Hybrid authentication scenario - Azure AD B2C and Azure AD

Question

I have this scenario where we have to authenticate corporate users via Azure AD, but the external users via Azure AD B2C - all from the same login screen.

There are a few web applications which will share this capability. The applications come from various technology stacks, ranging from .Net to Java-Spring + Angular 2.

What is your recommended approach for this? Apologies, if this question has already been asked and answered, but couldn't find much guidance on this. Will MSAL library solve this? Besides, there aren't any MSAL implementation for Java yet. Will Azure AD B2C Premium support this?

Thanks in advance for your help!

Answer 1

At this time your only option is to implement support for both Azure AD & Azure AD B2C independently in your applications. You must ask the user to select between the two identity providers, and then invoke the correct one.

There are plans to add support for Azure AD org users as an identity provider in Azure AD B2C, at which point two integrations will not be necessary. However that capability isn't in the near future.

I slapped together a bit of guidance on how to support both in a .NET application, perhaps that will get you on the right track: https://github.com/dstrockis/AAD-B2C-Hybrid

Answer 2

To use the Azure AD for corporate users login and Azure B2C for external users you need to Configure the following

Step 1 - Configure Identity providers If you are using the Identity Experience Framework policy

• Create Azure AD Claims Provider using OpenIdConnect Protocol for Corporate user Authentication
• Create Azure AD B2C Claims Provider using login-NonInteractive TechnicalProfile for External user Authentication
• Add the above two to <ClaimsProviderSelections> under <UserJourneys> --> <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signupsignin">

Example:

      <ClaimsProviderSelections>
        <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
        <ClaimsProviderSelection TargetClaimsExchangeId="AADExchange" />
      </ClaimsProviderSelections>
      <ClaimsExchanges>
        <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
      </ClaimsExchanges>
    </OrchestrationStep>

If you are using User flows then you need to configure the following

• Register the Azure AD as a new OpenID Connect provider in Identity Providers of Azure AD B2C
• In the User Flow policy, Choose Email Signin under Local Accounts for External user authentication
• In the User Flow policy, Choose the newly created OpenID Connect provider for the Corporate User Authentication

Step 2 - Create a App registration

Step 3 - Configure the Redirect URIs for the app created in App Registration to your Application URL's

Step 4 - When you test the policy, you will be presented with 2 options, username and password for the External user authentication where the user use the username and password configured for them in Azure AD B2C and the second option is a Link at the bottom off the signin page to login with Azure AD. When users click on this link, they will be taken to the Azure AD Login page for authentication.

Refer to the below link for more detailed configuration steps

https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-single-tenant-custom?tabs=app-reg-ga