Detect social account existence flow using custom policies on Azure AD B2C

543 Views Asked by At

I am struggling to get my head around how to implement a custom policy for the following flow:

User lands on the login page and that login page only contains an email input.
User enters email address and clicks continue
    if user has already registered
        Redirected to their selected login provider (Google, Microsoft Account or Local Account)
    if user has not registered before
        Check google provider if a user account exists for that email address
        if Google account exists
            Redirect to Google login
        Check Microsoft provider if a user account exists for that email address
        if Microsoft account exists
            Redirect to Microsoft login
        else
            Redirect to registration screen
            User completes registration screen
            User is automatically logged in
            
The user

I've investigated whether this can in fact be done and I've found a "digital workspace for visual collaboration" (a.k.a Mural.co) that does in fact implement a similar flow, so this has to be possible. See the pictures below.

Landing page

Microsoft social account detected page

I'm, however, unable to find information on

  1. how to query the social providers for account existence
  2. how to go about creating this complex type of flow in Azure AD B2C custom policies.

Any pointers in the right direction would be greatly appreciated

1

There are 1 best solutions below

2
On BEST ANSWER
  1. Not possible. Nobody would allow you to probe a social IdP for an email. Data protection etc.

  2. Reference our samples and wiki

Your sign up would be from our default sign up journey.

Your sign in flow could work like this:

  1. Request for email
  2. Read the directory to see if an email exists
  3. If email exists, send the user to the IdP they used to sign up. You can do that by looking at the “issuers” registered on the userIdentity object,
  4. If email doesn’t exist, send the user to the combined sign in and sign up page (technical profile) where they can sign in with social or sign up with a local account. Hide the sign in elements with CSS.