This post looks at implementing an Open ID Connect identity provider in Microsoft Entra External ID. Auth0 is used as the identity provider and an ASP.NET Core application is used to test the authentication. Microsoft Entra External ID federates to Auth0.
Client code: https://github.com/damienbod/EntraExternalIdCiam
Microsoft Entra External ID supports federation using OpenID Connect and was used to create the Auth0 OpenID Connect client. The settings configured in the portal must align with those in the Auth0 identity provider. The Entra External ID OIDC client would work with most IDPs, since standard OpenID Connect is used.
The corresponding client configuration was created in Auth0:
The Auth0 client in this setup returns the email in the name claim. This must match in the claim mapping in Entra External ID. The email claim is switched to use the name claim. Depending on the mappings, different claim mappings are required. The values are read from the id_token.
The correct callback URLs MUST be set on the Auth0 client configuration. Entra External ID requires the following redirectly URLs:
https://<tenant-subdomain>.ciamlogin.com/<tenant-ID>/federation/oauth2
https://<tenant-subdomain>.ciamlogin.com/<tenant-subdomain>.onmicrosoft.com/federation/oauth2
The values are added to the Auth0 client. See the Entra External ID docs.
Once the OpenID Connect client is setup, the identity provider can used in the Entra External ID user flow. Select the required user flow:
And select the Identity Providers and add the OpenID connect IdP.
To test, an ASP.NET Core application using Microsoft.Identity.Web was implemented to authenticate against Entra External ID. When the user is redirected the authenticate, the sign-in with Auth0 option is displayed.
Notes
This works well, but setting up the mappings can be difficult if you don’t know the mapping. With this it is possible now to use identities from almost any identity provider.
Software Engineering 