Welcome to the Magic World

Welcome

Technical Details

  1. Magic Link - (link with the magic) - like the name is a URL - a link to the action (Internet page).

  2. To make the public communication secured - a common implementation is JWT (Json Web Token) with JWKS (Json Web Key Sets). The payload is JSON - easy to interpret.

  3. This is a JWT so Token, so interoperable claims: iss (issuer), exp (expiration time) etc … RFC7519

Token

In our magical world, building the Magic Link is as easy as waving a wand! We need to define the data structure for the JWT token, one case ID Token Hint will require fields like issuer or subject to authenticate user (based on the email ownership - access to the users mailbox equals that this is the user) - in the other case inside token we can push all expected business data to meet the requirements (please remeber, more data bigger token, longer URL (you can use URL shortening service for that).

Summary

Let’s Practice

Mobile App Are you interested in how it works? Check out my Factorlabs Bank application with the yellow flow. I created the Azure AD B2C authentication inside the mobile application.

Steps:

  • Click the button ‘Sign Up’ with dedicated onboarding flow.
  • Click the button ‘Sign In’. The magic link will be created (in the background) and will be populated to the web browser to authenticate user with Azure AD B2C Identity Provider
  • Click ‘Check status’ to make the request to the server (protected by Azure AD B2C)

Side note: Magic link based on the Verifiable Credentials stored inside Mobile Application (Internal Wallet).

Link to Store to download Android Application or search for Factorlabs Bank by name.

Summary

The Magic Link is a simple and secure way to authenticate users. But also can be used in various scenarios like promotion/discount codes, or to share the data between systems. The JWT token is a perfect solution for that.

THXp