Azure AD B2C As a Federation with multiple identity providers

Question

Hi,

I have an application 'SampleApp' which is using Azure AD B2C for authentication purpose. The 'SampleApp' application is being used by two types of users - employees & customers. Both employee and customer users are part of different AD instances (AD1 for employees and AD2 for customers). Now there is a need to integrate 'SampleApp' with a new application 'TestApp'. The 'TestApp' will be hosted in AWS and will use Cognito for managing users at its local level.
There is a need to have a SSO solution in place for this application, so that users once logged in to 'SampleApp' will be able to directly access 'TestApp' with a url link.

I have created a B2C Custom Policy and I am successfully able to integrate the two applications for users in one of the active directories, AD1. So users with employee role are able to SSO into both the applications are do get necessary claims too. I need to incorporate the remaining active directory, AD2, in the same custom policy.

• Want to know whether it is possible to do so?
• If both identity providers are configured in the Custom Policy, how to identify which AD is to be used when and how to configure it in B2C ?
• Since this custom policy is used as federation from AWS Cognito, will the authorization endpoint change when there are two AD's involved?
• How will the federation configuration understand the role (employee/customer) in the incoming request from 'SampleApp' to 'TestApp' in AWS and which AD to use for authentication and claims ?

Answer 1

It is possible to incorporate multiple identity providers in a B2C Custom Policy. You can configure each identity provider separately and specify the identity provider to be used based on the user flow. You can use the "IdentityProviderSelection" technical profile to select the identity provider based on the user's input. The authorization endpoint will not change when there are multiple identity providers involved. The role of the incoming request can be identified using the claims in the token. You can use the "ClaimsTransformation" technical profile to transform the claims as needed.

---

References:

• Register a SAML application in Azure AD B2C (b2c-custom-policy)
• Set up sign-up and sign-in with SAML identity provider using Azure Active Directory B2C (b2c-custom-policy)
• Configure SAML identity provider options with Azure Active Directory B2C (b2c-custom-policy)