A Hack to develop PoCs using Java to leverage Azure AD and Azure AD B2C identities.

1. Develop a PoC that signs-in, signs-up, and signs-out a user with Azure AD B2C using MSAL Java.
2. Develop a PoC that signs-in, signs-up, and signs-out a user with Azure AD using MSAL Java.

1. Provision an AAD B2C tenant
2. Register an B2C app
3. Create and test 3 user flows: Sign up & sign in, Profile Editing, Password Reset using a B2C Local Account

References:

• Create a AAD B2C tenant
• Register an app in AAD B2C
• Create user flows in AAD B2C

1. Register an app with a social IDP, e.g. Google and add it as social IDP to your B2C tenant.
2. Register an app with OIDC IDP, e.g. Partner's org AAD tenant and add it as a custom OIDC IDP to your B2C tenant.
3. Retest your user flows with the new IDPs.

References:

• Configure Google as AAD B2C IDP
• Configure AAD org as AAD B2C IDP

1. Protect target pages with auth server, aka require a user to sign up/in
2. Redeem auth code for access token
3. Issue silent login to handle token expiration
4. Validate auth request and responses, i.e 'state', 'nonce', etc. *

CheckList

• Setup local environment, i.e. create a self-signed cert to support https on localhost

  Example:  
  keytool -genkeypair -alias testCert -keyalg RSA -storetype PKCS12 -keystore keystore.p12 -storepass password
  
  server.ssl.key-store-type=PKCS12  
  server.ssl.key-store=classpath:keystore.p12  
  server.ssl.key-store-password=password  
  server.ssl.key-alias=testCert
  

• Configuration file + class
• Check user is authenticated on secure pages
• Prompt user for sign in if not authenticated
• Handle auth code response from auth server to redeem it for an access token.
• Validate state and nonce to protect against attacks, cross-site scripting, etc.

Hint: if not calling a downstream webapi, use the client Id as a scope to generate an access token. References:

• MSAL4J workaround if just sign-in
• Public vs Confidential client apps

1. Call a api protected by same auth server with a scope

References:

• Configure an app to expose an api
• Configure an app to access a web api

1. Provision a separate AAD tenant.
2. Register an AAD app as a multi-tenant app.

References:

• Create a new AAD tenant
• Register an AAD app

1. Rinse and repeat steps in the B2C PoC or just clone above with some minor tweaks.

References:

• Force revoke of token (for testing silent login)

1. Call a api protected by same auth server with a scope

• MSAL Java Library: https://github.com/AzureAD/microsoft-authentication-library-for-java
• Microsoft Identity Java Webapp Sample: https://github.com/Azure-Samples/ms-identity-java-webapp
• VSCode IDE: https://code.visualstudio.com/
• VSCode Java Extension Pack: https://marketplace.visualstudio.com/items?itemName=vscjava.vscode-java-pack
• VSCode Spring Book Extension Pack: https://marketplace.visualstudio.com/items?itemName=Pivotal.vscode-boot-dev-pack
• Spring Initalizr: https://start.spring.io/

Ref: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

Ref: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow