Skip to main content

Configure Azure AD B2C

This guide connects DIAL to Azure AD B2C, Microsoft's customer identity (CIAM) service, so external users authenticate through a B2C user flow and DIAL authorizes them by a custom role claim. For the shared workflow, see the SSO / IdP setup overview.

Prerequisites​

  • A running DIAL deployment and the URL of your DIAL Chat instance, referred to below as <chat_url>.
  • An Azure subscription with permission to create a B2C tenant.

Step 1: Configure Azure AD B2C​

  1. Create a B2C tenant if you do not have one, and save its tenant ID (<azure_b2c_tenant_id>).
  2. Register a web application with redirect URI <chat_url>/api/auth/callback/azure-ad-b2c. Save the Application ID (<azure_b2c_app_id>).
  3. Create a client secret and save its value (<azure_b2c_client_secret>) along with the client ID (<azure_b2c_client_id>).
  4. Expose an API scope, for example Chat.Login, under Manage → Expose an API.
  5. Grant API permissions for that scope plus the OpenID scopes openid, profile, email, and offline_access.
  6. Create a user flow (sign-up / sign-in) and save its name (USER_FLOW_NAME). The flow must emit the sub, name, and emails claims.
  7. Add a roles claim. Configure the user flow to include a custom claim (this guide uses roles) carrying user role values, including an admin value for DIAL administrators.

Step 2: Configure DIAL Chat​

Set these environment variables on DIAL Chat. See DIAL Chat configuration — Azure AD B2C for the full list.

AUTH_AZURE_B2C_AUD: "<azure_b2c_app_id>"
AUTH_AZURE_B2C_CLIENT_ID: "<azure_b2c_client_id>"
AUTH_AZURE_B2C_CLIENT_SECRET: "<azure_b2c_client_secret>"
AUTH_AZURE_B2C_DIAL_ROLES_FIELD: "roles"
AUTH_AZURE_B2C_ADMIN_ROLE_NAMES: "admin"
AUTH_AZURE_B2C_NAME: "Azure B2C"
AUTH_AZURE_B2C_SCOPE: "openid profile email offline_access <azure_b2c_tenant_id>.onmicrosoft.com/<azure_b2c_app_id>/Chat.Login"
AUTH_AZURE_B2C_TENANT_ID: "<azure_b2c_tenant_id>"
AUTH_AZURE_B2C_USER_FLOW: "USER_FLOW_NAME"

To enable logout, also set:

FEDERATED_LOGOUT_PROVIDERS: "azure-ad-b2c"
tip

The application scope above is required to validate the access token signature.

Step 3: Configure DIAL Core​

Add the provider to the identityProviders section of DIAL Core static settings (settings.json). projectPath is aud because B2C carries the project in the audience claim. Generate a random loggingSalt, for example with pwgen -s 32 1.

{
  "identityProviders": {
    "azureb2c": {
      "issuerPattern": "^https:\\/\\/<azure_b2c_tenant_id>\\.b2clogin\\.com.+$",
      "jwksUrl": "https://<azure_b2c_tenant_id>.b2clogin.com/<azure_b2c_tenant_id>.onmicrosoft.com/<USER_FLOW_NAME>/discovery/v2.0/keys",
      "loggingKey": "sub",
      "loggingSalt": "<random_salt>",
      "projectPath": "aud",
      "rolePath": "roles",
      "userDisplayName": "name"
    }
  }
}

To grant administrator access, add a matching rule under access.admin.rules. This guide treats the claim roles with value admin as administrators.

{
  "access": {
    "admin": {
      "rules": [
        {
          "source": "roles",
          "function": "EQUAL",
          "targets": ["admin"]
        }
      ]
    }
  }
}

For every setting, see the Identity providers reference and the Access control reference.

note

DIAL Core reads static settings at startup. Restart Core after editing settings.json. Each setting can also be supplied as an aidial.identityProviders.azureb2c.* environment variable.

Step 4: Assign roles to resources​

In config.json (dynamic settings), add a role claim value to a deployment's userRoles array. This guide uses regular_user for non-admin users.

{
  "models": {
    "chat-gpt-35-turbo": {
      "userRoles": ["regular_user"]
    }
  }
}

Result​

External users sign in through the B2C user flow, administrators are recognized by the access.admin.rules match, and DIAL Core authorizes all other requests by the roles claim values.

Further reading​