Last active
November 8, 2023 01:09
-
-
Save rbrayb/9b9889419fa8edf3c4c7461e6a4d19fd to your computer and use it in GitHub Desktop.
Changing the MFA provider for Azure AD B2C
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> | |
<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | |
xmlns:xsd="http://www.w3.org/2001/XMLSchema" | |
xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="tenant.onmicrosoft.com" PolicyId="B2C_1A_AuthSignalMFA" PublicPolicyUri="http://tenant.onmicrosoft.com/B2C_1A_AuthSignalMFA" | |
DeploymentMode="Development" | |
UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights" | |
> | |
<BasePolicy> | |
<TenantId>tenant.onmicrosoft.com</TenantId> | |
<PolicyId>B2C_1A_TRUSTFRAMEWORKEXTENSIONSMFA</PolicyId> | |
</BasePolicy> | |
<BuildingBlocks> | |
<ClaimsSchema> | |
<ClaimType Id="appScope"> | |
<DisplayName>appScope</DisplayName> | |
<DataType>string</DataType> | |
</ClaimType> | |
<ClaimType Id="ClientId"> | |
<DisplayName>ClientId</DisplayName> | |
<DataType>string</DataType> | |
</ClaimType> | |
<ClaimType Id="requestBody"> | |
<DisplayName>requestBody</DisplayName> | |
<DataType>string</DataType> | |
</ClaimType> | |
<ClaimType Id="bearerToken"> | |
<DisplayName>bearerToken</DisplayName> | |
<DataType>string</DataType> | |
</ClaimType> | |
<ClaimType Id="actionCode"> | |
<DisplayName>actionCode</DisplayName> | |
<DataType>string</DataType> | |
</ClaimType> | |
<ClaimType Id="actionState"> | |
<DisplayName>actionState</DisplayName> | |
<DataType>string</DataType> | |
</ClaimType> | |
</ClaimsSchema> | |
<ClaimsTransformations> | |
<ClaimsTransformation Id="authsignalInitAuthRequestBody" TransformationMethod="GenerateJson"> | |
<InputClaims> | |
<InputClaim ClaimTypeReferenceId="objectId" TransformationClaimType="userId"/> | |
<InputClaim ClaimTypeReferenceId="appScope" TransformationClaimType="scope"/> | |
<InputClaim ClaimTypeReferenceId="ClientId" TransformationClaimType="appId"/> | |
</InputClaims> | |
<InputParameters> | |
<InputParameter Id="action" DataType="string" Value="signin"/> | |
<!-- Allow user to self-manage MFA options --> | |
<InputParameter Id="redirectToSettings" DataType="boolean" Value="true"/> | |
</InputParameters> | |
<OutputClaims> | |
<OutputClaim ClaimTypeReferenceId="requestBody" TransformationClaimType="outputClaim"/> | |
</OutputClaims> | |
</ClaimsTransformation> | |
<ClaimsTransformation Id="CreateClientId" TransformationMethod="CreateStringClaim"> | |
<InputParameters> | |
<InputParameter Id="value" DataType="string" Value="25b...521"/> | |
</InputParameters> | |
<OutputClaims> | |
<OutputClaim ClaimTypeReferenceId="ClientId" TransformationClaimType="createdClaim"/> | |
</OutputClaims> | |
</ClaimsTransformation> | |
<ClaimsTransformation Id="CreateAppScope" TransformationMethod="CreateStringClaim"> | |
<InputParameters> | |
<InputParameter Id="value" DataType="string" Value="readonly"/> | |
</InputParameters> | |
<OutputClaims> | |
<OutputClaim ClaimTypeReferenceId="appScope" TransformationClaimType="createdClaim"/> | |
</OutputClaims> | |
</ClaimsTransformation> | |
</ClaimsTransformations> | |
</BuildingBlocks> | |
<ClaimsProviders> | |
<ClaimsProvider> | |
<Domain>Contoso.com</Domain> | |
<DisplayName>Contoso</DisplayName> | |
<TechnicalProfiles> | |
<TechnicalProfile Id="REST-Authsignal-Connect-API"> | |
<DisplayName>Authsignal Connect API</DisplayName> | |
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/> | |
<Metadata> | |
<Item Key="SendClaimsIn">Body</Item> | |
<Item Key="AuthenticationType">Basic</Item> | |
<Item Key="AllowInsecureAuthInProduction">false</Item> | |
<Item Key="ResolveJsonPathsInJsonTokens">true</Item> | |
<Item Key="ClaimUsedForRequestPayload">requestBody</Item> | |
<Item Key="DefaultUserMessageIfRequestFailed">Cannot process your request right now, please try again later.</Item> | |
</Metadata> | |
<CryptographicKeys> | |
<Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_AuthsignalTenantAPISecret"/> | |
<Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_AuthsignalTenantAPISecret"/> | |
</CryptographicKeys> | |
<InputClaims> | |
<InputClaim ClaimTypeReferenceId="requestBody"/> | |
</InputClaims> | |
</TechnicalProfile> | |
<TechnicalProfile Id="authsignalOidcInitAuth"> | |
<DisplayName/> | |
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/> | |
<Metadata> | |
<Item Key="ServiceUrl">https://au-connect.authsignal.com/init-auth</Item> | |
</Metadata> | |
<InputClaimsTransformations> | |
<InputClaimsTransformation ReferenceId="CreateAppScope"/> | |
<InputClaimsTransformation ReferenceId="CreateClientId"/> | |
<InputClaimsTransformation ReferenceId="authsignalInitAuthRequestBody"/> | |
</InputClaimsTransformations> | |
<InputClaims> | |
<InputClaim ClaimTypeReferenceId="requestBody"/> | |
</InputClaims> | |
<OutputClaims> | |
<OutputClaim ClaimTypeReferenceId="bearerToken" PartnerClaimType="token"/> | |
</OutputClaims> | |
<IncludeTechnicalProfile ReferenceId="REST-Authsignal-Connect-API"/> | |
</TechnicalProfile> | |
<TechnicalProfile Id="authsignalOidcAuth"> | |
<DisplayName>authsignal</DisplayName> | |
<Protocol Name="OpenIdConnect"/> | |
<Metadata> | |
<Item Key="METADATA">https://au-connect.authsignal.com/oidc/.well-known/openid-configuration</Item> | |
<Item Key="client_id">6ce...3e9</Item> | |
<Item Key="authorization_endpoint">https://au-connect.authsignal.com/oidc/auth</Item> | |
<Item Key="AccessTokenEndpoint">https://au-connect.authsignal.com/oidc/token</Item> | |
<Item Key="response_types">code</Item> | |
<Item Key="scope">openid</Item> | |
<Item Key="HttpBinding">POST</Item> | |
<Item Key="response_mode">form_post</Item> | |
<Item Key="token_endpoint_auth_method">client_secret_post</Item> | |
<Item Key="UsePolicyInRedirectUri">false</Item> | |
<Item Key="IncludeClaimResolvingInClaimsHandling">true</Item> | |
<Item Key="ResolveJsonPathsInJsonTokens">true</Item> | |
</Metadata> | |
<CryptographicKeys> | |
<Key Id="client_secret" StorageReferenceId="B2C_1A_AuthsignalTenantAPISecret"/> | |
</CryptographicKeys> | |
<InputClaims> | |
<InputClaim ClaimTypeReferenceId="bearerToken" PartnerClaimType="token"/> | |
</InputClaims> | |
<OutputClaims> | |
<OutputClaim ClaimTypeReferenceId="actionCode" PartnerClaimType="action_code"/> | |
<OutputClaim ClaimTypeReferenceId="actionState" PartnerClaimType="action_state"/> | |
</OutputClaims> | |
</TechnicalProfile> | |
</TechnicalProfiles> | |
</ClaimsProvider> | |
</ClaimsProviders> | |
<UserJourneys> | |
<UserJourney Id="SignUpOrSignIn-MFA"> | |
<OrchestrationSteps> | |
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin"> | |
<ClaimsProviderSelections> | |
<ClaimsProviderSelection TargetClaimsExchangeId="FacebookExchange"/> | |
<ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange"/> | |
</ClaimsProviderSelections> | |
<ClaimsExchanges> | |
<ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email"/> | |
</ClaimsExchanges> | |
</OrchestrationStep> | |
<!-- Check if the user has selected to sign in using one of the social providers --> | |
<OrchestrationStep Order="2" Type="ClaimsExchange"> | |
<Preconditions> | |
<Precondition Type="ClaimsExist" ExecuteActionsIf="true"> | |
<Value>objectId</Value> | |
<Action>SkipThisOrchestrationStep</Action> | |
</Precondition> | |
</Preconditions> | |
<ClaimsExchanges> | |
<ClaimsExchange Id="FacebookExchange" TechnicalProfileReferenceId="Facebook-OAUTH"/> | |
<ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail"/> | |
</ClaimsExchanges> | |
</OrchestrationStep> | |
<!-- For social IDP authentication, attempt to find the user account in the directory. --> | |
<OrchestrationStep Order="3" Type="ClaimsExchange"> | |
<Preconditions> | |
<Precondition Type="ClaimEquals" ExecuteActionsIf="true"> | |
<Value>authenticationSource</Value> | |
<Value>localAccountAuthentication</Value> | |
<Action>SkipThisOrchestrationStep</Action> | |
</Precondition> | |
</Preconditions> | |
<ClaimsExchanges> | |
<ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError"/> | |
</ClaimsExchanges> | |
</OrchestrationStep> | |
<!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). | |
This can only happen when authentication happened using a social IDP. If local account was created or authentication done | |
using ESTS in step 2, then an user account must exist in the directory by this time. --> | |
<OrchestrationStep Order="4" Type="ClaimsExchange"> | |
<Preconditions> | |
<Precondition Type="ClaimsExist" ExecuteActionsIf="true"> | |
<Value>objectId</Value> | |
<Action>SkipThisOrchestrationStep</Action> | |
</Precondition> | |
</Preconditions> | |
<ClaimsExchanges> | |
<ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social"/> | |
</ClaimsExchanges> | |
</OrchestrationStep> | |
<!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent | |
in the token. --> | |
<OrchestrationStep Order="5" Type="ClaimsExchange"> | |
<Preconditions> | |
<Precondition Type="ClaimEquals" ExecuteActionsIf="true"> | |
<Value>authenticationSource</Value> | |
<Value>socialIdpAuthentication</Value> | |
<Action>SkipThisOrchestrationStep</Action> | |
</Precondition> | |
</Preconditions> | |
<ClaimsExchanges> | |
<ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId"/> | |
</ClaimsExchanges> | |
</OrchestrationStep> | |
<!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect | |
from the user. So, in that case, create the user in the directory if one does not already exist | |
(verified using objectId which would be set from the last step if account was created in the directory. --> | |
<OrchestrationStep Order="6" Type="ClaimsExchange"> | |
<Preconditions> | |
<Precondition Type="ClaimsExist" ExecuteActionsIf="true"> | |
<Value>objectId</Value> | |
<Action>SkipThisOrchestrationStep</Action> | |
</Precondition> | |
</Preconditions> | |
<ClaimsExchanges> | |
<ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId"/> | |
</ClaimsExchanges> | |
</OrchestrationStep> | |
<!-- Init. Authsignal. These two steps replace the default MFA. --> | |
<OrchestrationStep Order="7" Type="ClaimsExchange"> | |
<ClaimsExchanges> | |
<!-- <ClaimsExchange Id="PhoneFactor-Verify" TechnicalProfileReferenceId="PhoneFactor-InputOrVerify"/> --> | |
<ClaimsExchange Id="Init-Auth" TechnicalProfileReferenceId="authsignalOidcInitAuth"/> | |
</ClaimsExchanges> | |
</OrchestrationStep> | |
<!-- MFA with Authsignal --> | |
<OrchestrationStep Order="8" Type="ClaimsExchange"> | |
<ClaimsExchanges> | |
<ClaimsExchange Id="OIDC" TechnicalProfileReferenceId="authsignalOidcAuth"/> | |
</ClaimsExchanges> | |
</OrchestrationStep> | |
<OrchestrationStep Order="9" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer"/> | |
</OrchestrationSteps> | |
<ClientDefinition ReferenceId="DefaultWeb"/> | |
</UserJourney> | |
</UserJourneys> | |
<RelyingParty> | |
<DefaultUserJourney ReferenceId="SignUpOrSignIn-MFA"/> | |
<UserJourneyBehaviors> | |
<JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="410...5d0" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0"/> | |
</UserJourneyBehaviors> | |
<TechnicalProfile Id="PolicyProfile"> | |
<DisplayName>PolicyProfile</DisplayName> | |
<Protocol Name="OpenIdConnect"/> | |
<OutputClaims> | |
<OutputClaim ClaimTypeReferenceId="displayName"/> | |
<OutputClaim ClaimTypeReferenceId="givenName"/> | |
<OutputClaim ClaimTypeReferenceId="surname"/> | |
<OutputClaim ClaimTypeReferenceId="email"/> | |
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/> | |
<OutputClaim ClaimTypeReferenceId="identityProvider"/> | |
<OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}"/> | |
</OutputClaims> | |
<SubjectNamingInfo ClaimType="sub"/> | |
</TechnicalProfile> | |
</RelyingParty> | |
</TrustFrameworkPolicy> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
https://medium.com/the-new-control-plane/changing-the-mfa-provider-for-azure-ad-b2c-997dfd3ab2dc