CODEWITHSUNDEEP
azureazure-active-directoryazure-ad-b2c
Bren Gunning
Bren Gunning

Reputation: 390

Checking a user exists in Azure Active Directory B2C

I am creating a new Azure AD B2C authenticated site to replace an older Forms Authenticated one. In the new site, I am asking the user to initially enter their email address so I can check if they exist in Azure B2C and send them to the appropriate sign-in page and if not send them to the older Forms Authenticated site.

The issue is I have when following Microsoft's tutorials, is that they show user management but they all require you to have logged in with your Azure account first and obviously this is not possible given the system I am trying to build. Is what I am doing even possible?

Thanks in advance!

MS tutorials: https://azure.microsoft.com/en-gb/documentation/articles/active-directory-code-samples/

Upvotes: 1

Views: 3143

Answers (2)

Bren Gunning
Bren Gunning

Reputation: 390

Sadly, it seems like this is not possible within the Azure B2C Preview.

From the limitations section (https://azure.microsoft.com/en-gb/documentation/articles/active-directory-b2c-limitations/) there is this paragraph which describes what I am trying to do:

Daemons / Server Side Applications

Applications that contain long running processes or that operate without the presence of a user also need a way to access secured resources, such as Web APIs. These applications can authenticate and get tokens using the application's identity (rather than a consumer's delegated identity) using the OAuth 2.0 client credentials flow. This flow is not yet available in Azure AD B2C preview - which is to say that applications can only get tokens after an interactive consumer sign-in flow has occurred.

So it seems like this is currently not possible. Hopefully it'll work once it comes out of preview.

Upvotes: 1

Erik Oppedijk
Erik Oppedijk

Reputation: 3551

Be careful with this, check if your site is not vulnerable to username enumeration: http://www.troyhunt.com/2012/05/everything-you-ever-wanted-to-know.html

With the old users going to forms based authentication, you could call the Graph API to create the users in the B2C directory: https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2c-devquickstarts-graph-dotnet/

Then the next time they can login through B2C

Upvotes: 0

Related Questions