rbrayb

	OIDC / JWT	SAML / XML Token
Format	Compact JSON, Base64url-encoded, 3 parts	Verbose XML document
Transport	HTTP header (Bearer), URL fragment, JSON body	Browser form POST (SAMLResponse)
Signing	JSON Web Signature (JWS) — RSA or ECDSA over a hash	XML Digital Signature — canonicalized XML subtree
Primary consumer	Modern APIs, SPAs, mobile apps	Legacy enterprise apps, portals
User Identifier	sub claim — opaque unique string for the user	saml:NameID element — format varies - email, persistent ID, transient
Claims	JSON key/value pairs inside a payload object	XML saml:Attribute elements inside an Assertion
Initiated by	SP redirects user to IdP with a simple URL	IdP POSTs XML blob to SP's ACS URL
Tooling	Lightweight — any JWT library in any language	Heavy — requires XML parsing, canonicalization, namespace handling

rbrayb

# FormatPemWithSlashN.ps1 - Convert PEM key to JSON-safe format
#
# This script reads a PEM-encoded private key file and converts it to a format
# that can be safely embedded in JSON configuration files (e.g., appsettings.json).
# It replaces actual newlines with the literal string "\n" so the multi-line key
# becomes a single-line string suitable for JSON values.

# Path to the PEM file containing the private key
$pemPath = ".\jit-private-key.pem"  # Change this to your actual PEM file path

rbrayb

Passkey Fix Documentation for 1Password Compatibility

Overview

This document details the changes made to fix passkey authentication issues with 1Password and other authenticators in the Blazor application. The primary issue was related to improper serialization of WebAuthn credential data, specifically the handling of ArrayBuffer fields and required JSON properties.

Error Messages Resolved

1. Initial Error: The attestation credential JSON had an invalid format: Expected a valid base64url string.
2. Secondary Error: credential.toJSON is not a function
3. Final Error: JSON deserialization for type 'Microsoft.AspNetCore.Identity.PublicKeyCredential' was missing required properties including: 'clientExtensionResults'.

rbrayb

const browserSupportsPasskeys =
    typeof navigator.credentials !== 'undefined' &&
    typeof window.PublicKeyCredential !== 'undefined' &&
    typeof window.PublicKeyCredential.parseCreationOptionsFromJSON === 'function' &&
    typeof window.PublicKeyCredential.parseRequestOptionsFromJSON === 'function';

// Passkey fix: Helper function to convert ArrayBuffer to base64url string
// Base64url encoding is required by WebAuthn spec - it's base64 but URL-safe
// (replaces + with -, / with _, and removes padding =)
function arrayBufferToBase64Url(buffer) {

rbrayb

Category	B2C Capability	External ID Status	Difference	Migration Action	Gotcha	Citations
Local Accounts	Native local username/password authentication	Native support with email/phone	Same core capability	Direct migration via Graph API	-	-
Social Identity Providers	Google, Facebook, Microsoft Account, etc.	Native support for major providers	Same integration model	Reconfigure identity providers in External ID	-	learn.microsoft.com
Custom Identity Providers (OIDC)	Generic OIDC federation	Native OIDC support	Similar configuration	Recreate OIDC apps in External ID	-	-
SAML Federation	SAML 2.0 enterprise federation	Supported via Entra ID federation	Requires Entra ID premium SKU	Migrate SAML trust to Entra federation	SAML requires premium license in External ID	[learn.microsoft.com](https://learn.mic

rbrayb

# If you haven't done this already...
# Install-Module -Name Microsoft.Graph -Repository PSGallery -Scope CurrentUser -Force -AllowClobber
# Install-Module -Name Microsoft.Entra -Repository PSGallery -Scope CurrentUser -Force -AllowClobber
# Import-Module Microsoft.Graph
# Import-Module Microsoft.Entra

# Sign in interactively to your EEID tenant. 
Connect-MgGraph -Scopes 'User.ReadWrite.All', 'Directory.ReadWrite.All'

# Update your values

rbrayb

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:xsd="http://www.w3.org/2001/XMLSchema"
	xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0"
	TenantId="tenant.onmicrosoft.com" PolicyId="B2C_1A_OrchestrateToCiam_PwdMigrate_Hybrid"
	PublicPolicyUri="http://tenant.onmicrosoft.com/B2C_1A_OrchestrateToCiam_PwdMigrate_Hybrid"
	DeploymentMode="Development"
	UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights">

	<!--
   Please modify policyId to save the policy. 

rbrayb

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:xsd="http://www.w3.org/2001/XMLSchema"
	xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0"
	TenantId="tenant.onmicrosoft.com" PolicyId="B2C_1A_OrchestrateToCiamV_FullMigrate_Hybrid"
	PublicPolicyUri="http://tenant.onmicrosoft.com/B2C_1A_OrchestrateToCiamV_FullMigrate_Hybrid"
	DeploymentMode="Development"
	UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights">

	<!--
   Please modify policyId to save the policy. 

rbrayb

using Azure.Identity;
using Microsoft.Graph;
using Microsoft.Graph.Models;
using Microsoft.Graph.Models.ODataErrors;
using Microsoft.Identity.Client;
using System;
using System.Threading.Tasks;

namespace GraphPhoneAuthenticationDemo
{

rbrayb

using Microsoft.IdentityModel.Logging;
using Microsoft.IdentityModel.Tokens;
using Newtonsoft.Json.Linq;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Cryptography;
using System.Text;

class Program
{
    // https://xsreality.medium.com/making-azure-ad-oidc-compliant-5734b70c43ff