.Net Foundation On .NET, 4 Sep 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Customer Identity Management with Azure AD - On.NET

Description

Azure Active Directory (Azure AD) B2C is a cloud identity management service that enables your applications to authenticate your customers. This white-label service is customizable, scalable, and reliable, and can be used on iOS, Android, and .NET, or any other platform.

In this episode, Parakh Jain (@jainparakh) from the Azure AD B2C team joins Rich to give us an overview of how the service works, and also show how we can quickly connect B2C to an ASP.NET Core application.
01:01 - What is Azure AD B2C?
04:13 - Azure AD B2C compared to Azure AD
05:26 - What's the sign-in workflow?
06:43 - Available identity providers
08:36 - Connecting an ASP.NET Core app to B2C
17:45 - What's the pricing model?

Useful Links
Azure Active Directory B2C: https://azure.microsoft.com/en-us/services/active-directory-b2c/?WT.mc_id=ondotnet-channel9-cephilli
Azure AD B2C documentation: https://docs.microsoft.com/en-us/azure/active-directory-b2c/?WT.mc_id=ondotnet-channel9-cephilli
Azure Identity and Access Management blog: https://azure.microsoft.com/en-us/blog/topics/identity-access-management/?WT.mc_id=ondotnet-channel9-cephilli
Create a Free Account (Azure): https://aka.ms/azft-net

A

Today, on, on.net show we're going to be learning about azure ad b2c,, which allows you to add identities to your app easily.. Come watch.

B

Save the date for.net conf 2018,.

B

On september, 12-14..net conf is a free,.

B

Three-Day virtual developer event co-organized by the .net community and microsoft.

B

you'll, enjoy a wide selection of live sessions that feature speakers from the community and the .net product teams.

B

head over to www.dotnetconf.net to learn more and save the date.

A

Welcome to another episode of on.net.

A

Today, we're going to be talking about azure ad b2c with pirog.

A

Okay., how about you introduce yourself and then we can dig into the topic.

A

so, what the heck is. Azure ad b2c.

C

Absolutely., thank you for having me here., no problem.. I am a product manager or program manager working on the azure active directory, b2c team.

C

What this service is, for azure, is a way.

C

For you to add an identity system into your applications.

C

So, that customers can sign in,, right.

C

So,, let me start off with example.

C

Real madrid is using-, that's a soccer team, right?, that is a soccer team.. That's the football team.

C

Okay. yeah. from madrid, and what they've done on their application,, the realmadrid.com, they're, using our sign in service,, the azure ad b2c sign in service, to allow fans to sign in.

C

then, once they do, the application. Realmadrid.Com,.

C

Would effectively get their information coming from azure,, but going to the application.

A

Right., because when I login into my office, 365 email account.

A

That microsoft provides me as an employee or into sharepoint, also,. Microsoft provides me as an employee.

A

there, I'm using azure ad.

A

That's what I'm opting against, right?.

C

That's right. yeah.

A

Because that's the employee, scenario. exactly., this is not that, right? no. so,. This is for?.

C

The consumers,, the customers,, the citizens,, if you're a government. right.

A

It's for the person out there,.

C

Who wants to just sign up for an application.

A

Right. so,, like for the microsoft store for example,, you can log in and have an account and buy laptops and copies of office. Presumably.

C

A

They could use azure ad b2c.

C

Yeah. so, in fact,.

C

I'll would jump into another example.. We have another danish company who's using b2c.

C

You can see they have a customized experience. That's.

C

Completely different from real madrid.

C

so,, it's a completely white label..

C

They designed the experience that they want and if.

C

You want,, you can have it in 36 different languages as well as of today.

A

Okay. is that how many languages your strings are localized in?.

C

Yeah., actually, they can customize the string completely. so, if they wanted to create their own language and they specify it, go for it.

C

A

Yeah. right. so,, there's no real limitations.

A

C

Do you provide an out-of-the-box off ui or no?.

C

We do., we do., I can show you that., but I assume that's not it.. That's not it. so,. What they did was they took the html css..

C

They provided their own html css and that's what we we render.

A

Okay., you guys are totally cool with that?.

C

Yeah, absolutely.

A

Okay. awesome. just keep on going.

C

Cool. so, just to kind of quickly summarize what b2c is it's allowing.

C

Customers of organizations to bring their own identities,.

C

To allow them to sign in to you-, say your applications.

C

If you real, madrid, customers could bring their twitter,.

C

Their facebook identities and actually just sign into realmadrid.com.. If you were a government, then you for a government as a citizen,. You could use your government id as a way to sign in.

C

It's allowing governments and all of these organizations to scale very quickly as the organization scale.

C

You're not hindered by the fact that it's growing quickly, it's going viral, and oh, crap,. Your database can't handle these users.

A

Right. so here,, let me ask a super fundamental question,, which is we already have this active directory system,.

A

There's obviously existing active directory,, but azure active directory has existed for what 5-6 years now or maybe longer..

A

We already have that. Why didn't we just use that for real madrid, for example, to sign up their customers?? Why do we need something different?

A

or how are they different?.

C

Yeah. so,: there are two main reasons: why.

C

First is scale. typically,. If you look at in your organization, look at the number of employees, they have. it's rare for it to be in the millions, whereas.

A

Organizations get hit.

C

Hundreds of millions, if not billions.,.

A

I'm assume us post office.

C

Absolutely, right. absolutely., then the other thing is this: the ability to customize. the flexibility of being able to customize the user, experience, the whole branding of it, the look, and feel not that we're presenting that this is microsoft,.

C

But presenting that this is your own brand.. That's the biggest appeal for using b2c.

A

I see. so, it's kind of more oriented.

A

To the isv market, sort of thing.

C

A

Makes sense. okay. so, that's kind of a value prop.

A

Maybe we should talk more about,, a littlemore about the flow of how the system works.

C

Okay, yeah. so,. Imagine this scenario.

C

Let's just call it contoso, where there are three applications that contoso's building a gaming, application, billing, application, music, application.

C

say,, there's a user named john.

C

john comes through the gaming application and wants to sign it..

C

He clicks sign in and what will happen is that john will be redirected to the service,, the azure ad b2c service,, where he will be presented with options and how john wants to sign in.

C

once he does, he's sign in and successfully, a token will be issued back to the application..

C

Now the cool part is this unlocks sso.

C

so,. If he were to go back to the gaming application,, the billing application, the music application, he doesn't need to sign in again.

A

Right. sso, we mean single sign-on.

C

Absolutely. yeah. right. all of this, is configured in b2c using a concept we call policy.

C

It's really the crux of it: all. it's hey,, there's a user flow that I want to build.

C

It has a different ui experience.. It has certain token lifetimes..

C

How do I configure all of that?? We configure it through policies.

A

Okay. yeah. makes sense., so it looks like on the slide here.

A

That you have a federation system as well.

A

So it's not just this case of like, oh,.

A

You have to create a microsoft account,.

A

Like we've kind of had in the past. basically,, there is at least facebook and google. I see listed there that you can just sign in with those and then you're already part of the system..

A

Are there more than just those two? yeah., there's quite a few? Actually, I can show it to.

C

You by taking you to our portal.

C

all of the options that we have available.

C

So,, what you're looking at here is the management experience for azure ad b2c.

C

If people worked on identity providers., I have four configured already.

C

one is for google,, one is from microsoft,, microsoft, accounts, and one is for facebook..

C

Then I have another one. That's a very custom: openid connect identity provider that I've configure,, which is connecting to an azure ad's tenant,.

C

An azure ad service.

A

Okay. is that the case if,.

A

Going back to the real madrid example., I was a real madrid employee.

A

I'm president of real madrid and I logged onto the website., can I then log in with my rich@realmadrid.com email address that actually opts to get azure ad.

A

Exactly. okay., that's actually pretty cool.

C

Yeah. so,, the whole idea is: why should you have multiple identities?.

A

Use one identity, go around the world,.

C

Do everything you need to do with that identity.? There are absolutely more identity providers. You can add.

C

So, today, just out-of-the-box in addition to those four you can linkedin, amazon, and some other ones that we haven't preview.

C

okay.. It looks like there are some that.

A

Are more asia, oriented. exactly. some chinese identity, providers?

A

yeah. awesome. for the chinese markets.

C

Yeah. we like that. yeah. in fact,. I can quickly walk you through the portal and kind of give you the laid out of the whole experience.

A

C

The first thing you'd want to do is create an application.

C

in fact,. Let me walk you through a demo here.

C

The demo we're going to build is an application.net core, 2.0 application.

C

By clicking on file, new project, and creating this application. you'll have b2c already configured.

A

Okay. wow. good., yeah. so,, the first thing I'd say, is go to file,.

C

New, and click on project.: let's select the.net asp, core application.

C

I'm going to give it a demoapp.

C

A

Very unique name.

C

Right., it's the most common name, available. all right.

C

So,, what I'm doing here, is, I'm changing the way authentication works., I'm configuring, how the project on what middlewares should be added to this system.

C

I'm going to select individual accounts because you as an individual are looking to sign in to end this application, as an individual looking to sign into the real madrid app in a sense.

C

so,. Instead of saying store the users in the app meaning,.

C

In a directory or in a store object, in a file object that has to in a sense even scale now with as the application scales., I get it., I'm going to store it in the cloud, with b2c, and what I'm going to provide here is my tenant name,.

C

The directory, where all the users will be stored., I'm going to provide the application id..

C

This is how you identify this application to azure active directory b2c.

C

okay. so,, I'm going to go over here, create this application.

A

Right. this application id,.

A

Would you consider that to be a secret?, it is not a secret.

C

It's not a secret., it's just an identifier. okay.. You can generate secrets, but that's a different one.

C

okay. inside the reply, url, which is where the token will be.

C

Sent back to after the user signs, then,.

C

I'm going to specify what the application would like me to specify. so, I'll, take "copy", hit "paste" in here.

C

Because this is a web app that I'm creating,.

C

I'm going to simply click "yes" over here and that's it..

C

I'm going to hit "save it" and hit "create"., so I've created,. I registered this application with b2c.

C

I've, as I showed you earlier,, also configured a few identity providers..

C

The way I would do this is, I would just go to their proper websites, their,, developer, consoles and register an application there they're just the way I did.

A

Understood. I've done that before.

A

cool. yeah. now,. The last thing that is critical,.

C

Which is what I was talking about. This policy is how you're creating these experiences.

C

There are multiple kinds of policies, but in this particular demo, I'm going to create two kinds. one is a signup or sign in experience and the other I'm going to create is a password reset. Experience.

C

A

Both of those sound important.

C

Yeah. so, very quickly, I'm going to do it out-of-the-box., I'm going to give it a name. Susidemo demo,.

C

And then the identity providers, I'll just say, "hey,.

C

I want users to be able to sign with their msa, google and facebook accounts." for the attributes,, the sign up, attributes I'll say,.

C

"Hey,, when you do sign up,, please give me your display name,.

C

What would you like me to call you?" I hit "okay".

A

I see. so,. This is effectively the information that the application- gets.

A

exactly. well,, sign up.

C

Attribute is the information that we collect during sign. Up. the, "hey, get user,, give us the information about you that you want us to know." right? so,. It could be, "hey,. Give me your gamer tag,.

C

Give me your street address,. Give me your shoe. Size.".

A

I see. so, is this the information from the federated system that b2c collects?.

C

That's right: too. okay. so,. We will also look at, "hey,. The federated system is giving us all this information. We will stored it. ", but in addition to that perhaps facebook doesn't have your shoe size,.

C

Then we'll say, "okay,.

A

Well, we don't have your shoe size, then,.

C

Can you give us that information, too?"., okay. cool. but here,, where you were going back to earlier, application claims.?

C

This is where I actually specify. What is that information that should be sent back to the application.

A

Okay. so,: these are two different things.

C

Two different things. now,, I assume.

A

Do these not necessarily have to overlap?.

A

C

Okay. yeah. I mean sometimes you just want to collect a lot of information during sign up, but certain applications, different applications use different amounts of data. okay.. Cool.. Here is where I would trigger just by switch of a button. I can turn on mfa..

C

I won't do it right, now,, but.

C

right. by clicking on, every time the user signs, in, they'll, have to use their phone to sign. In.

A

Right now,, if that's on,, that's going to affect the sign up experience as well.

A

C

That I can control. in this case, this is a sign up or sign in policy,, so it will trigger in both cases, at sign up and during sign in..

C

But if I wanted to have a different experience during the sign up versus sign in,, I would create two different policies. Here..

C

I would create a sign up experience and then independently to that, I would create a sign in experience. for one or the other. I can enable or disable mfa.

A

I see. okay., I think I get that.

C

Yeah. then that's it., I'm not going to customize my ui,, I'm just going to take the default template.

A

Right. the way just what we were talking about, before,, whether there was one.

C

Exactly., what I would have done in this case now,, I would have done the same exact thing by going through our password reset., but I'm just going to take an existing one that I already have. great.

A

So,, I will take this information.

C

So, for the reset password policy, I put it here.

C

for the sign up, sign in I don't remember. It was a susidemo, and I hit "okay".

C

Yeah, you've done this before. oops.. We specify for that too.

A

Oh yeah,, we didn't talk about them. yeah,. I didn't copy the application. Id.

C

So,, let me go back to the applications,.

C

"Demo app", here's the id but I'll use.

C

This nifty feature to copy over the application id.

C

I guess I did not copy. please copy and then hit.

A

Okay, there we go.

C

Okay. now,: it's going to generate a web application for me and when it's done, now it's going to generate it,.

C

And when it's done, I'll have a working.net core application that has the ability for users to sign in.

C

Just takes a few seconds.

A

Now,, did this add any nuget packages in the process?.

C

It does. it adds all the packages it needs in order to build a middleware and get the right middleware.

A

Okay., could you show us the dependencies known?.

C

A

Which seems like it's still doing, something, yeah nuget.

C

So, I think.net core,.

C

I think it's all that it needs really.. Let me just hit "run", and if it needs to get any packages.

A

C

It should automatically get them for me.

C

Seems like it doesn't need any more.

C

Well, it has.net core on.

A

Okay. it looks like it resolved all those dependencies. yeah, exactly.. I was a little worried about that. if there's still those little yellow warning, signals.

C

A

But those are gone.

C

Yeah. so,, as you can tell, I mean adding, building and sign in, is very trivial,, we'll be able to see.

C

You don't need to do much and it takes away the headache of having to manage all these user identities,, especially in this day and age, where privacy is such a big deal..

C

There are new regulations coming out like,. Let the cloud,.

C

Let b2c handle all those worries.. Why should you?.

A

Right., because at the very base of this,, this is identity as a service.

A

exactly. exactly. in particular,.

C

Its'a customer identity as a service.

A

Yeah, right. okay, there, it is. right. so,. I have a running application.

C

I would go ahead and click sign in. okay.. This is kind of the magic moment. exactly.. What it does is. It goes to the url that you can,.

C

It goes through the url that specified this is b2c.

C

I did not actually give the ability, as.

C

One of the identity providers to sign in using email address password.

C

okay., but I did,, if you remember, select facebook, google, and msa. okay.

B

So I'm going to just go ahead.

C

And select say, facebook., I think I'm already signed into facebook,. So what's going to happen, is it's going to facebook. facebook will say. yeah,. I get that.

A

You'll sign in, I'll, go federate.

C

Back to the application., it's already worked., it works, yeah. b2c and then b2c will send the token back to the application.

A

Right. so,, we have seen the whole experience tonight.

A

So,, you must talk to customers about this.

A

C

What has the reaction been?? The reaction? Is, I mean there is definitely a lot of excitement.

C

in fact, we've grown tremendously month over month over the last year.

C

It's an exciting place., it's especially with gdpr, and all these new regulations.

C

There's a lot of investment being made in this area.

A

Yeah, I can imagine.

C

That's why it's a very exciting product and I love being on it.

A

So,, you missed one of the last thing which is,.

A

How much does this cost?

A

absolutely. glad you asked.

C

So,, the pricing you.

C

Believe it or not, is it's essentially free if you're playing it.

C

by essentially,, I mean for the first 50,000 users that are stored per month and for the first 50,000 authentication per month,, there's no fee to it.

C

wow! after that, it's a few pennies and after that.

C

It's pretty reasonable.

A

It's very reasonable,. I can tell you that.

C

There is one slight thing that you do need to worry about,. If you are doing mfa,, it will charge you three cents for every authentication.

A

C

But that is only on a successful authentication.

A

Okay. so,, that's basically when that text message gets sent, out., exactly., actually,, here's a good question.. We were talking about text messages, but obviously microsoft also provides the authenticator app, which you and I presumably both use.

A

right.- does b2c work with the authenticator app?.

C

So, today,, it does not.

A

Okay. we are working on enabling.

C

That capability, fairly soon.

B

Okay,, because I think people would like that. in fact,, it won't just be just mfa,.

C

Not just the azure authenticator app,, it could be any authenticator app.

A

Sure. yeah., but that scenario.

C

That scenario will definitely be enabled., so, today,. It's mostly you get a text message and you look at it and you're like okay cool,. Let me sign in.

A

Yeah. but that's about it. okay., awesome., so,, basically,,.

A

We covered what the service does and what it's for.

A

We covered what the developer experiences.

A

At least the base experience,, it's a mixture of using the portal and basically the wizard in vs.

A

I presume we have some docs. yeah. that exist. Somewhere.

C

Absolutely. so, one thing actually to add to that as you're mentioning., even though it's two components, the best part is now, you will never have to deploy your app again. If you want it to just change in your sign in experience,, right?.

B

So, you're calling onto.

C

This different service and say you choose to change the ui for that particular experience.. You don't need to deploy the new app.

A

That's a separate thing. exactly, because it's calling out a rest api,.

C

It's doing a web call and you're going somewhere else.

A

Right. say you only had google as one of your federated partners, and/or sign in providers and you wanted to add facebook.

A

Exactly. then, that's also just a back-end change.

C

Exactly., it's all just a change in the policy and the application will never know what changed.

A

Awesome. yeah. okay. well,. I think we've pretty much covered it.

C

Absolutely. so,, if you are interested,, I mean there's documentation, aka.ms/aadb2c.

C

We love getting our questions., we love answering questions in stack overflow,. It helps the rest of the community as well.

A

C

Then for feedback,, there's always user voice.

C

okay.. Thank you for having me again. awesome,, okay.,.

A

Do you like having me here?, yeah. well,? This has been another episode of the on.net show.. We learned about azure ad b2c from.

A

Parakh- and you can add all this to your application- today. thanks for watching.