This document provides an overview of managing application identity using Azure B2C. It begins with introductions and an agenda. It then covers key concepts around identity, OpenID Connect, and options for identity as a service. It distinguishes Azure AD, B2B, and B2C and their uses. The bulk of the document focuses on Azure B2C, covering what it is, types of applications supported, SSO and federation capabilities. It includes demos of configuring a B2C tenant and using the authorization code flow with PKCE. It concludes with advanced B2C features like user journeys, the Graph API, and identity protection.

1. © 2020 Lunavi | Confidential |
MANAGING APPLICATION IDENTITY
USING AZURE B2C
Mike Douglas

2. © 2020 Lunavi | Confidential | 2
ABOUT ME
• Mike Douglas
• Solution Consultant and Director of Delivery Engineering at
Lunavi
• Microsoft MVP – Developer Technologies – DevOps
• Organizer of Omaha DevOps Meetup
• Competitive Robotics Club Coordinator for 4th – 6th Graders
• @mikedouglasdev on twitter

3. © 2020 Lunavi | Confidential | 3
AGENDA
• Identity Overview
• Azure B2C Overview
• Using B2C in Your Application
• Advanced Features

4. © 2020 Lunavi | Confidential | 4
IDENTITY
• What is Identity?
− Controls access to system or service based on credentials of user
− Authentication – validating a user is who they claim to be
− Authorization – provides access to specific resource
• Social vs Enterprise
− You own the account VS Organization owns the account
− Facebook, Google, etc. VS O365, AAD, ADFS
• SSO and Federation
• Standards – SAML and Open ID Connect

5. © 2020 Lunavi | Confidential | 5
OPEN ID CONNECT
• Parts
− Identity Providers (IdP), Token / Service Providers (TP/SP)
− JWT (JSON Web Token)
− OAuth2
• Flows
− Authorization Code Flow
− Implicit Flow
− Client Credentials Grant Flow
− Resource Owner Flow
− Auth Code with PKCE replaces
• ROPF and Implicit

6. © 2020 Lunavi | Confidential | 6
OIDC OPTIONS
• Identity Server
• ADFS, Ping Federate
• Identity as a Service
− Okta, AuthO, Azure AD, Azure B2C

7. © 2020 Lunavi | Confidential | 7
AAD VS B2C VS B2B
• Azure AD
− Enterprise Organization IDs = Employees
− Protect apps with internal users – use this
− RBAC for your application resources
• Azure B2B
− SAAS Partners
− You want partners to use your apps but have them manage their users
− Want your app to be the O365 / AAD SSO Directory
• Azure B2C
− External Users, Default is a Self Service Sign up / Sign in
− Local (email / no email)
− Social (Facebook, Google, etc)
− Federate other OIDC and SAML

8. © 2020 Lunavi | Confidential |
AZURE B2C

9. © 2020 Lunavi | Confidential | 9
AZURE B2C
• Identity Protection for your Customers
− Protect against attacks (Password Spray, DDOS, Bot, etc)
− Identity and Mitigate Risk
− MFA
• High Availability and Globally Available
• Extensive and Custom User Flows
• Billing – Monthly Active Users (MAU) / First 50K Free

10. © 2020 Lunavi | Confidential | 10
TYPES OF APPLICATIONS SUPPORTED
• Web Applications (Server)
• SPA (Angular / React)
− Implicit Flow
− Authorization Code Flow with PKCE
• Web APIs
• Mobile / Native Applications
• Not Support
− Services / Daemons
− On-Behalf-Of Flow

11. © 2020 Lunavi | Confidential | 11
SSO / FEDERATION
• Azure B2C – IdP and/or SP
− SAML
− OIDC
Azure B2C
Service
Provider
SAML/OAuth
IDP
OKTA/FB/
Google/
SalesForce
B2C as SP
B2C as IdP

12. © 2020 Lunavi | Confidential | 12
AZURE AD AND B2C
Okta
B2C
Identity
Provider
Local Users
Okta Users
API
Management
(Validate JWT)
Token
Provider
Enterprise
Identity Provider
Federation
AAD
(RBAC)
API
Organization Tenant
External Identities
Tenant (B2C)
Google
Social
Identity Provider
Google
Users
Validate
Org Users
Web
Authenticate

13. © 2020 Lunavi | Confidential |
DEMO 1 – AZURE B2C
CONFIGURATION

14. © 2020 Lunavi | Confidential |
USING B2C IN YOUR APPLICATION

15. © 2020 Lunavi | Confidential | 15
MSAL
• https://docs.microsoft.com/en-us/azure/active-
directory/develop/reference-v2-libraries

16. © 2020 Lunavi | Confidential | 16
AUTH CODE GRANT WITH PKCE

17. © 2020 Lunavi | Confidential |
DEMO 2 – AUTH CODE WITH PKCE

18. © 2020 Lunavi | Confidential |
ADVANCED FEATURES

19. © 2020 Lunavi | Confidential | 19
ADVANCED FEATURES
• User Journeys
− Identity Experience Framework
− GitHub Examples - https://github.com/azure-ad-b2c/samples
• Graph API
• Identity Protection and Conditional Access

20. © 2020 Lunavi | Confidential |
QUESTIONS?