You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Set redirect URLs to b2clogin.com - Azure Active Directory B2C | Microsoft Docs
3
-
description: Learn about using b2clogin.com in your redirect URLs for Azure Active Directory B2C.
2
+
title: Set redirect URLs to b2clogin.com - Azure Active Directory B2C
3
+
description: Learn about using b2clogin.com in your redirect URLs for Azure Active Directory B2C.
4
4
services: active-directory-b2c
5
5
author: mmacy
6
6
manager: celestedg
7
7
8
8
ms.service: active-directory
9
9
ms.workload: identity
10
10
ms.topic: conceptual
11
-
ms.date: 01/28/2019
11
+
ms.date: 08/17/2019
12
12
ms.author: marsma
13
13
ms.subservice: B2C
14
14
---
15
15
16
16
# Set redirect URLs to b2clogin.com for Azure Active Directory B2C
17
17
18
-
When you set up an identity provider for sign-up and sign-in in your Azure Active Directory (Azure AD) B2C application, you need to specify a redirect URL. In the past, login.microsoftonline.com was used, now you should be using b2clogin.com.
18
+
When you set up an identity provider for sign-up and sign-in in your Azure Active Directory B2C (Azure AD B2C) application, you need to specify a redirect URL. You should no longer reference *login.microsoftonline.com* in your applications and APIs. Instead, use *b2clogin.com* for all new applications, and migrate existing applications from *login.microsoftonline.com* to *b2clogin.com*.
19
19
20
-
> [!NOTE]
21
-
> You can use JavaScript client-side code (currently in preview) in b2clogin.com. Your JavaScript code will be removed from your custom page if you use login.microsoftonline.com. Additional security restrictions are also applied to login.microsoftonline.com, such as removing HTML form elements from your custom page.
20
+
## Benefits of b2clogin.com
22
21
23
-
Using b2clogin.com gives you additional benefits, such as:
22
+
When you use *b2clogin.com* as your redirect URL:
24
23
25
-
- Space consumed in the cookie header by Microsoft services is reduced.
26
-
- Your URLs no longer include a reference to Microsoft. For example, `https://your-tenant-name.b2clogin.com/tenant-id/oauth2/authresp`.
24
+
* Space consumed in the cookie header by Microsoft services is reduced.
25
+
* Your redirect URLs no longer need to include a reference to Microsoft.
26
+
* JavaScript client-side code is supported (currently in [preview](user-flow-javascript-overview.md)) in customized pages. Due to security restrictions, JavaScript code and HTML form elements are removed from custom pages if you use *login.microsoftonline.com*.
27
27
28
-
> [!NOTE]
29
-
> You can use both the tenant name and the tenant GUID as follows:
30
-
> *`https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com` (which still refers to `onmicrosoft.com`)
31
-
> *`https://your-tenant-name.b2clogin.com/your-tenant-guid` (in which case there is no reference to Microsoft at all)
32
-
>
33
-
> However, you cannot use a _custom domain_ for your Azure Active Directory B2C tenant, e.g. `https://your-tenant-name.b2clogin.com/your-custom-domain-name` would _not_ work.
28
+
## Overview of required changes
34
29
35
-
Consider these settings that might need to change when using b2clogin.com:
30
+
There are several modifications you might need to make to migrate your applications to *b2clogin.com*:
36
31
37
-
- Set the redirect URLs in your identity provider applications to use b2clogin.com.
38
-
- Set your Azure AD B2C application to use b2clogin.com for user flow references and token endpoints.
39
-
- If you are using MSAL, you need to set the **ValidateAuthority** property to `false`.
40
-
- Make sure that you change any **Allowed Origins** that you have defined in the CORS settings for [user-interface customization](active-directory-b2c-ui-customization-custom-dynamic.md).
32
+
* Change the redirect URL in your identity provider's applications to reference *b2clogin.com*.
33
+
* Update your Azure AD B2C applications to use *b2clogin.com* in their user flow and token endpoint references.
34
+
* Update any **Allowed Origins** that you've defined in the CORS settings for [user interface customization](active-directory-b2c-ui-customization-custom-dynamic.md).
41
35
42
-
## Change redirect URLs
36
+
## Change identity provider redirect URLs
43
37
44
-
To use b2clogin.com, in the settings for your identity provider application, look for and change the list of trusted URLs to redirect back to Azure AD B2C. Currently, you probably have it set up to redirect back to some login.microsoftonline.com site.
38
+
On each identity provider's website in which you've created an application, change all trusted URLs to redirect to `your-tenant-name.b2clogin.com` instead of *login.microsoftonline.com*.
45
39
46
-
You'll need to change the redirect URL so that `your-tenant-name.b2clogin.com` is authorized. Make sure to replace `your-tenant-name` with the name of your Azure AD B2C tenant and remove `/te` if it exists in the URL. There are slight variations to this URL for each identity provider so check the corresponding page to get the exact URL.
40
+
There are two formats you can use for yourb2clogin.com redirect URLs. The first provides the benefit of not having "Microsoft" appear anywhere in the URL by using the Tenant ID (a GUID) in place of your tenant domain name:
47
41
48
-
You can find set-up information for identity providers in the following articles:
* Replace `{your-tenant-name}` with the name of your Azure AD B2C tenant.
55
+
* Remove `/te` if it exists in the URL.
64
56
65
-
Your Azure AD B2C application probably refers to `login.microsoftonline.com` in several places, such as your user flow references and token endpoints. Make sure that your authorization endpoint, token endpoint, and issuer have been updated to use `your-tenant-name.b2clogin.com`.
57
+
## Update your applications and APIs
66
58
67
-
## Set the ValidateAuthority property
59
+
The code in your Azure AD B2C-enabled applications and APIs may refer to `login.microsoftonline.com` in several places. For example, your code might have references to user flows and token endpoints. Update the following to instead reference `your-tenant-name.b2clogin.com`:
68
60
69
-
If you're using MSAL, set the **ValidateAuthority** property to `false`. When **ValidateAuthority** is set to `false`, redirects are allowed to b2clogin.com.
61
+
* Authorization endpoint
62
+
* Token endpoint
63
+
* Token issuer
70
64
71
-
The following example shows how you might set the property:
65
+
For example, the authority endpoint for Contoso's sign-up/sign-in policy would now be:
72
66
73
-
In [MSAL for .Net](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet):
If you're using [MSAL.NET][msal-dotnet] v2 or earlier, set the **ValidateAuthority** property to `false` on client instantiation to allow redirects to *b2clogin.com*. This setting is not required for MSAL.NET v3 and above.
74
76
75
77
```CSharp
76
-
ConfidentialClientApplicationclient=newConfidentialClientApplication(...); //can also be PublicClientApplication
77
-
client.ValidateAuthority=false;
78
+
ConfidentialClientApplicationclient=newConfidentialClientApplication(...); //Can also be PublicClientApplication
79
+
client.ValidateAuthority=false;// MSAL.NET v2 and earlier **ONLY**
78
80
```
79
81
80
-
And in [MSAL for Javascript](https://github.com/AzureAD/microsoft-authentication-library-for-js):
82
+
If you're using [MSAL for JavaScript][msal-js]:
81
83
82
-
```Javascript
84
+
```JavaScript
83
85
this.clientApplication=newUserAgentApplication(
84
86
env.auth.clientId,
85
87
env.auth.loginAuthority,
@@ -89,3 +91,9 @@ this.clientApplication = new UserAgentApplication(
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/multiple-token-endpoints.md
+9-7Lines changed: 9 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Support multiple token issuers in an OWIN-based web application - Azure Active Directory B2C
3
-
description: Learn how to enable a .NET web application to support tokens issued by multiple domains.
2
+
title: Migrate OWIN-based web APIs to b2clogin.com - Azure Active Directory B2C
3
+
description: Learn how to enable a .NET web API to support tokens issued by multiple token issuers while you migrate your applications to b2clogin.com.
4
4
services: active-directory-b2c
5
5
author: mmacy
6
6
manager: celestedg
@@ -13,14 +13,16 @@ ms.author: marsma
13
13
ms.subservice: B2C
14
14
---
15
15
16
-
# Support multiple token issuers in an OWIN-based web application
16
+
# Migrate an OWIN-based web API to b2clogin.com
17
17
18
-
This article describes a technique for enabling support for multiple token issuers in web apps and APIs that implement the [Open Web Interface for .NET (OWIN)](http://owin.org/). Supporting multiple token endpoints is useful when you're migrating Azure Active Directory (Azure AD) B2C applications from *login.microsoftonline.com* to *b2clogin.com*.
18
+
This article describes a technique for enabling support for multiple token issuers in web APIs that implement the [Open Web Interface for .NET (OWIN)](http://owin.org/). Supporting multiple token endpoints is useful when you're migrating Azure Active Directory B2C (Azure AD B2C) APIs and their applications from *login.microsoftonline.com* to *b2clogin.com*.
19
19
20
-
The following sections present an example of how to enable multiple issuers in a web application and corresponding web API that use the [Microsoft OWIN][katana] middleware components (Katana). Although the code examples are specific to the Microsoft OWIN middleware, the general technique should be applicable to other OWIN libraries.
20
+
By adding support in your API for accepting tokens issued by both b2clogin.com and login.microsoftonline.com, you can migrate your web applications in a staged manner before removing support for login.microsoftonline.com-issued tokens from the API.
21
+
22
+
The following sections present an example of how to enable multiple issuers in a web API that uses the [Microsoft OWIN][katana] middleware components (Katana). Although the code examples are specific to the Microsoft OWIN middleware, the general technique should be applicable to other OWIN libraries.
21
23
22
24
> [!NOTE]
23
-
> This article is intended for Azure AD B2C customers with currently deployed applications that reference `login.microsoftonline.com` and who want to migrate to the recommended `b2clogin.com` endpoint. If you're setting up a new application, use [b2clogin.com](b2clogin.md) as directed.
25
+
> This article is intended for Azure AD B2C customers with currently deployed APIs and applications that reference `login.microsoftonline.com` and who want to migrate to the recommended `b2clogin.com` endpoint. If you're setting up a new application, use [b2clogin.com](b2clogin.md) as directed.
24
26
25
27
## Prerequisites
26
28
@@ -30,7 +32,7 @@ You need the following Azure AD B2C resources in place before continuing with th
30
32
31
33
## Get token issuer endpoints
32
34
33
-
You first need to get the token issuer endpoint URIs for each issuer you want to support in your application. To get the *b2clogin.com* and *login.microsoftonline.com* endpoints supported by your Azure AD B2C tenant, use the following procedure in the Azure portal.
35
+
You first need to get the token issuer endpoint URIs for each issuer you want to support in your API. To get the *b2clogin.com* and *login.microsoftonline.com* endpoints supported by your Azure AD B2C tenant, use the following procedure in the Azure portal.
34
36
35
37
Start by selecting one of your existing user flows:
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/concept-authentication-methods.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -153,7 +153,7 @@ Users may have a combination of up to five OATH hardware tokens or authenticator
153
153
154
154
## OATH hardware tokens (public preview)
155
155
156
-
OATH is an open standard that specifies how one-time password (OTP) codes are generated. Azure AD will support the use of OATH-TOTP SHA-1 tokens of the 30-second or 60-second variety. Customers can procure these tokens from the vendor of their choice. Secret keys are limited to 128 characters, which may not be compatible with all tokens.
156
+
OATH is an open standard that specifies how one-time password (OTP) codes are generated. Azure AD will support the use of OATH-TOTP SHA-1 tokens of the 30-second or 60-second variety. Customers can procure these tokens from the vendor of their choice. Secret keys are limited to 128 characters, which may not be compatible with all tokens. The secret keys need to be encoded in Base32.
157
157
158
158
Baseline policies are a set of predefined policies that help protect organizations against many common attacks. These common attacks can include password spray, replay, and phishing. Baseline policies are available in all editions of Azure AD. Microsoft is making these baseline protection policies available to everyone because identity-based attacks have been on the rise over the last few years. The goal of these four policies is to ensure that all organizations have a baseline level of security enabled at no extra cost.
20
+
Baseline policies are a set of predefined policies that help protect organizations against many common attacks. These common attacks can include password spray, replay, and phishing. Baseline policies are available in all editions of Azure AD. Microsoft is making these baseline protection policies available to everyone because identity-based attacks have been on the rise over the last few years. The goal of these four policies is to ensure that all organizations have a baseline level of security enabled at no extra cost.
21
21
22
22
Managing customized Conditional Access policies requires an Azure AD Premium license.
23
23
@@ -38,7 +38,7 @@ All four of these policies will impact legacy authentication flows like POP, IMA
38
38
39
39
Due to the power and access that administrator accounts have, you should treat them with special care. One common method to improve the protection of privileged accounts is to require a stronger form of account verification when they are used to sign in. In Azure Active Directory, you can get a stronger account verification by requiring administrators to register for and use Azure Multi-Factor Authentication.
40
40
41
-
[Require MFA for admins (preview)](howto-baseline-protect-administrators.md)is a baseline policy that requires multi-factor authentication (MFA) for the following directory roles, considered to be the most privileged Azure AD roles:
41
+
[Require MFA for admins (preview)](howto-baseline-protect-administrators.md)is a baseline policy that requires multi-factor authentication (MFA) for the following directory roles, considered to be the most privileged Azure AD roles:
42
42
43
43
* Global administrator
44
44
* SharePoint administrator
@@ -49,7 +49,7 @@ Due to the power and access that administrator accounts have, you should treat t
49
49
* Billing administrator
50
50
* User administrator
51
51
52
-
If your organization has these accounts in use in scripts or code, consider replacing them with[managed identities](../managed-identities-azure-resources/overview.md).
52
+
If your organization has these accounts in use in scripts or code, consider replacing them with[managed identities](../managed-identities-azure-resources/overview.md).
53
53
54
54
### End user protection (preview)
55
55
@@ -84,11 +84,11 @@ To protect privileged actions, this **Require MFA for service management (previe
84
84
85
85
To enable a baseline policy:
86
86
87
-
1. Sign in to the**Azure portal**as global administrator, security administrator, or Conditional Access administrator.
87
+
1. Sign in to the**Azure portal**as global administrator, security administrator, or Conditional Access administrator.
88
88
1. Browse to **Azure Active Directory** > **Conditional Access**.
89
89
1. In the list of policies, select a baseline policy you’d like to enable.
0 commit comments