title: Generating a magic login link with Azure B2C as the authority
body: <p>I'm looking for a method to log in a user using a link sent by mail. The <a href="https://github.com/azure-ad-b2c/samples/tree/master/policies/sign-in-with-magic-link" rel="nofollow noreferrer">Sign-in with a magic link sample policy</a> comes very close to what I want to achieve.</p>
  
  <p>My main issue with this sample is that it requires the web app to set up a certificate and host an OIDC endpoint. So the web app becomes the source of trust. What even is the point of B2C if it's not generating or validating the tokens? It seems like I'm adding an extra attack surface on our application. One of the reasons we use B2C is so we don't have to deal with the dangers of authenication. Or am I seeing this wrong?</p>
  
  <p>Another option I was looking at is the <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow" rel="nofollow noreferrer">OAuth 2.0 On-Behalf-Of flow</a>. That does use B2C as the source of trust but is not intended to create user tokens. It's for authenticating one app with the parent app. Would it be a bad idea to try to use such an OBO access token to authenticate a user instead?</p>