# Microsoft Entra ID (Azure AD) -- Federate to a CodeB Sovereign Communications tenant

Documented integration guide. This is not a Microsoft-published gallery app,
not certified by Microsoft -- just an External Identities OIDC federation
that surfaces "European Digital Identity Wallet" sign-in inside your existing
Entra ID tenant.

Full guide + verification steps:
https://<CODEB_TENANT_HOST>/iam-integrations.html#entra

## Prerequisite
- Entra ID tenant with an **External ID** or **B2B** / **B2C** setup
- Entra role: `External Identity Provider Administrator` or higher
- A CodeB OIDC client registered at `/oidc-clients.html` on your CodeB tenant
  with the Entra callback URL allow-listed:
  `https://login.microsoftonline.com/te/<ENTRA_TENANT_ID>/oauth2/authresp`
- The CodeB-issued `client_id` and `client_secret`

## Steps (Entra admin center)

1. Entra admin center -> **External Identities** -> **All identity providers**
   -> **Custom** -> **New OpenID Connect provider**.
2. Fill in:
   - **Name**: `CodeB (EU Digital Identity Wallet)`
   - **Client ID**: `<CLIENT_ID>`
   - **Client secret**: `<CLIENT_SECRET>`
   - **Scope**: `openid profile email`
   - **Response type**: `code`
   - **Response mode**: `query`
   - **Metadata URL**: `https://<CODEB_TENANT_HOST>/.well-known/openid-configuration`
3. Under **Identity provider claims mapping**, map:
   - `User ID`            <-  `sub`
   - `Display name`       <-  `name` (falls back to `preferred_username`)
   - `Given name`         <-  `given_name`
   - `Surname`            <-  `family_name`
   - `Email`              <-  `email`
4. Save.
5. Add the provider to the applicable **User flow** (self-service sign-up)
   or **User flow policy** so end users see it on the sign-in page.

## Verify
- Open the user flow in **incognito** and click the CodeB button.
- CodeB's `/oidc.ashx/authorize` picker renders. Complete any method
  (password, passkey, or EU Digital Identity Wallet).
- Entra creates the guest / external user and issues its own token.

## Notes
- Entra External ID does not currently allow arbitrary custom claims from
  the external OIDC IdP to flow through unmodified. If you need
  `eudi_verified` or `wallet_attestation` inside the Entra-issued token,
  add a **Custom claims provider** (REST call to your app) that reads them
  back from CodeB's `/oidc.ashx/userinfo` at token-issuance time.
- OIDC "back-channel logout" (RP-Initiated Logout) is supported by CodeB
  but the Entra External ID surface does not currently propagate it.
  Rely on Entra session timeout for now.