# Azure AD B2C

Journey's can be authenticated using Azure AD B2C as an OAuth vendor and can require users to login before accessing a web flow in an application.

![](https://4185914948-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSItjRhbHaLQ4ar3DUljt%2Fuploads%2Fgit-blob-657c63446065c9425ee82c22ddb771deba49dc67%2Fazure-ad-b2c-v181-0.png?alt=media)

This document will walk through authenticating a Journey using Azure AD B2C using Google as the identity provider. For additional information on setting up other identity providers in Azure AD B2C and Airkit see [here](https://docs.microsoft.com/en-us/azure/active-directory-b2c).

#### Pre-requisites

* [Have an Azure AD B2C tenant](https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-tenant)

## Authenticating a Journey using Azure AD B2C using Google as the Identity Provider

### Register a Web Application in Azure AD B2C

To register a web application in Azure AD B2C, follow the steps outlined in [this document](https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-register-applications?tabs=app-reg-ga).

![](https://4185914948-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSItjRhbHaLQ4ar3DUljt%2Fuploads%2Fgit-blob-7d687ddeee6e174850331be7049d9b7103000225%2Fazure-ad-b2c-v181-1.png?alt=media)

The one step that is different is using the following Redirect URI:

\[block:callout] { "type": "info", "title": "Redirect URI", "body": "`\nhttps://{base-domain}/internal/session-gateway/v1/oauth/callback`" } \[/block] The `{base-domain}` can be found in **Settings**. For example, in the following screenshot, the base domain would be `app.airkit.com`.

![](https://4185914948-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSItjRhbHaLQ4ar3DUljt%2Fuploads%2Fgit-blob-015c4a2c9fef0308e072379c391f1975c6ed4bc2%2Fazure-ad-b2c-v181-2.png?alt=media)

Once the web application is registered, take note of the client ID, as this will be needed in a future step.

### Set up sign-up and sign-in with a Google Account

To set up sign-up and sign-in with a Google account, follow the steps outlined in [this tutorial](https://docs.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-google?WT.mc_id=Portal-Microsoft_AAD_B2CAdmin\&pivots=b2c-user-flow). After creating the Google application and configuring Google as an identity provider, you will need to add the Google identity provider to a User Flow.

When creating the User Flow, there are some additional steps needed in order for it to work with Airkit. Under **User attributes and token Claims**, the following attributes and claims are required:

**Collect attribute**

* Email Address

**Return Claim**

* Email Addresses
* Identity Provider Access Token

![](https://4185914948-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSItjRhbHaLQ4ar3DUljt%2Fuploads%2Fgit-blob-79e5c4c1df3ca2d00b1a2c4d1bc1ae5a4f92fd38%2Fazure-ad-b2c-v181-3.png?alt=media)

### Configure Authentication in Airkit

After setting up sign-up and sign-in with Google in Azure AD B2C, go to **Settings** in the Airkit App and change the **App Authentication Type** to **Secure App**.

![](https://4185914948-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSItjRhbHaLQ4ar3DUljt%2Fuploads%2Fgit-blob-02d1df3cb2da89ec6d84d7288949f8ea87c8aed4%2Fazure-ad-b2c-v181-4.png?alt=media)

Then select **OAuth 2.0 w/ OpenID Connect** as the Authentication Method and choose Azure AD B2C as the OAuth Vendor.

![](https://4185914948-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSItjRhbHaLQ4ar3DUljt%2Fuploads%2Fgit-blob-3cc6aa45b1223dac640b8eff5af36f4964226891%2Fazure-ad-b2c-v181-5.png?alt=media)

Next, fill in the following based off of your Azure AD B2C configuration.

**OAuth Client ID (Required)**

* The application (client ID) of the web application that is registered in Azure

**Tenant (Required)**

* The name of the Azure AD B2C tenant

**User Flow Policy (Required)**

* The name of the User Flow that was created.

**Custom Domain**

* The domain name of the Azure AD B2C tenant.

**Force auth on web link**

* Require authentication each time the web link is accessed.

![](https://4185914948-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSItjRhbHaLQ4ar3DUljt%2Fuploads%2Fgit-blob-a625b2bba23235e6e240aa50f5199b808e08c178%2Fazure-ad-b2c-v181-6.png?alt=media)

Then, save your app and Publish and test out the web link to see if you are asked to authenticate.

### Authentication Success

After setting up you OAuth authentication, go to **Connections Builder** and click on the **On Authentication Success** Event.

The “On Authentication Success” event will run when the user is authenticated. On this event, there is the `event` namespace where you can access data about the user.

![](https://4185914948-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSItjRhbHaLQ4ar3DUljt%2Fuploads%2Fgit-blob-35b5a2c5496bab77540dbf3e1b90d49485e9dd1e%2Fazure-ad-b2c-v181-7.png?alt=media)

To access this data and store it in a session variable, In the Inspector section, click on the **‘+’** icon under Actions and add a **Set Variable** action and set it to a property in the `event` namespace.
