Azure AD B2C SSO with Sitecore and Dynamics 365 Portals

Question

We have a simple scenario but technologies(or implementation) have made things bit complex -

We have Sitecore as CMS for client's main web site and for business functionality we have Dynamics 365 Portal and we are using Azure AD B2C as identity provider for both.

We have heavily customised B2C custom policy to cater specific requirements.

We are using same custom policy in Sitecore and in Dynamics 365 Portals so sign in individually and works perfect without any issues.

With regards to SSO, we have kept the configuration as OOTB as you can find it here .

Only 1 or 2 user journeys are absolutely perfect as good as seamless journeys. In specific journeys we need user to be logged in both ends to make it work (we can force user to go to sign in page, but it is not required on all the pages).

In order to understand how real and proper SSO should work in Azure AD B2C, I have no idea or experience to relate this process to. so I am looking for guidance and help here.

I found very good information in this about how B2C works in terms of signin and providing tokens process but it bit old question and things have changed a lot since then specifically UI and some of the operations.

Answer 1

Use the following docs when configuring sessions management for a custom policy. Session Behavior section is where you define which SSO behavior. Specifically:

<SingleSignOn Scope="Application" />

If you want your users to get SSO between all applications, then define this value as "Tenant". There are several useful scenarios in creating separation between sessions - such as a company that has multiple brands that do not want to conflict each other. Or a separation of experiences.

Follow the exact format and location to be placed in your policy or you will not get the desired result.

Another concept that is important is the understanding the session provider :

SSO session management has two parts. The first deals with the user's interactions directly with Azure AD B2C and the other deals with the user's interactions with external parties such as Facebook. Azure AD B2C does not override or bypass SSO sessions that might be held by external parties. Rather the route through Azure AD B2C to get to the external party is “remembered”, avoiding the need to reprompt the user to select their social or enterprise identity provider. The ultimate SSO decision remains with the external party.

Session providers are used to define maintain what goes into generating the session when your policy is being executed (inside the Identity Experience Framework). If marked incorrectly, this could lead to undesirable results such as wrong claims being sent, additional MFA prompts, parts of your policy not being maintained when ran or just general errors.

Answer 2

This is for those who are interested in how we achieved this -

Sitecore also does offer OOTB Azure AD B2C configuration however the supplier of Sitecore delivery side decided not to use OOTB configuration approach and hence it caused lot of issues. From what I have read about Sitecore configuration for Azure AD B2C it does work smoothly with B2C with careful configuration.

Work Around: We had to rely on external triggers(eg cookie) which will indicate and trigger that a user has signed on either sides and accordingly the sign in process on both side kicks off.