Blogs

Share on facebook
Share on twitter
Share on linkedin
Share on email

Sign-up and sign-in with Bitbucket using Azure AD B2C

This article describes how to add authentication for a Bitbucket account to an Azure AD B2C custom policy.

Architecture

The following diagram illustrates the authentication flow for a Bitbucket account to an Azure AD B2C custom policy.

The authentication flow requires an Azure function that retrieves claims for the authenticated user.

For information about Bitbucket and OAuth 2.0, see https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/.

Prerequisites

  1. If you don’t already have one, then you must create an Azure AD B2C tenant that is linked to your Azure subscription.
  2. Prepare your Azure AD B2C tenant by creating the token signing and encryption keys and creating the Identity Experience Framework applications.
  3. Download one of the starter packs for Azure AD B2C from Microsoft’s GitHub repository.

Create the Azure function

  1. Create a C# function containing the following code. This implements a GetBitbucketClaims function that retrieves claims for the authenticated user. Firstly, this function retrieves the ID and name claims for this user (see https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-get). Then, it retrieves the e-mail addresses for them (see https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-emails-get) and returns the confirmed, primary e-mail address. Publish this C# function to a function app.
using System;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Threading.Tasks;
using System.Web.Http;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.Extensions.Logging;

namespace SignInWithBitbucket
{
    public static class GetBitbucketClaims
    {
        private static readonly HttpClient InnerClient = new HttpClient();

        [FunctionName("GetBitbucketClaims")]
        public static async Task<IActionResult> Run(
            [HttpTrigger(AuthorizationLevel.Anonymous, "get")] HttpRequest request,
            ILogger logger)
        {
            if (!request.Headers.TryGetValue("Authorization", out var authorizationHeaderValues))
            {
                logger.LogError("The Authorization header is missing");
                return new BadRequestResult();
            }

            if (authorizationHeaderValues.Count > 1)
            {
                logger.LogError("The Authorization header is invalid");
                return new BadRequestResult();
            }

            var authorizationHeaderValue = authorizationHeaderValues[0];
            var authorizationHeaderValueParts = authorizationHeaderValue.Split(' ');

            if (authorizationHeaderValueParts.Length != 2 || !authorizationHeaderValueParts[0].Equals("Bearer", StringComparison.OrdinalIgnoreCase))
            {
                logger.LogError("The Authorization header is invalid");
                return new BadRequestResult();
            }

            InnerClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(authorizationHeaderValueParts[0], authorizationHeaderValueParts[1]);

            // Get the current user.
            // For more information, see https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-get.

            var innerUserRequest = new HttpRequestMessage(HttpMethod.Get, "https://api.bitbucket.org/2.0/user");
            var innerUserResponse = await InnerClient.SendAsync(innerUserRequest);

            if (innerUserResponse.StatusCode != HttpStatusCode.OK)
            {
                return new InternalServerErrorResult();
            }

            var innerUserResponseModel = await innerUserResponse.Content.ReadAsJsonAsync<BitbucketUserClaimsResponseModel>();

            // List the e-mail addresses for the current user.
            // For more information, see https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-emails-get.

            var innerUserEmailsRequest = new HttpRequestMessage(HttpMethod.Get, "https://api.bitbucket.org/2.0/user/emails");
            var innerUserEmailsResponse = await InnerClient.SendAsync(innerUserEmailsRequest);

            if (innerUserResponse.StatusCode != HttpStatusCode.OK)
            {
                return new InternalServerErrorResult();
            }

            var innerUserEmailsResponseModel = await innerUserEmailsResponse.Content.ReadAsJsonAsync<BitbucketUserEmailsClaimsResponseModel>();

            var responseModel = new
            {
                id = innerUserResponseModel.Uuid,
                email = innerUserEmailsResponseModel.Values != null && innerUserEmailsResponseModel.Values.Any()
                    ? innerUserEmailsResponseModel.Values.FirstOrDefault(userEmailModel => userEmailModel.IsPrimary && userEmailModel.IsConfirmed && userEmailModel.Type.Equals("email", StringComparison.OrdinalIgnoreCase))?.Email
                    : null,
                name = innerUserResponseModel.DisplayName
            };

            return new OkObjectResult(responseModel);
        }
    }
}

The model classes are implemented as follows.

using Newtonsoft.Json;

namespace SignInWithBitbucket
{
    public class BitbucketUserClaimsResponseModel
    {
        [JsonProperty("uuid")]
        public string Uuid { get; set; }

        [JsonProperty("display_name")]
        public string DisplayName { get; set; }
    }

    public class BitbucketUserEmailsClaimsResponseModel
    {
        [JsonProperty("values")]
        public IEnumerable<BitbucketUserEmailModel> Values { get; set; }
    }

    public class BitbucketUserEmailModel
    {
        [JsonProperty("email")]
        public string Email { get; set; }

        [JsonProperty("is_confirmed")]
        public bool IsConfirmed { get; set; }

        [JsonProperty("is_primary")]
        public bool IsPrimary { get; set; }

        [JsonProperty("type")]
        public string Type { get; set; }
    }
}

The ReadAsJsonAsync extension method is implemented as follows.

using System.Net.Http;
using System.Threading.Tasks;
using Newtonsoft.Json;

namespace SignInWithBitbucket
{
    public static class HttpContentExtensions
    {
        public static async Task<T> ReadAsJsonAsync<T>(this HttpContent content)
        {
            if (content == null)
            {
                return default;
            }

            var value = await content.ReadAsStringAsync();
            return JsonConvert.DeserializeObject<T>(value);
        }
    }
}

Configure a Bitbucket application

  1. Log in to https://bitbucket.org/dashboard/overview.
  2. Select Your profile and settings and then select All workspaces.
  3. In the Workspaces page, select a workspace.
  4. In the workspace page, select Settings and then select OAuth consumers.
  5. In the OAuth consumers page, select Add consumer.
  6. In the Add OAuth consumer page, enter the following fields and then select Save:
    1. Name
    2. Callback URL: Enter either https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp if you use the built-in domain or https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp if you use a custom domain for the Callback URL field. Replace your-tenant-name with your tenant name and your-domain-name with your custom domain.
    3. Permissions: In the Account section, select Email and Read.
  7. In the OAuth consumers page, expand the application name and then copy the Key and Secret fields.

Add the client secret for the Bitbucket application as a policy key

  1. Sign in to the Azure AD B2C portal.
  2. Select Identity Experience Framework.
  3. Select Policy keys.
  4. Select Add.
  5. In the Create a key section, enter the following fields and then select Create:
    1. Options: Manual
    2. Name: BitbucketClientSecret
    3. Secret: Paste the Secret field that was copied in the previous section.

Configure Bitbucket as an identity provider

  1. Open the TrustFrameworkExtensions.xml file.
  2. Find the ClaimsProviders element. If it doesn’t exist, then add it to the TrustFrameworkPolicy element.
  3. Add the following ClaimsProvider element to the ClaimsProviders element. Replace your-bitbucket-client-id with the Key field that was copied in the Configure a Bitbucket application section. Replace your-function-app-name with the function app name that was created in the Create the Azure function section.
<ClaimsProvider>
  <Domain>bitbucket.org</Domain>
  <DisplayName>Bitbucket</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="Bitbucket-OAuth2">
      <DisplayName>Bitbucket</DisplayName>
      <Protocol Name="OAuth2" />
      <Metadata>
        <Item Key="client_id">your-bitbucket-client-id</Item>
        <Item Key="authorization_endpoint">https://bitbucket.org/site/oauth2/authorize</Item>
        <Item Key="AccessTokenEndpoint">https://bitbucket.org/site/oauth2/access_token</Item>
        <Item Key="ClaimsEndpoint">https://your-function-app-name.azurewebsites.net/api/GetBitbucketClaims</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="BearerTokenTransmissionMethod">AuthorizationHeader</Item>
        <Item Key="UsePolicyInRedirectUri">false</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="client_secret" StorageReferenceId="B2C_1A_BitbucketClientSecret" />
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="bitbucket.org" AlwaysUseDefaultValue="true" />
        <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="id" />
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

Add a user journey

  1. Open the TrustFrameworkBase.xml file.
  2. Copy the UserJourney element that includes Id="SignUpOrSignIn".
  3. Open the TrustFrameworkExtensions.xml file and find the UserJourneys element. If it doesn’t exist, then add it to the TrustFrameworkPolicy element.
  4. Paste the UserJourney element that was copied in step 2 to the UserJourneys element and replace the Id attribute for this UserJourney element from "SignUpOrSignIn" to "BitbucketSignUpOrSignIn".

Add the identity provider to the user journey

  1. Add the claims provider that was configured in the Configure Bitbucket as an identity provider section to the user journey that was added in the previous section.
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
  <ClaimsProviderSelections>
    ...
    <ClaimsProviderSelection TargetClaimsExchangeId="BitbucketExchange" />
  </ClaimsProviderSelections>
  ...
</OrchestrationStep>

<OrchestrationStep Order="2" Type="ClaimsExchange">
  ...
  <ClaimsExchanges>
    <ClaimsExchange Id="BitbucketExchange" TechnicalProfileReferenceId="Bitbucket-OAuth2" />
  </ClaimsExchanges>
  ...
</OrchestrationStep>

Configure the relying party policy

  1. Open the SignUpOrSignIn.xml file.
  2. Replace the ReferenceId attribute for the DefaultUserJourney element from "SignUpOrSignIn" to "BitbucketSignUpOrSignIn".
<RelyingParty>
  <DefaultUserJourney ReferenceId="BitbucketSignUpSignIn" />
  ...
</RelyingParty>

Upload and test the custom policy

  1. Upload all policy files in the following order to your Azure AD B2C tenant:
    1. TrustFrameworkBase.xml
    2. TrustFrameworkLocalization.xml
    3. TrustFrameworkExtensions.xml
    4. SignUpOrSignIn.xml
  2. Test the B2C_1A_signup_signin policy from your Azure AD B2C tenant.
[mailpoet_form id="1"]

Other Recent Blogs

Multiple conditions for Bicep resource deployments

After working with Bicep templates we have discovered a useful mechanism, multiple conditions. Multiple conditions provide ways to be more specific in the way we perform conditional deployments and enable us to have more control on the conditions we match on.

Read More »

Arinco trades as Arinco (VIC) Pty Ltd
and Arinco (NSW) Pty Ltd

All Rights Reserved

 

Level 9, 360 Collins Street, 
Melbourne VIC 3000

Level 2, 24 Campbell St,
Sydney NSW 2000

Get started on the right path to cloud success today. Our Crew are standing by to answer your questions and get you up and running.