>> So my name is matt i'm a senior cloud developer advocate
At microsoft and when i say, who your users are and how they get
In your web site and this and that the.
Let's jump into a demo off the bat.
I have an app. We are reviewing businesses,
Restaurants, hotels. People can click in.
And they can read reviews. But, if you're not logged in, i
Don't want you to be able to edit one is eelses review.
We want this to be -- people to be accountable for what they do.
We have a sign up or sign in. And then, within this, i want to
Be able to have internet.
>> We're going to transition here.
I want to
-- So when we log in i want to make sure that the users
Are able to enter either an e-mail address or sign in with twitter.
>> Or any other various social
Idea providers. >> As this spins up i will jump
Into is slides. -- The slides.
So there's a couple different ways of identity management.
I will call the easy way and nothing is really easy.
I'll call this the straightforward away.
When you know who your users are. So somebody comes to you and say
Here are your users and you know how they're going to log in.
With an e-mail address or active directory and what not.
Then you have the not so straightforward way.
And this is when the users come knocking at your door.
You don't know who that are tully they tell you.
And you don't know how they're going to log in. You might give them a an e-mail address.
You might want to give them a way to log in with twitter,
Facebook or github. You can that separate away with
Azure active directory b2 correct. Provider to use to give
Authentication and authorization apps.
Highly available and secure and scale to millions of identities.
So customers can also use your social accounts, facebook,
Twitter, get hub or -- get hob r hub or yous another password.
And sports things like multi >> i can't hear you offhand.
-- >> Just come afterwards. I'm sorry.
Here's what i want to do. Vy a user and data source.
And the app you want to create here is sign up or sign in.
And then i want to have personal and relevant information.
I want to be able to edit my reviews. Get my personal reviews back.
That's what i want.
How am i going to do this. I am going to have my user, i
Have my azure a -- i have my
Data source. So first off, i'm going to go in
And invoke a policy. I want to sign in.
From from there, i'm going to correctly. I get a tone back.
I will take that token and make a request to my backend data
Source. My backend data source will
Verify and everything comes in back.
Is happening. Let's do it.
Let's set this up.
All right. This demo then.
I have an azure b2c instance.
There's something i want to show.
The first thing i want to show is
The identity providers. So here i can do several things.
These are the things i will be able to log in be.
-- With. So you can see i have e-mail and
I set up hub and twitter and others i can as well.
And amazon. So you say you want a twitter
Log in. I go to twitter itself.
Back url which is all in the documentation.
So this is how twitter knows how to call back to b2c.
Then, posting the credentials back into here.
So that's all i need to do. B2c is an job strakes
-- I can set up and interact with them once.
There's then underlying users. When people sign up, i can ask
Them for, what's your job title? what is your postal code.
I don't have to ask them for it, but it's there.
>> The actual users underneath everything. Vy this user.
So you can see if i had for a job title would have been posted
Here. >> Then there's the application.
You can think of the application as abstracting over my mobile
App that will work i promise. The application has something
Called application id which is important. Then various urls that it is
Going to call back to. What you want to do here is
I'm going to delete all these.
Here. I'm going to call it jwt dot
Ms. As soon as it saves. All right.
What -- by putting that in, all i'm you saying i want to call
This jwt dot ms web site. The reason i did that is this
Other thing called policies. Defining a user experience
People have when they interact with b2c.
A sign up or sign in policy is exactly what it sounds like.
What the user doeses when they sign up or in.
When i create one of these, i can specify which providers
Allowed to use. I have all the ones defined.
Twitter and github. Which attributes and which
Claims i will return back to the app.
As well.
I can set up other things. Multi factor authentication to go with it.
Saying, my reply url is jwt dot his run
Now. I will bring up a web site that
I can log in with. I have an account created.
My banking password here.
That joke got no laughs. Post it back and this is the
Token that is sent back at jwtms.
It's a great web site which takes tokens and it decodes them for you.
So you can see what's being sent back. It says that the name here is laboski.
The e-mails that come back is mat at
Comil matt.Com and the policy invoked to get me to this page.
A nice way that you can go back and has a claims tab which
Actually says, what each of these mean as well.
So what i'm going to go back into here, i'm going to set the
Call back urls of my application to be back to the
To what i had before.
To interact with my mobile app and web site.
>> All right. So that's setting up the cloud
Portion of the b2c.
The next thing i want to show up is how to do the authentication
Or verifying things on the backend. One of the
An asp core web a perks that i have deployed in an azure app
Service. Existing asp net core things.
If you're used to it.
All i'm doing is in the app settings, i'm calling out, this
Is my log in. I am giving it the domain.
This is to set up things i get from when i set up the b2c
Service. Really plugging in configuration tokens.
During the start up, i have a where is it?
This at azure b2c token. This comes from one of the
Samples we have on github. I will have a link to get this.
This is an extension alternated helps me -- an extension that
Helps me add everything and puts in the options authority.
Me. Grabbing from the app settings
And putting it here. When i want to go through and
Make sure everything is authenticated.
The scope is a way to make sure that permissions
And i set a scope up within the application
As well. Right here. This rvw all.
I put that in my application in bwc. That gets sent back and i check
It here by looking through the user of the
Htp context and see if that review all is in there.
So it's basic what's being done already
In apps.Net. I'm also using with this mobile
App azure functions. To set that up to communicate
With b2c, there's an authentication note.
In that authentication note there's an azure active
Directory portion. Here i put into the client id
What my application id was from. B2c and then an issuer.
Then obtained through the documentation.
It tells you where to get it. That's the backend stuff.
Grabbing the mobile app site.
The mobile app side works through the microsoft identity
Client client. That's on .Net.
There's a jai have script -- java script version and you can
Do -- i'll show the .Net version. You can do it through your
Choice of platforms. >> When we log -- or start it up
There's two crucial methods. One that's called acquire token
A-sync. Actually try to log in.
You can see here, i'm saying i will pass a scope.
The scope variable is the rvw all.
Which i have set here.
I will pass other things saying where do you want to get to.
The authority happens to be the policy i want to call and so on.
There's another one. Down here called.
Acquire token silent a-sync. I can be cached.
I don't necessarily have to go in call b to -- b2c.
I log in and my token hasn't expired so there's no reason to
Call it again. The mc client takes care of
Everything for me. Let's run this.
>> I'm going to set a break point
As it compiles. I'm going to sign up or sign in.
The break point. I'm not signed in yet so it will
Go out. >> I'm going to sign in under
Same credentials.
>> It comes back. So now, i have
In here an access token. If i can get that to come up i
Will set that to the jwtms web site.
If i can get that to come up.
I will paste that in.
There's a couple things i want to point out.
The name comes back. The e-mail comes back and we can
Seevy a scope saying i the rw all permissions.
When i call to the web site, it will let me have it.
That's what it's checking. I go through and it shows me the
Reviews i currently have. So now when i go into this cool
Restaurant review i can view it. If i go back to me i can go
Through and edit reviews as well.
So when i call out to things is right here.
This is where i'm sending the token. So this is the request message
I'm sending. And this is -- i'm sending a
Token with it. That is all i have to do to call
Out b2c. I can log in under anything.
I log out here.
I can go back in and when this shows up, you'll see i have
Twitter. I can log in with github.
It would send a text message to my phone which i would have to
Enter to get through and so on. All right.
So we'll keep on going. So,
Ad b2c we have the cloud portion.
It creates accounts and handles identities for the users you
Don't now you have yet that let's them come to you.
You have the backend of things as the functions.
A web api where you can use the built in mechanisms to
Authenticate the users. The microsoft identity client.
To obtain tones. -- Tokens and handle them for you.
And finally, i want to -- this slide here, if you follow this
Link it will bring you to a full functioning web application.
The web api and a function app which has the production steps
Else. Finally, there's going to be
In-depth work shops and session here.
Tuesday and wednesday work shops and sessions.
Highly recommend it. With that said, thank you very