Tuesday, August 30, 2022

Azure AD B2C configuration note

 In Azure AD B2C, multiple user flows can be defined for different purposes, for example, signin, signup, or reset password. These user flows can be used by any app registration, so they are global AD B2C configuration, and do not belong to a particular app registration.

In order to test Azure AD B2C with a particular web app, theoretically, there is nothing that need to be changed in application side, an web or SPA app can just hook up with Azure AD B2C without any changes. In the end, after Azure authentication is finished, a bearer token is provided by Azure AD B2C in request header to the web app,  and web app can validate the token to accept or reject the request, but if the web app does nothing, then it should work as usual.

When registering an app to Azure AD B2C, it needs to provide a redirect URL to tell Azure B2C where to redirect the client after Azure B2C authentication. The app registration also generate an application ID (or client id), which the client request must provide when it initializes authentication request, so Azure B2C can validate the request is sent from a registered application.