I am looking for some guidance on how I can use an Azure B2C custom policy to federate to a legacy Authentication Server. Here is the current flow that I would like to implement in the custom policy.
This protocol looks like a hybrid Oauth1 and the "actors" involved are:
Browser based user Application Server Authentication Server + protected resources
The Application server is preconfigured with an application id and an application secret provided by the Authentication Server. The Authentication server is also configured with a callback URL (pointing to the Application server). - Similar setup to OAuth.
Flow:
Step 1: The user requests a resource from the Application server by performing a GET on the application server (e.g. GET /resource
Step 2: The application server calculates an attribute using the preconfigured client secret and redirects the browser to the Authentication Server.
Step 3: If the Authentication Server determines that the user needs to be authenticated and may prompt the user for a username/password. This is transparent to the application server.
Step 4: The Authentication Server verifies the application server-provided attributes sent in Step 2 and responds by redirecting the user to the preconfigured application server callback URL. This request will additionally include a number of attributes set by the authentication server.
Step 5: The browser redirects the user to the application server’s callback URL and the application server uses the attributes received in Step 4 to calculate a resource request token
Step 6: The application server uses this request token to request protected resources and responds to the user's original request.
I am looking for ways to implement the above. Do I build this using a custom policy with an Oauth1 Technical profile Or an OIDC technical profile or something else?
The only way to do this is to create some middle layer than talks OpenId Connect to AAD B2C and talks the proprietary protocol to your legacy system.
Azure AD B2C can then make an open id connect request to your web server and it can do whatever it needs. Just have it respond back to B2C in an open id connect way.