Secure API with Azure AD / B2C Users

Question

My use case:

• Creating users through an API with custom fields, assigned password using any email address
• Update / disable these users through the API
• "Log in" to the Azure AD application with user data through an access API to receive a token
• Perform authorized web API requests when passing a token in the Http header

Is it possible to achieve all this with direct Azure AD / B2C or should I look at another identity provider, for example. IdentityServer / Auth0?

Change 1

I am very confused between the AAD applications / users and the B2C applications / applications, in this case there is very little guidance as to what to use.

Using https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet as a starting point, I get the following results when connecting the client ID and privacy from :

• Azure AD - Application Type Web Application / Api - works, can create a user
• Azure AD - Native application type - not working, cannot create user
• Azure B2C - an application created in Powershell by reference - works, can create a user, however, I do not see the newly created application on the Azure portal and cannot make changes.
• Azure B2C - an application created in the B2C user interface - does not work, the request for Graph Api ends with "insufficient permissions". I added read / write permissions manually in Powershell, but that didn't work.

At this point, I do not know what is the right approach for my scenario.

Answer 1

If you want to add local accounts to Azure AD B2C, you can use the Azure AD Graph API to do this to add the local account user to the Azure Active Directory B2C tenant, see Create a user api document (local account) .

If you want to add social accounts such as Facebook and Google, you need to check to see if these credentials provide REST APIs to manage your users.

Edit

To connect to the Graph API, you currently need to configure another application in Azure AD (not in azure b2c ad):

In this application, you can set the application key and grant permissions to use the Azure AD APIs. Another way is to use the powershell authority principle and attach the permissions of the 3-graphics API:

https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2c-devquickstarts-graph-dotnet/

After a user logs into a B2C application when calling the api graph, you can use ADAL v2 or v3 to get access tokens that can be used with the Azure AD Graph API (using the client account stream). See the sample code in the link above.

If you want to limit the use of users who can create users using the Graph api, you can write your own logic in the application to control this.

Update:

The B2C application (which is created in the b2c blade server) can help you log in and register, but the B2C application cannot access the API at present (in the preview, but cannot select any api on my portal) therefore you need to use the AD application (in the azure commercial) that can provide permission to access other APIs, such as the Microsoft Graph API. When the link is: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet , in the article it creates a ServicePrincipal, not an application, so you don’t can find the application, click here for more information on the main objects of applications and services in Azure Active Directory