Azure B2C as a Claims Provider to ADFS to use with federated partners using oAuth

Syed Palayathar 486 Reputation points
2021-08-04T17:18:50.84+00:00

Dear Experts

Application hosted on-premise. So far they have used WS-Fed to federate between application ADFS [RP] and authentication [IP-STS] ADFS server. Users log on to ADFS endpoint to get a security token. This security token browser redirected to the user for consuming the application

Now, we would like to make use of Azure AD B2C as IDM.

Application developers want to use oAuth2.0. They want B2C to send the oAuth2.0 token to their ADFS token consumer endpoint.

I have two questions:

I know that ADFS could be configured to receive SAML tokens. Could ADFS be configured to receive the oAuth2.0 token from B2C? i.e. Azure B2C as a Claims Provider to ADFS to use with federated partners or Federating ADFS as Relying Party with B2C using oAuth

Thanks for your time

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,639 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. VipulSparsh-MSFT 16,231 Reputation points Microsoft Employee
    2021-08-05T04:22:30.853+00:00

    @Syed Palayathar Yes you can absolutely do that.

    Follow our github to know the steps : https://github.com/azure-ad-b2c/saml-sp/blob/master/source-code/adfs-claims-provider/readme.md

    You will need to work with the custom profiles and after following the docs, your relying party technical profile will look like this:

    <TechnicalProfile Id="PolicyProfile">
    <DisplayName>PolicyProfile</DisplayName>
    <Protocol Name="SAML2" />
    <Metadata>
    <Item Key="PartnerEntity">https://sts.contoso.con/federationmetadata/2007-06/federationmetadata.xml</Item>
    </Metadata>
    <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="displayName" />
    <OutputClaim ClaimTypeReferenceId="givenName" />
    <OutputClaim ClaimTypeReferenceId="surname" />
    <OutputClaim ClaimTypeReferenceId="email" DefaultValue="" />
    <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="" />
    <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="objectId" />
    </OutputClaims>
    <SubjectNamingInfo ClaimType="objectId" ExcludeAsClaim="true" />
    </TechnicalProfile>

    -----------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.