Skip to main content
This guide walks through configuring Flipt v2 to enable login with Azure Active Directory B2C (Azure AD B2C) using the OIDC authentication method. Azure AD B2C is a standards-compliant OpenID Connect provider, so Flipt talks to it through the generic oidc method. However, B2C has two behaviors that require extra configuration compared to most providers:
  • Its OIDC discovery document is served from a policy-specific URL (using your tenant domain), while the issuer it reports is the tenant GUID. This requires the discovery_url option.
  • It returns the email address in an emails array rather than a string email claim. This requires the claims_mapping option.

​
Prerequisites

  • Docker
  • An Azure AD B2C tenant
  • A B2C user flow or custom policy (for example, a sign-up/sign-in flow such as B2C_1_signupsignin)

​
Register an application in Azure AD B2C

  1. In the Azure portal, switch to your Azure AD B2C tenant and open App registrations.
  2. Select New registration and give the application a meaningful name, such as “Flipt”.
  3. Under Redirect URI, select Web and enter your Flipt callback URL: https://your.flipt.instance.url.com/auth/v1/method/oidc/azure/callback
    The azure segment must match the provider name you use in your Flipt configuration. This guide uses azure.
  4. After creating the registration, open Certificates & secrets, select New client secret, and copy the generated value. You’ll use this as the client_secret.
  5. Copy the Application (client) ID from the app’s Overview page. You’ll use this as the client_id.

​
Find your issuer and discovery URLs

Flipt needs two related URLs that B2C keeps separate. Fetch your policy’s discovery document. The metadata path uses your tenant domain and policy name, and does not include the oauth2 segment:
From the JSON response:
  • The value of the issuer field is your issuer_url. It uses the tenant GUID, for example https://yourtenant.b2clogin.com/00000000-0000-0000-0000-000000000000/v2.0/. Copy it exactly, including the trailing slash.
  • The URL you fetched, without the .well-known/openid-configuration suffix, is your discovery_url, for example https://yourtenant.b2clogin.com/yourtenant.onmicrosoft.com/B2C_1_signupsignin/v2.0.
Don’t use the oauth2/v2.0/authorize or oauth2/v2.0/token endpoints as your issuer_url or discovery_url. Those are the authorize and token endpoints; the discovery document lives at the /v2.0/.well-known/openid-configuration path without the oauth2 segment.

​
Running Flipt

​
1. Define a Flipt config.yml

Configure the oidc method with a provider named azure. Set issuer_url and discovery_url from the previous step, and map the email claim from the B2C emails array.
config.yml
A few notes specific to Azure AD B2C:
  • claims_mapping maps Flipt’s email attribute to the first entry of the B2C emails array. This is required for email_matches to work, since B2C doesn’t emit a string email claim.
  • Don’t request email or profile in scopes. B2C only advertises the openid scope (which Flipt requests automatically); requesting others can cause the authorize request to fail. Email and name claims are delivered through your user flow’s application-claims configuration.
  • Don’t enable fetch_extra_user_info. B2C doesn’t expose a UserInfo endpoint, so enabling it causes the login callback to fail. All claims are already present in the ID token.

​
2. Run Flipt as a Docker container

​
3. Navigate to the Flipt UI

Open your Flipt instance in a browser. A “Login with Azure” option is presented. Selecting it redirects you to your B2C sign-up/sign-in experience, and after authenticating you’re returned to the Flipt dashboard.

​
Troubleshooting

NewProvider: unable to create provider: 404 Not Found Flipt couldn’t fetch the discovery document. This usually means the URL includes the oauth2 segment, or the policy name is wrong. The discovery document is at .../<policy>/v2.0/.well-known/openid-configuration (no oauth2). Verify the URL with curl as shown above. oidc: issuer did not match the issuer returned by provider The issuer_url doesn’t match the issuer reported by the discovery document. Set discovery_url to the policy URL you fetch discovery from, and set issuer_url to the exact issuer value from that document (the tenant-GUID form, including the trailing slash). Login succeeds but every request is rejected If you use email_matches but haven’t mapped the email claim, Flipt has no email to match and rejects requests. Add claims_mapping with email: "/emails/0" as shown above.

​
Conclusion

This guide showed how to configure Flipt v2 to authenticate with Azure AD B2C, including the discovery_url and claims_mapping options that B2C requires. If you have any questions or feedback, please reach out to the Flipt team on Discord or GitHub Discussions.
References: