Azure AD B2C：能否对接第三方自定义用户存储实现统一登录验证？

Absolutely! This scenario is perfectly achievable with Azure AD B2C Custom Policies—it’s actually one of the core use cases for extending B2C’s authentication capabilities to external user stores. Let me break down how this works and how you can implement it:

1. Set up a RESTful Technical Profile for Third-Party Validation #

Azure AD B2C’s custom policies let you define a RestfulProvider technical profile that sends the user’s input (username/email and password) to your trusted third-party authentication API. Here’s the gist:

• Map the user’s entered signInName and password as input claims that get sent to your third-party service (usually via a POST request in the request body).
• Configure the technical profile to expect specific claims back from the third-party service once validation succeeds—things like user ID, display name, email, or any other attributes you need.

Here’s a simplified example of what this technical profile might look like in your policy XML:

<TechnicalProfile Id="ThirdPartyCredentialValidation">
  <DisplayName>Validate with External User Store</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ServiceUrl">https://your-trusted-service.com/api/validate-credentials</Item>
    <Item Key="SendClaimsIn">Body</Item>
    <Item Key="AuthenticationType">ApiKey</Item> <!-- Secure your API with an API key -->
    <Item Key="ApiKeyHeaderName">X-Api-Key</Item>
    <Item Key="ApiKey">your-api-secret-here</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="userIdentifier" />
    <InputClaim ClaimTypeReferenceId="password" PartnerClaimType="userPassword" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="externalUserId" />
    <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="fullName" />
    <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="userEmail" />
  </OutputClaims>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

2. Integrate the Validation into Your User Journey #

To create a seamless login experience (where users don’t have to choose between B2C and external accounts), you can structure your user journey to:

• First attempt to validate the credentials against Azure AD B2C’s local user store.
• If that validation fails, automatically fall back to calling the third-party validation technical profile.

Alternatively, you could build logic to check for a specific identifier (like a domain suffix in the email) to route users directly to the correct validation source—but the "fallback" approach works best for a truly unified experience.

3. Handle Claims Post-Validation #

Once the third-party service confirms the credentials are valid, it should return the user’s core attributes as claims. Azure AD B2C can then:

• Use these claims to generate the ID/access tokens for your application (so your app gets consistent user data regardless of where the user is stored).
• Optionally, create a "shadow" account in Azure AD B2C for the external user. This lets you store additional attributes or use B2C’s features (like MFA) for these users without modifying the external store. If you choose this route, add a step to your user journey to create the local account using the claims returned from the third-party service.

Critical Security Notes #

• Always use HTTPS for communication between B2C and your third-party service to protect credentials in transit.
• Secure your third-party API with authentication (like API keys or OAuth2) to ensure only B2C can call it.
• Avoid storing the user’s password in B2C if the external store is the authoritative source—let the third-party handle password storage and validation.

This approach gives you a single login flow that works for both your B2C-native users and those in your custom external store, keeping the experience consistent for all end-users.

内容的提问来源于stack exchange，提问作者venkatr