I spent a lot of time looking at this at work, and it was not smooth sailing for a complex workflow.
The main issue is that B2B supports it pretty well, but if you need to say, do something like add an extra attribute dynamically to the JWT tokens, or allow automatic migration from a legacy IdP on first logon, you are forced to use B2C and Custom Policies which are effectively a programming language defined in XML and which are quite nasty to use. In addition to that, B2C doesn’t fully implement all of OIDC so things like client credential flow are still in “Preview” at the moment. Deployment of custom policies is also only by use of a “Preview” API too. It didn’t feel mature enough to me.
Azure AD is 6$/mo per Premium P1 user as far as I know, but I think yrro is talking about Azure AD B2C and that's free up until something like 200,000 monthly active users (not affiliated with Azure but their calculator is my start page)
Comments
I've had pretty good experiences with Azure Active Directory's flavour of OpenID Connect. Multiple callback URIs are supported per app registration.
I spent a lot of time looking at this at work, and it was not smooth sailing for a complex workflow.
The main issue is that B2B supports it pretty well, but if you need to say, do something like add an extra attribute dynamically to the JWT tokens, or allow automatic migration from a legacy IdP on first logon, you are forced to use B2C and Custom Policies which are effectively a programming language defined in XML and which are quite nasty to use. In addition to that, B2C doesn’t fully implement all of OIDC so things like client credential flow are still in “Preview” at the moment. Deployment of custom policies is also only by use of a “Preview” API too. It didn’t feel mature enough to me.
Azure B2C policies are a nightmare. Basically a programming language implemented in XML. Stay away from it.
I've had real issues with Azure. The (opaque, non JWT) refresh token seems to expire well before the access token is due to expire.
Unless I force the access token to be refreshed 20 or 30 minutes before the stated expiry time then the session gets killed off.
It works now, but there was a lot of head scratching and trail-and-error before I found out what was going on.
But is Azure AD free? When I checked it out, it looked like you have to pay for using it?
Azure AD is 6$/mo per Premium P1 user as far as I know, but I think yrro is talking about Azure AD B2C and that's free up until something like 200,000 monthly active users (not affiliated with Azure but their calculator is my start page)
AAD without all the security features (p1/p2) is free, with some limitations you'll quickly hit if using as your main directory. https://jumpcloud.com/blog/understanding-aad-pricing-free is a decent overview
* 50,000 monthly active users
I think there's a very limited edition available for free.