Embedded sign-in in combination with the plugin?

Hi @tyrannous

I quickly read the documentation and I have the feeling that this should almost work out-of-the-(premium)-box.

From what I understand, you must embed an iframe in your WordPress website that requests a URL that will automatically redirect the user to the Azure AD B2C login page. So in other words: When the iframe is initialized, it will first request e.g. https://your-website.com/signup-signin/ and if you added this URL to the list of Private pages (on the plugin’s Single Sign-on configuration page when you selected the Internet Authentication scenario, also on the Single Sign-on configuration page) then the plugin will automatically redirect to Microsoft (assuming that the user is not signed in – when the user is already signed in, you need to make sure that you have hidden the iframe).

As soon as the user has authenticated successfully, the user will be redirected back to the website. The plugin will detect the ID token, processes it and will sign in the user.

I wrote almost, because there are a few things that need to be tested and probably adapted.

First of all, the plugin is iframe-aware and as soon as it detects an iframe it will initialize a popup to start authentication (if authentication is required, that is). However, this behavior must be supressed.

Secondly, the plugin does not support custom login domains for Azure AD B2C at the moment. It will always send the user to <your-domain>.b2clogin.com instead. This will cause cookie-related trouble.

Thirdly, when the user is redirected back in the iframe, the top level window needs to be reloaded e.g. to hide the iframe and to reload the page for the logged-in user. Similar functionality is currently implemented for the iframe-popup logic. Alternatively, the user is redirected to a page that reloads the top window.

I find this approach very interesting and I recommend that you add this request also as an idea to the plugin’s user voice.

Is this something that can wait to the begin of the new year 2023?

Hi Marco,

Thank you very much for your detailed response!

Is this something that can wait to the begin of the new year 2023?

This is one of the “everything needs to be done yesterday” clients. So while I’m glad you seem to consider this a possible addition to the plugin, the SSO feature is supposed to go live in February 2023. If I may speak openly, I’m afraid of doing “nothing” ourselves and hoping for the plugin to gain support for that feature in time.

I wrote almost, because there are a few things that need to be tested and probably adapted.

Do you mean that the points you mentioned would need to be changed in the plugin by you, or can be adjusted by us developers? Sorry, I never checked the plugin’s source code for possible filters, etc.

[…] add this request […] as an idea to the plugin’s user voice.

Thanks, I didn’t know this existed. Added it (and another one from an earlier email ?? ).

Hi @tyrannous

I’ll see what can be done in December from a development point of view.

PS Thanks for User Voice entries!

Hi @tyrannous

I have made some good progress with Azure AD B2C embedded login and manage to test it successfully at my end. It supports the necessary custom B2C domain e.g. login.contoso.com plus you can select a policy of your choice e.g. to sign in or to sign up. Furthermore, I have added a shortcode that you can embed on a page that you would then call as your initial source of the iframe. The shortcode will then initiate the redirect inside the iframe to the Azure AD B2C login page. This shortcode can be parameterized with an Azure AD B2C policy and a URL where the user should be sent upon successful authentication. That URL should then point to a page that would not do anything else but refresh the top level window (to burst out the iframe).

Let me know if you’re interested in testing this solution by contacting me via support [@] wpo365 email channel so I can provide you with download instructions.

Hi @tyrannous

The new functions proposed and discussed here have long since become part of the production version of WPO365. Therefore I am closing this issue and mark it as resolved.

Thanks!

-Marco

Hi @wpo365, thanks so much for adding support for Embedded sign-in, and sorry for not getting back to you earlier. Unfortunately, the client ditched using this feature (because of technical limitations on Azure side) and decided to use the regular login button instead.

Thanks!