Share via

B2C Sign in with magic link but not quite

Robin Deprins 101 Reputation points
2020-03-23T14:21:55.52+00:00

I'm looking for a method to log in a user using a link sent by mail.
The Sign-in with a magic link sample policy comes very close to what I want to achieve.

My first issue with it is that the process is triggered from a button on the sign-in page. Because I need to provide additional information I need to generate the link and send the mails from my web application instead. That seems reasonably easy to solve though, B2C just sends the info to the IdentityController so I could use this same code anywhere else.

But my main issue with this sample is that it requires the web app to set up a certificate and host an OIDC endpoint. So the web app becomes the source of trust.
What even is the point of B2C if it's not generating or validating the tokens?
It seems like I'm adding an extra attack surface on our application. One of the reasons we use B2C is so we don't have to deal with the dangers of authenication.
Or am I seeing this wrong?

Another option I was looking at is the OAuth 2.0 On-Behalf-Of flow. That does use B2C as the source of trust but is not intended to create user tokens. It's for authenticating one app with the parent app. Would it be a bad idea to try to use such an OBO access token to authenticate a user instead?

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,697 questions
0 comments
Accepted answer
  1. Robin Deprins 101 Reputation points
    2020-03-24T14:18:38.277+00:00

    Thanks to "Jas Suri" on stackoverflow for pointing out that the answer was in the description of the B2C sample I linked all along. I couldn't quite connect the dots myself.
    https://stackoverflow.com/questions/60826495/generating-a-magic-login-link-with-azure-b2c-as-the-authority/60831730#60831730

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Robin Deprins 101 Reputation points
    2020-07-08T06:36:17.493+00:00

    We generate an id 'hint' token with the code found here
    https://github.com/azure-ad-b2c/samples/blob/master/policies/invite/source-code/AzureADB2C.Invite/Controllers/HomeController.cs
    This is not a login token yet, it just tells B2C you authorize this action.

    Then with a custom policy based on this you validate that token
    https://github.com/azure-ad-b2c/samples/blob/master/policies/sign-in-with-magic-link/policy/SignInWithMagicLink.xml
    You'll need to upload the same signing key here so that B2C can verify that the hint token is valid. Then it looks up the user and generates a login JWT. This second key generation can be done with another key or you reuse the same key.

    If all is well you'll get redirected to your reply url with a valid token. In our case we were using the built-in B2C policies for our normal login flow and you cannot access the secrets of those from a custom policy. So our normal login enpoint could not be used and we made a secondary one specifically for magic links