Hi,
I want external users to federate external users authentication in Office 365 with an external identity provider. The authentication provider is not implemented by us. The goal is to enable both internal and external users to access Office 365 resources, namely SharePoint Online.
Is it possible to have internal users authenticate using native Office 365 authentication (using URL https://login.microsoftonline.com/common/oauth2/v2.0/authorize, going against Azure AD directly) and have external users to be authenticated against na external identity provider?
According to https://docs.microsoft.com/en-us/azure/active-directory/external-identities/direct-federation, a domoin must be configured as being federated and thus a user must enter a email in the default Office 365 login page (https://login.microsoftonline.com/common/oauth2/v2.0/authorize) from the domain that is going to be federated so that the authentication can be done in the external identity provider page (user gets redirected if it enters na email from the federated domain).
In our case, we would like to have:
- Internal users to authenticate against Azure AD login page (https://login.microsoftonline.com/common/oauth2/v2.0/authorize)
- External users (if possible, without any email introdution, not sure if possible) to go to an external identity provider for authentication and authorization. This identity provider has authentication mechanisms that dont rely on email but on other Personal Identification Information such as VAT Number for instance.
Questions:
- Will users always pass through the Azure AD login page (https://login.microsoftonline.com/common/oauth2/v2.0/authorize)?
- If yes, how can we differentiate internal users from external users? Through the domain? Examples:
- Domain.com - auth done directly in Azure AD without any redirection to custom identity provider
- Externaldomain.com - domain configured as federated and thus being redirect to the custom login page from the identity provider
- If no, how can we ensure that internal users go though the normal Azure AD authentication flow and external users go thought the custom login page from the identity provider?
- Since the custom identity provider has authentication mechanisms that dont rely on email but on other Personal Identification Information such as VAT Number for instance, how can we ensure that the returned identity can be mapped to a valid Guest User in Azure AD that requires an email?
- From my understanding, the Guest user in Azure AD must be created after authentication in the custom login page from the identity provider. How can we ensure that after authentication in the custom login page from the identity provider, the Guest User is created with a valid email address? The identity provider must supply a valid email (assuming email is available) to a custom page of ours that invokes the Create invition (https://docs.microsoft.com/en-us/graph/api/invitation-post?view=graph-rest-1.0&tabs=http) API?
- Is it possible to have a custom form to override https://login.microsoftonline.com/common/oauth2/v2.0/authorize or the authentication entry point is always the the MS login page and the user has to enter a domain (the federated domain) in the MS login page to be redirected to the identity provider custom page for authentication and authorization?
- Any more relevant details in the process?
- What is the most complete guide available with all the steps necessary for this scenario?
Thanks
