Skip to main content

Azure B2C for the Clipboard Portal

This article will outline the steps for adding Azure B2C as an SSO Configuration

Only IT Admins can set up SSO in Clipboard.

This help article is specifically for setting up SSO with Azure B2C.

Please note that this article serves as a general guide for setting up Azure B2C as an identity provider using SAML. It's important to consider the unique aspects of your specific setup and security requirements. This guide does not cover all scenarios and should be adapted to fit the particular needs and policies of your environment. Always ensure that any configuration or setup aligns with your organisational standards and security protocols

Guide to Setting Up Azure B2C as an Identity Provider Using SAML

Before diving into the setup of Azure B2C with SAML, it's crucial to properly prepare your B2C environment. The process involves several key steps, which are outlined in detail in the Azure documentation. However, recognising the complexity of this task, we will provide additional commentary to guide you through each step.

Important Note: If you already have an Azure B2C environment configured, you may skip this initial preparation phase and proceed directly to Step 4.

Begin by following the instructions on the Azure documentation page dedicated to B2C environment preparation. This guide is your primary reference for the initial setup stages.

Step 1. Create Azure B2C Tenant

To initiate the setup process, you'll need to create an Azure B2C Tenant. Follow the detailed steps provided in the Azure documentation dedicated to this task.

Step 2: Create user flows and custom policies

Social and local accounts form the backbone of the login process for various users - staff, students, and guardians - in the applications you create using Azure B2C. Establishing these accounts is an important first step before you can implement more complex workflows.

Go to the Azure documentation and select Custom Policy and follow the steps.

The page linked above shows two prerequisites:

  1. Having an Azure B2C tenant.

    1. We should have created this in step 1 above, so all good.

  2. A web application with ID token implicit grant enabled.

    1. It links this page to go and create a web application.

After following the steps in the article, navigate to Azure AD B2C -> Identity Experience Framework and you should see a page that looks something like this:


​


​
​

Step 3: Set up a SAML user flow.

This is broken up into two parts. The first is what needs to be done to get the B2C tenant ready for SAML, and the second, what needs to be done to configure Clipboard to work with your tenant.

This page details the steps to setup SAML.

Once the certificate is setup we need to go back to the Identity Experience Framework section and update the TrustFrameworkBase to include SAML and then create the SAML workflow by cloning and modifying the SignupSignin XML. The current state of these can be downloaded from the Azure B2C tenant.

It’s fairly simple, just follow the steps to create these. A few small things to note when you are modifying the XML:

  1. We had to change the Order=7 to Order=4.

  2. The value for IssuerUri">https://issuerUriMyAppExpects isn't checked by Clipboard.

  3. SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert Ensure that the name you assign to your certificate in this step exactly matches the name you used for the certificate in the previous step.

Once the above steps are done and uploaded as per the linked steps you should be able to access the metadata for the SAML response at the URL listed in the docs, example:

https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/samlp/metadata

Step 4: Creating and applying SAML configuration for Clipboard.

Assuming that the setup of Azure B2C has been correctly completed, integrating this configuration for user authentication in Clipboard is straightforward:

  • Visit the SSO page in Clipboard settings. Settings → Security → SSO and configure the Metadata URL set up in Azure B2C.
    ​
    ​

  • Then make a note of the Metadata URLs listed at the bottom of this page. In this case, we are configuring SSO for the app, so the value of relevance is: https://api.clipboard.app/sso/<id>/metadata.xml
    ​
    ​Note: If you are setting up Portal SSO, the process is the same but the URL may slightly differ.
    ​


    ​

  • From the Azure B2C Tenant page select App registrations in the sidebar and click on the app you wish to use, or click new registration and create one.
    ​
    ​

  • Once in the app settings click Manifest in the side bar.

  • Using the Clipboard Metadata.xml URL that was created above, paste it in two places.

  • The first is identifierUris.

    • This field needs to match the issuer field in the XML AuthNRequest. Which in Clipboards case is set to this XML URI. This allows the Azure B2C tenant to route the SAML request to the correct application and is a very important field.

  • The second is samlMetadataUrl This points to the same location and just tells this application how to respond to the request. I.e. the assert and logout URIs are defined in this XML. This removes the need to configure these urls manually.

  • You'll also need to find the accessTokenAcceptedVersion parameter and set the value to 2 otherwise you will receive an error message requiring a verified domain.

  • The second is samlMetadataUrl This points to the same location and just tells this application how to respond to the request. I.e. the assert and logout URIs are defined in this XML. This removes the need to configure these urls manually.

Replace [id] with your unique identifier.

"accessTokenAcceptedVersion": 2, 
"identifierUris": [ 	
"https://api.clipboard.app/sso/[id]/metadata.xml" 
], 
"samlMetadataUrl": "https://api.clipboard.app/sso/[id]/metadata.xml",


​Note: There will be a lot of other fields in this manifest, We’ve just removed them for simplicity.

Note: The Metadata URL is for the Clipboard App, the Clipboard Portal URL will look slightly different.


​

Did this answer your question?