Business Requirement
Our business would like to support direct signup, using 3rd party IDPs, federate with business partners with existing active directories, and our own employee active directory. This authentication system MUST support SSO (preferably seamless but at the minimum no alternate credentials) into 3rd party apps such as but not limited to ShareFile. I will use ShareFile for this example as it is our immediate integration need but the solution can't be short-sighted.
Tech Stack
We are building an angular micro front-end with a a .NET core micro-service back-end architecture using bearer tokens provided from B2C as our authentication/authorization mechanism for both the front-end and the back-end. Our front-end will launch into the B2C custom policy we have created.
Current Implementation
We started with a B2C implementation using custom policies. Our custom policies allows local signup/sign in, Google, Facebook, our own Employee Active Directory and an extra form field which will map a domain to any configured business partner. I am not an identity expert by any means so kudos to the B2C team on the ease and flexibility that B2C offers to someone like myself.
The Problem
In B2C, ShareFile will not integrate through enterprise apps or have B2C act as a service provider for ShareFile by implementing SAML within our B2C custom policy.
In B2B, we are able to get ShareFile to fully integrate into our employee active directory by using enterprise applications in our employee active directory tenant. However this implementation will not work for the local B2C accounts, google, or facebook. We were however by using guest accounts able to integrate any account into our employee active directory which leads me to think we need to move away from B2C and more towards B2B.
Our Journey
We started with B2C to get authentication completed. Given the B2C documentation states that B2C can act as a service provider (https://docs.microsoft.com/en-us/azure/active-directory-b2c/connect-with-saml-service-providers) I saw no red flags with integrating with 3rd party applications and started development. A couple weeks later we had our authentication/authorization completed with a our API's and UI using the produced bearer token. This was a very quick process as in my past experience identity is one of the most difficult problems to do well in software . After working with a support rep for a day or two, I was told that ShareFile will not integrate with B2C. I was not told if this was a limitation of ShareFile or B2C.
Having a fully working B2C solution I started to experiment with B2B. We started using guest accounts to test adding a user into our existing employee active directory. This worked and allowed for seamless integration into ShareFile. We would send the invitation via B2B, then use our employee IDP button in B2C to authorize that user. Worked well!
Questions
Is there a better way to meet our business need? I can't believe we are the only company with this scenario as it seems very common in my experience.
Is there an ability like in B2C to customize the onboarding/invitation experience in B2B? From what I have heard from others in this space that B2C is for more of managing user life cycles vs B2B assumes you already have an office 365 account so there isn't a lot of emphasis on onboarding. We need our full branding and customized processes with onboarding. I am struggling between entitlement management (https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview) and self-service sign up (https://docs.microsoft.com/en-us/azure/active-directory/b2b/self-service-portal). If no to above question, could we build out our own UI and use graph API to grammatically provision users in B2B. The experience must be streamlined and cannot be clunky, our old implementation is like this and we promised a better experience.
One other "hack-ish" thought was that we could provision users in both tenants. Is it possible to link these accounts/tenants somehow so the user wouldn't have to manage multiple credentials. Most likely not doable given what I know but if we could sync passwords for local accounts then we could accomplish what we need with what we have already built.
Thank you for reviewing my post!!!! I would love the opportunity to speak to a Microsoft Identity expert surrounding our business needs!
