Generating a magic login link with Azure B2C as the authority

user_3494331 0
Viewed 1573

I'm looking for a method to log in a user using a link sent by mail. The Sign-in with a magic link sample policy comes very close to what I want to achieve.

My main issue with this sample is that it requires the web app to set up a certificate and host an OIDC endpoint. So the web app becomes the source of trust. What even is the point of B2C if it's not generating or validating the tokens? It seems like I'm adding an extra attack surface on our application. One of the reasons we use B2C is so we don't have to deal with the dangers of authenication. Or am I seeing this wrong?

Another option I was looking at is the OAuth 2.0 On-Behalf-Of flow. That does use B2C as the source of trust but is not intended to create user tokens. It's for authenticating one app with the parent app. Would it be a bad idea to try to use such an OBO access token to authenticate a user instead?

azure-ad-b2c
1 Answers

Your solution is in the link you posted. You can give the certificate to B2C and we can host that metadata.

Using B2C to generate the metadata endpoints

To note, when using id_token_hint, you are the IDP and giving Azure AD B2C the hint. Hence you need to have a metadata endpoint. B2C can host it for you if you use the above link, but you are sharing with us the Private Key, and you may not want to do that since as an IdP you dont share your private keys.....

user_83573570
Related