Hi Alin,

Did you ever get this working? I am planning on using Azure AD B2C for membership and Azure AD for back office users.

I previously got Identity Server 4 working with the Umbraco 8 backoffice. But I have no idea where to start with Umbraco 9, since everything moved to .Net core.

Any advice you could offer would be great.

Thanks for the info Alin,

I have since been able to get the Backoffice login working. I used:

AddBackOfficeExternalLogins(...)

in ConfigureServices() and populated all the required options with the values from my Azure AD B2C instance and it seems to be working.

Next step is to try to get Members working.

It seems to me that the work to support this in Umbraco 9 is not quite complete yet.

For one thing, when I try to use the backoffice to "Restrict Public Access" I am required to supply a login page that exists in the content tree.

Also, there is some code commented out in the source that seems to pertain to this:

public static class AuthenticationOptionsExtensions
{
    // TODO: Migrate this! This will basically be an implementation of sorts for IBackOfficeExternalLoginProviders

So with that in mind, this is as far as I have gotten:

Step 1 - add a composer to use Microsoft.Identity.Web:

    public void Compose(IUmbracoBuilder builder)
    {
        builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApp(builder.Config, "AzureAdB2C");
    }

Step 2 - override the default rendering controller to authenticate with this scheme:

[Authorize(AuthenticationSchemes = OpenIdConnectDefaults.AuthenticationScheme)]
public class CustomRenderController : RenderController
{
    public CustomRenderController(ILogger<RenderController> logger, ICompositeViewEngine compositeViewEngine, IUmbracoContextAccessor umbracoContextAccessor)
        : base(logger, compositeViewEngine, umbracoContextAccessor)
    {
    }

    [AllowAnonymous]
    public override IActionResult Index()
    {
        return base.Index();
    }
}

Step 3 - Handle requests to the login page

I created a new Document Type for the login page, then added a filter that would check if the request was for that doc type. If so, it returns a challenge result to reditect the user to AD B2C.

        public override async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
    {

        UmbracoRouteValues umbracoRouteValues = HttpContext.Features.Get<UmbracoRouteValues>();

        if (umbracoRouteValues.TemplateName == "OidcLogin" && !User.Identity.IsAuthenticated)
        {
            context.Result = Challenge(OpenIdConnectDefaults.AuthenticationScheme);
        }
        else
        {
            await base.OnActionExecutionAsync(context, next);
        }
    }

This all seems to work. BUT. Now I am getting this error:

InvalidOperationException: Unable to convert user ID to int Umbraco.Cms.Core.Security.UmbracoUserStore

Which I can only imagine is because the AD B2C id is a Guid and cant be converted to an int.

This one doesn't feel like it is easily worked around.

I've made some progress following this blogpost. The issue I'm facing now is that it works only for newly generated users. When I try to authenticate an older user (saved on the Umbraco 8 version of the website) it fails like this

Alin, is it possible to share any more detail on how you are implementing Azure B2C for Umbraco 9? I saw the blog post by Scott Brady and I'm looking to implement the same kind of thing. I'm not finding much on Azure B2C implementations for Umbraco 9.. any help is greatly appreciated

is working on a reply...