title: B2C as IdP for SalesForce
body: <p>Completely new to B2C.  Tried both of these walkthroughs, but I'm missing something still:</p>
  
  <p><a href="https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/master/Walkthroughs/RP-SAML.md" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/master/Walkthroughs/RP-SAML.md</a></p>
  
  <p><a href="http://blogs.quovantis.com/saml-based-sso-with-azure-ad-b2c-as-an-idp/" rel="nofollow noreferrer">http://blogs.quovantis.com/saml-based-sso-with-azure-ad-b2c-as-an-idp/</a></p>
  
  <p>Both of these only describe the policies needed, but I'm pretty sure I need to register an app on B2C still?  The problem I have with app registration is that SalesForce gives me a token endpoint URL with a query string:</p>
  
  <p><a href="https://mycompany.cs79.my.salesforce.com/services/oauth2/token?so=00D1h000000Cnli" rel="nofollow noreferrer">https://mycompany.cs79.my.salesforce.com/services/oauth2/token?so=00D1h000000Cnli</a></p>
  
  <p>And B2C won't allow query strings in the reply URL.</p>
  
  <p>Is there any way around this?  Salesforce also supports OpenID I think, if that would be better?</p>
  
  <p><strong>::::::::::::UPDATE 6/22::::::::::</strong></p>
  
  <p><strong>SAML:</strong></p>
  
  <p>I found and realized I was missing a critical step on the SalesForce side: <a href="https://help.salesforce.com/articleView?id=domain_name_login_id_prov.htm&amp;type=5" rel="nofollow noreferrer">adding the authentication provider to my domain's login page</a>.  Clicking the new link redirects me to B2C, but I get an immediate error from B2C.  Application Insights shows the following exception:</p>
  
  <blockquote>
    <p>The SAML technical profile 'serviceProviderMetadata' specifies a PartnerEntity URL of 'REMOVED', but fetching the metadata fails with reason 'For security reasons DTD is prohibited in this XML document. To enable DTD processing set the DtdProcessing property on XmlReaderSettings to Parse and pass the settings into XmlReader.Create method.</p>
  </blockquote>
  
  <p><strong>OpenID:</strong></p>
  
  <p>Using <a href="https://help.salesforce.com/articleView?id=sso_provider_azure.htm" rel="nofollow noreferrer">this</a> write-up as a guideline, I've registered the app in B2C and configured the SalesForce side.</p>
  
  <p>Instead of using the Azure AD authorization endpoints, I pulled my B2C tenants endpoints from my meta data URL (login.microsoftonline.com/{tenant}/.well-known/openid-configuration).</p>
  
  <p>This works for my B2C admin account, however, when I try try a test user that isn't a B2C admin I get the following error from the B2C sign-in page:</p>
  
  <blockquote>
    <p>Sorry, but we’re having trouble signing you in.
    AADSTS50020: User account 'REMOVED' from identity provider 'LINK REMOVED' does not exist in tenant 'MTB2CTest' and cannot access the application '5c8b9f4f-cf28-42fe-b629-b87251532970' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account. </p>
  </blockquote>
  
  <p><strong>::::::::::::UPDATE 6/23::::::::::</strong></p>
  
  <p><strong>OpenID:</strong></p>
  
  <p>I’ve found that it works 100% only for my B2C admin account <strong>if I don’t use a policy</strong>, but doesn't work for other accounts.  <strong>When I use a policy</strong>, only accounts that signed up through the policy can authenticate with B2C (which is great) – but the token doesn’t seem to be reaching SalesForce.  I've created two PDFs showing the configuration details and the results from each method (policy and nopolicy) <a href="https://drive.google.com/drive/folders/1tYAcv3AXHA1mVIbfETWnarAQSwot3_RV?usp=sharing" rel="nofollow noreferrer">here</a>.</p>