Pre-requisits to setup things on AD B2C before the SAML setup

Prashant N 1

Hi,

Wanted to know what and all should be in place on AD B2C instance before we start configuring the AD B2C with any external application for SSO using SAML. Basically after procuring of the new AD B2C instance, what configurations should be in place on AD B2C for SSO.

JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2021-12-09T23:35:48.38+00:00

@Prashant N
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

1 answer

AmanpreetSingh-MSFT 56,311 Reputation points

2021-11-11T05:03:31.483+00:00
Hi @Prashant N • Thank you for reaching out. Please find below the steps that you need to perform and the detailed documentation for step by step walkthrough.

First, you need to set up signing certificates, create the policy key, and upload the certificate.

Enable your policy to connect with a SAML application by configuring the SAML Technical Profiles in the TrustFrameworkExtension file.

Configure your policy to issue a SAML response by configuring the signup_signin file.

Register your SAML application in Azure AD B2C using Azure AD B2C > App registrations > New registration

Configure Azure AD B2C as a SAML IdP in your SAML application by providing B2C metadata URL in the application configuration. Example of B2C metadata URL: https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/Samlp/metadata.

For step-by-step instructions and a detailed walkthrough of these steps, please refer to Register a SAML application in Azure AD B2C.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Prashant N 1 Reputation point

2021-11-11T15:41:22.43+00:00

Thanks

We followed the steps what you have described here but getting the following error when we tried to integrate with eCommerce application for login authentication with AD B2C. Any pointers?

<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester" />
<samlp:StatusMessage>The request exceeds the allowable time to live.</samlp:StatusMessage>
<samlp:StatusDetail>
<IsPolicySpecificError>false</IsPolicySpecificError>
</samlp:StatusDetail>
</samlp:Status>

AmanpreetSingh-MSFT 56,311 Reputation points

2021-11-11T17:06:01.263+00:00

@Prashant N · Have you Collected Azure Active Directory B2C logs with Application Insights to get more details about the error? I suspect that this is due to the time difference (clock skew) between the application sending the SAML request and B2C. Make sure there are no more than ±5 minutes of difference.

Again, App Insights may provide more details about the problem.

Prashant N 1 Reputation point

2021-11-12T04:23:39.493+00:00

Not yet, have asked customer to collect the logs

Can you confirm the option how to register SP Entity ID metadata and its ACS URL in AD B2C for SAML? suspecting issue could be with these settings/configurations.

Thanks

Prashant N 1 Reputation point

2021-11-12T13:29:31.423+00:00

hello,

Issue is resolved, Thanks for the support.

Is there a way to generate the JWT Token as part of return URL from AD B2C after the successful authentication from AD B2C using SAML.

AmanpreetSingh-MSFT 56,311 Reputation points

2021-11-16T08:41:16.717+00:00

@Prashant N · Thanks for the update. Not sure about the entire setup, but if you have federated SAML based IDP with B2C and B2C issues JWT to the application, you need to make sure that the authentication request from the Application includes response_mode parameter and should be either set to query or fragment.

Response_mode parameter specifies the method that should be used to send the resulting token back to your app. Can be one of the following:

query

fragment

form_post

query provides the code as a query string parameter on your redirect URI. If you're requesting an ID token using the implicit flow, you can't use query as specified in the OpenID spec. If you're requesting just the code, you can use query, fragment, or form_post. form_post executes a POST containing the code to your redirect URI.

Please check below request to understand how the request with this parameter looks like:

https://amsin.b2clogin.com/amsin.onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_SuSiV3&client_id=a7eb03a0-c31a-4e9c-b07c-345b94604b17&nonce=defaultNonce&redirect_uri=https%3A%2F%2Fjwt.ms%2F&scope=openid&response_type=id_token&response_mode=fragment&prompt=login

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

AmanpreetSingh-MSFT 56,311 Reputation points

2021-11-25T07:59:55.617+00:00

@Prashant N · Just checking if you had a chance to test it out. If the issue is resolved, kindly "Accept the answer" to help others in the community as well.
Sign in to comment