Abstract image of a woman sitting on books and studying on a laptop

Programming with Azure Active Directory

Joonas Westlin, profile picture
Joonas Westlin

The document provides a comprehensive overview of Azure Active Directory (Azure AD), covering its functionalities such as app registration, authentication flows, and managing permissions. It highlights the differences between single-tenant and multi-tenant applications, detailed authentication scenarios, and the use of tokens in application interactions with secured APIs. Additionally, it introduces the new Azure AD v2 endpoint and its features, along with valuable resources for further learning and troubleshooting.

Software
1 of 34
Downloaded 10 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
PROGRAMMING WITH AZURE AD JOONAS WESTLIN
STANDARD SPEAKER INTRO • Joonas Westlin • Azure Developer at Kompozure • Azure MVP, MCSD, MCSE • Active on Stack Overflow o Currently #4 All-time for Azure AD @JoonasWestlin joonasw.net
STANDARD AGENDA SLIDE • Intro to Azure Active Directory o How we can manage a directory • Registering apps o Important settings • Authentication flows o Different ways to authenticate users and get tokens to call secured APIs • Demo, back-end Web app calling MS Graph API
AZURE ACTIVE DIRECTORY • “Azure Active Directory (Azure AD) is a cloud identity service that allows developers to securely sign in users with a Microsoft work or school account.” • The login system underneath Office 365 and Azure • Global, multi-tenant, identity and access management service • Single Sign-On for cloud services • If you have ever signed in to O365 or Azure, you have used Azure AD • Quite different from on-premises Windows Server AD https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-developers-guide
MANAGING AAD • Can use portal.azure.com • Find Azure Active Directory from the left or from under All services • Pro-tip: Use https://aad.portal.azure.com • PowerShell: https://docs.microsoft.com/en- us/powershell/azure/active- directory/install-adv2?view=azureadps- 2.0 • AAD Graph Explorer: https://graphexplorer.azurewebsites.net/
AZURE AD “TENANTS” • Tenant = One Azure AD “instance” • Container for users, their passwords, groups etc. • An organization typically has one tenant • You already have one if you use Azure or Office 365 • You can create more tenants from the Azure Portal https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-howto-tenant
REGISTERING APPS • Registering an app you are developing can be done from App registrations • Name: display name for the app • Sign-on URL: the URL given to users in https://myapps.microsoft.com • Name and Sign-on URL can be changed later • Application type: next slide https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-integrating-applications
APPLICATION TYPES • The Portal options are a bit confusing • Web app / API = App which can keep a secret o Runs on device you control o APIs, back-end Web apps, Azure Web Jobs • Native = App which cannot keep a secret o Runs on user’s device o SPA, Mobile, any app installed on user’s device • Correspond to publicClient property on Application o Public client = Native https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory- authentication-scenarios#application-types-and-scenarios
APPLICATIONS & SERVICE PRINCIPALS • An Application object is created when you register an app • It then gets an identity in the directory in the form of a Service Principal • Multi-tenant apps get a Service Principal in every directory they are integrated in o Application stays in original tenant • Enterprise Applications = Service Principals in portal https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-application-objects
SINGLE-TENANT VS MULTI-TENANT • Set in application’s Properties • A single-tenant app can only be used by one organization o Line-of-business apps • A multi-tenant app can be used by any organization o SaaS apps Overview for MT: https://docs.microsoft.com/en-us/azure/active-directory/develop/active- directory-devhowto-multi-tenant-overview MT sample: https://azure.microsoft.com/en-us/resources/samples/active-directory-dotnet- webapp-multitenant-openidconnect/
REPLY URLS • Set of URLs to which Azure AD can redirect the user back to after logging in • The redirect can contain user’s personal info in a token, reason why this exists
APPLICATION KEYS • Non-Native apps can have keys • Either client secrets or public keys from key pairs • Used by the app to authenticate itself • NEVER PUT CLIENT SECRETS IN CODE THAT RUNS ON USER DEVICE
PERMISSIONS & GRANTING THEM • An Application can require permission on APIs • Two types o Application: Org-wide access for the app o Delegated: Access as a single user • Required permissions must also be granted o User can consent when logging in o Grant Permissions grants for whole org o One of the biggest causes for problems people have is permissions are not granted https://joonasw.net/view/the-grant-requires-admin-permission
THE APP MANIFEST • Found via the Manifest button • JSON representation of the Application object • Can edit in Portal • Advanced scenarios o Scopes for APIs and roles for users in apps https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-application- manifest https://joonasw.net/view/defining-permissions-and- roles-in-aad
AUTHENTICATION FLOWS • An app usually needs to do one or both of: o Authenticate user o Call Azure AD protected API(s) • Various flows exist for this purpose for different scenarios and application types • The examples I give here apply to OpenID Connect and OAuth o Protocols commonly used by modern apps • Libraries are available for major platforms that help with implementation o ADAL (.NET, Java, JavaScript, iOS, macOS, Android, Node.JS, Python) • Azure AD supports WS-Federation and SAML too https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-authentication-scenarios
TOKENS • Tokens in OIDC and OAuth are JSON Web Tokens (JWTs) • Id token contains info about a user o Can be gotten after user signs in • Access token is used by an app to call a protected API o Can contain user info if acquired with user context • When getting access token, the resource parameter specifies which API you want to use o MS Graph API: https://graph.microsoft.com o Your APIs: Properties -> App ID URI https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and- claims
INSPECTING TOKENS • JSON Web Tokens are base 64-encoded (use e.g. https://jwt.ms) • Contain a set of claims { "aud": "https://graph.microsoft.com", "iss": "https://sts.windows.net/c5e5d73b-e74c-48b3-a1ad-b0af0cf7f751/", "iat": 1519065056, "nbf": 1519065056, "exp": 1519068956, "acr": "1", "aio": "Y2NgYGC+ti31U9grU6mW", "amr": [ "pwd" ], "app_displayname": "AspNetCoreAadDemo", "appid": "6f934905-6567-44c4-a599-b780a555a98f", "appidacr": "1", "e_exp": 262800, "family_name": "Westlin", "given_name": "Joonas", "ipaddr": "XXX.XXX.XXX.XXX", "name": "Joonas Westlin", "oid": "73c38a25-23eb-44eb-bf63-4aa987b2ef19", "platf": "3", "puid": "1003000098", "scp": "User.Read", "sub": "xLaF0g0DPYcmtpPN1bt9xQ7NdBjNuF", "tid": "c5e5d73b-e74c-48b3-a1ad-b0af0cf7f751", "unique_name": "joonas@joonasw.net", "upn": "joonas@joonasw.net", "uti": "w6-48cSPn0imual9sNkxAA", "ver": "1.0" } { "aud": "6f934905-6567-44c4-a599-b780a555a98f", "iss": "https://sts.windows.net/c5e5d73b-e74c-48b3-a1ad-b0af0cf7f751/", "iat": 1519065056, "nbf": 1519065056, "exp": 1519068956, "aio": "Y2NgYHjk9XOd1TGlgF1ZlZsVGc", "amr": [ "pwd" ], "family_name": "Westlin", "given_name": "Joonas", "ipaddr": "XXX.XXX.XXX.XXX", "name": "Joonas Westlin", "nonce": "636546621256195592.OWV", "oid": "73c38a25-23eb-44eb-bf63-4aa987b2ef19", "sub": "mHgciVvkOrE6YD-LgHul4oGZuWV5owJ4", "tid": "c5e5d73b-e74c-48b3-a1ad-b0af0cf7f751", "unique_name": "joonas@joonasw.net", "upn": "joonas@joonasw.net", "uti": "w6-48cSPn0imual9sNkxAA", "ver": "1.0" }
AUTHORIZATION CODE FLOW • Used mainly by back-end Web apps • App redirects user to Azure AD login page • After user logs in, your app gets back an authorization code • The app back-end can exchange the code + its client id and secret for an Id token, access token, and a refresh token o Refresh token used to get new access tokens • So it requires a little OpenID Connect dance ☺ • App will use delegated permissions in this case https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-openid- connect-code
AUTHORIZATION CODE FLOW PT.1 https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-openid- connect-code User + browser App back-end /oauth2/authorize Clicks Sign In 302 redirect Client id + reply URL Navigate Client id + reply URL Login Form POST to reply URL Authorization code
AUTHORIZATION CODE FLOW PT.2 https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-openid- connect-code User + browser App back-end /oauth2/token Establish session Session cookie HTTP POST Authorization code, client id, client secret, resource Access token, refresh token, id token
IMPLICIT GRANT https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-authentication- scenarios#single-page-application-spa
CLIENT CREDENTIALS https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth- service-to-service App /oauth2/token HTTP POST Client id, client secret, resource Access token
CLIENT CREDENTIALS • Authentication for scripts, Azure Web Jobs etc. • App sends client id and client secret to token endpoint • Receives access token • Application Permissions used https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth- service-to-service
OTHERS • Implicit o Single Page Apps: https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-authentication-scenarios#single-page- application-spa • Device code o For text-only clients: https://joonasw.net/view/device-code-flow • On-behalf-of o Calling an API from another API as the user: https://joonasw.net/view/azure-ad-on-behalf-of-aspnet-core • Resource Owner Password Credentials Grant o Don’t. https://www.scottbrady91.com/OAuth/Why-the-Resource-Owner- Password-Credentials-Grant-Type-is-not-Authentication-nor-Suitable-for- Modern-Applications o There are use cases for it, but you should avoid it if possible
DEMO TIME https://westl.in/aaddemo https://westl.in/aadrepo
AZURE AD V2? • New ”converged” endpoint for authentication • Some new capabilities • Azure AD or personal MS accounts can be used • MS Graph API allows calling with either for some endpoints (e.g. Mail and Calendar) https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-appmodel-v2- overview
V2: MAIN DIFFERENCES FROM V1 • New portal! https://apps.dev.microsoft.com/ o Login with MSA -> Apps created *somewhere* o Login with AAD -> Apps created in user home tenant • Personal MS accounts allowed • Native + Web App + Web API under same application identity • All apps are multi-tenant https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-compare
V2: SCOPES • In v1, you would ask for a token with: o resource=https://graph.microsoft.com o Requires you to specify which permissions you need ahead of time o User has to accept all of them • Now you can ask for a token with: o scope=https://graph.microsoft.com/User.Read o This is actually standards-compliant now
V2: INCREMENTAL CONSENT • Your app can, at any time ask for another scope • Don’t have to mention needed scopes at all when defining app • Users can opt-in to features of the app • No need to ask for consent for everything https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2- compare#incremental-and-dynamic-consent
V2: MSAL • With v1, you would use Azure AD Authentication Library (ADAL) • Microsoft Authentication Library replaces ADAL in v2 • API is a bit different • .NET, JS, and Android versions are in ”production-ready preview” https://github.com/AzureAD/microsoft-authentication-library-for-dotnet
SUMMARY • Azure AD and identity in general are hard topics • My suggestion: Practice, practice, and digging through examples • Loads of sample apps on GitHub • The apps that Visual Studio generates are pretty good samples too • If you have trouble, ask on Stack Overflow ;)
SOME THINGS NOT COVERED • Azure AD B2C: https://docs.microsoft.com/en-us/azure/active-directory- b2c/ • New v2 endpoint: https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-appmodel-v2-overview • IT Pro topics o Multi-Factor Authentication: https://docs.microsoft.com/en- us/azure/multi-factor-authentication/multi-factor-authentication o On-prem sync with AAD Connect: https://docs.microsoft.com/en- us/azure/active-directory/connect/active-directory-aadconnect • Pricing: https://azure.microsoft.com/en-us/pricing/details/active-directory/ o Spoiler: basic stuff can be done for free
LINKS • Documentation: https://docs.microsoft.com/en-us/azure/active- directory/active-directory-whatis • Developer guide: https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-developers-guide • Samples: https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-code-samples • MS Graph API: https://developer.microsoft.com/en- us/graph/docs/concepts/overview • My posts on AAD: https://joonasw.net/tag/azure-ad
@JoonasWestlin joonasw.net

More Related Content

PPTX
Zero Credential Development with Managed Identities for Azure resources
Joonas Westlin
 
PDF
Identity Security - Azure Active Directory
Eng Teong Cheah
 
PPTX
Zero Credential Development with Managed Identities
Joonas Westlin
 
PPTX
Zero credential development with managed identities
Joonas Westlin
 
PDF
Azure Active Directory
Sovelto
 
PPTX
Azure Active Directory - An Introduction
Venkatesh Narayanan
 
PDF
Develop enterprise-ready applications for Microsoft Teams
Markus Moeller
 
PPTX
Windows Azure Active Directory
Pavel Revenkov
 
Zero Credential Development with Managed Identities for Azure resources
Joonas Westlin
 
Identity Security - Azure Active Directory
Eng Teong Cheah
 
Zero Credential Development with Managed Identities
Joonas Westlin
 
Zero credential development with managed identities
Joonas Westlin
 
Azure Active Directory
Sovelto
 
Azure Active Directory - An Introduction
Venkatesh Narayanan
 
Develop enterprise-ready applications for Microsoft Teams
Markus Moeller
 
Windows Azure Active Directory
Pavel Revenkov
 

What's hot (20)

PDF
O365Con18 - Azure Active Directory - Sasha Kranjac & Mustafa Toroman
NCCOMMS
 
PDF
O365Con18 - Red Team vs Blue Team - Sasha Kranjac & Mustafa Toroman
NCCOMMS
 
PPTX
Introduction to Azure AD and Azure AD B2C
Joonas Westlin
 
PPTX
Windows Azure Active Directory
Krunal Trivedi
 
PPTX
Building a document e-signing workflow with Azure Durable Functions
Joonas Westlin
 
PDF
Access Security - Privileged Identity Management
Eng Teong Cheah
 
PPTX
Azure Key Vault with a PaaS Architecture and ARM Template Deployment
Roy Kim
 
PDF
04_Extending and Securing Enterprise Applications in Microsoft Azure_GAB2019
Kumton Suttiraksiri
 
PPTX
Durable Azure Functions
Pushkar Saraf
 
PPTX
Certifications for Azure Developers
Krunal Trivedi
 
PPTX
Microsoft Azure ad in 10 slides
Andre Debilloez
 
PPTX
Azure Active Directory
Thurupathan Vijayakumar
 
PPTX
Azure active directory
Raju Kumar
 
PPTX
Windows azure active directory
Krunal Trivedi
 
PPTX
Azure signalr service
Udaiappa Ramachandran
 
PDF
Active Directory & LDAP | Security for Elasticsearch
Jochen Kressin
 
PPTX
Azure Key Vault - Getting Started
Taswar Bhatti
 
PPTX
Global Azure Bootcamp 2017 - Azure Key Vault
Alberto Diaz Martin
 
PDF
Azure DevOps
Surasuk Oakkharaamonphong
 
PPTX
Azure Active Directory - An Introduction for Developers
John Garland
 
O365Con18 - Azure Active Directory - Sasha Kranjac & Mustafa Toroman
NCCOMMS
 
O365Con18 - Red Team vs Blue Team - Sasha Kranjac & Mustafa Toroman
NCCOMMS
 
Introduction to Azure AD and Azure AD B2C
Joonas Westlin
 
Windows Azure Active Directory
Krunal Trivedi
 
Building a document e-signing workflow with Azure Durable Functions
Joonas Westlin
 
Access Security - Privileged Identity Management
Eng Teong Cheah
 
Azure Key Vault with a PaaS Architecture and ARM Template Deployment
Roy Kim
 
04_Extending and Securing Enterprise Applications in Microsoft Azure_GAB2019
Kumton Suttiraksiri
 
Durable Azure Functions
Pushkar Saraf
 
Certifications for Azure Developers
Krunal Trivedi
 
Microsoft Azure ad in 10 slides
Andre Debilloez
 
Azure Active Directory
Thurupathan Vijayakumar
 
Azure active directory
Raju Kumar
 
Windows azure active directory
Krunal Trivedi
 
Azure signalr service
Udaiappa Ramachandran
 
Active Directory & LDAP | Security for Elasticsearch
Jochen Kressin
 
Azure Key Vault - Getting Started
Taswar Bhatti
 
Global Azure Bootcamp 2017 - Azure Key Vault
Alberto Diaz Martin
 
Azure DevOps
Surasuk Oakkharaamonphong
 
Azure Active Directory - An Introduction for Developers
John Garland
 
Ad

Similar to Programming with Azure Active Directory (20)

PDF
Modern Authentication With Azure Active Directory For Web Applications Develo...
ikhinesagang32
 
PPTX
Azure AD for browser-based application developers
Bob German
 
PPTX
Programming Azure Active Directory (DevLink 2014)
Michael Collier
 
PPTX
Azure from scratch part 2 By Girish Kalamati
Girish Kalamati
 
PPTX
Developing Apps with Azure AD
SharePointRadi
 
PPTX
Securing a modern Web application with Entra ID
Joonas Westlin
 
PPTX
7 Deadly Sins in Azure AD App Development
Joonas Westlin
 
PDF
24032022 Zero Trust for Developers Pub.pdf
Tomasz Kopacz
 
PPTX
Implement Authorization in your Apps with Microsoft identity platform-June 2020
Microsoft 365 Developer
 
PPTX
Microsoft Azure Identity and O365
Kris Wagner
 
PPTX
DotNet 2019 | Hugo Biarge - Autenticación en aplicaciones web y nativas
Plain Concepts
 
PPTX
Microsoft identity manoj mittal
Manoj Mittal
 
PPTX
Identity and o365 on Azure
Mostafa
 
PDF
BlueHat Seattle 2019 || I'm in your cloud: A year of hacking Azure AD
BlueHat Security Conference
 
PPTX
Windows Azure Active Directory: Identity Management in the Cloud
Chris Dufour
 
PPTX
Microsoft Graph API Webinar Application Permissions
Stefan Weber
 
PDF
Microsoft Azure Active Directory- The Complete Guide.pdf
Multisoft Systems
 
PDF
Application Security- App security
Eng Teong Cheah
 
PDF
Using Windows Azure for Solving Identity Management Challenges (Visual Studio...
Michael Collier
 
PPTX
Microsoft Graph API Delegated Permissions
Stefan Weber
 
Modern Authentication With Azure Active Directory For Web Applications Develo...
ikhinesagang32
 
Azure AD for browser-based application developers
Bob German
 
Programming Azure Active Directory (DevLink 2014)
Michael Collier
 
Azure from scratch part 2 By Girish Kalamati
Girish Kalamati
 
Developing Apps with Azure AD
SharePointRadi
 
Securing a modern Web application with Entra ID
Joonas Westlin
 
7 Deadly Sins in Azure AD App Development
Joonas Westlin
 
24032022 Zero Trust for Developers Pub.pdf
Tomasz Kopacz
 
Implement Authorization in your Apps with Microsoft identity platform-June 2020
Microsoft 365 Developer
 
Microsoft Azure Identity and O365
Kris Wagner
 
DotNet 2019 | Hugo Biarge - Autenticación en aplicaciones web y nativas
Plain Concepts
 
Microsoft identity manoj mittal
Manoj Mittal
 
Identity and o365 on Azure
Mostafa
 
BlueHat Seattle 2019 || I'm in your cloud: A year of hacking Azure AD
BlueHat Security Conference
 
Windows Azure Active Directory: Identity Management in the Cloud
Chris Dufour
 
Microsoft Graph API Webinar Application Permissions
Stefan Weber
 
Microsoft Azure Active Directory- The Complete Guide.pdf
Multisoft Systems
 
Application Security- App security
Eng Teong Cheah
 
Using Windows Azure for Solving Identity Management Challenges (Visual Studio...
Michael Collier
 
Microsoft Graph API Delegated Permissions
Stefan Weber
 
Ad

More from Joonas Westlin (8)

PPTX
Building a document signing workflow with Durable Functions
Joonas Westlin
 
PPTX
Using feature flags in an ASP.NET Core app on Azure
Joonas Westlin
 
PPTX
Deep Dive into Durable Functions
Joonas Westlin
 
PPTX
Deep Dive into Durable Functions
Joonas Westlin
 
PPTX
Zero Credential Development with Managed Identities
Joonas Westlin
 
PPTX
Zero Credential Development with Managed Identities
Joonas Westlin
 
PPTX
Zero credential development with managed identities
Joonas Westlin
 
PPTX
Get rid of credentials from your code: Using Managed identities for Azure res...
Joonas Westlin
 
Building a document signing workflow with Durable Functions
Joonas Westlin
 
Using feature flags in an ASP.NET Core app on Azure
Joonas Westlin
 
Deep Dive into Durable Functions
Joonas Westlin
 
Deep Dive into Durable Functions
Joonas Westlin
 
Zero Credential Development with Managed Identities
Joonas Westlin
 
Zero Credential Development with Managed Identities
Joonas Westlin
 
Zero credential development with managed identities
Joonas Westlin
 
Get rid of credentials from your code: Using Managed identities for Azure res...
Joonas Westlin
 

Recently uploaded (20)

PDF
AI Guide for Business Growth - Arna Softech
Arna Softech
 
PDF
CapCut PRO for PC Crack New Download (Fully Activated 2025)
imang66g
 
PPTX
string python Python Strings: Literals, Slicing, Methods, Formatting, and Pra...
Vijayakumari829030
 
PPTX
ROI Analysis for Newspaper Industry with Odoo ERP
SatishKumar2651
 
PPTX
Plex Media Server 1.28.2.6151 With Crac5 2022 Free .
cariaelif911
 
PDF
Website Design & Development_ Professional Web Design Services.pdf
narayanaduggempudi88
 
PPTX
Full-Stack Developer Courses That Actually Land You Jobs
Ask the C Expert
 
PPTX
Airline CRS | Airline CRS Systems | CRS System
yugababu033
 
PDF
Workplace Software and Skills - OpenStax
tranviettoan19672001
 
PPTX
Download Adobe Photoshop Crack 2025 Free
kokilasc86
 
PPTX
R-Studio Crack Free Download 2025 Latest
elifk7615
 
PPTX
Chapter 1 - Transaction Processing and Mgt.pptx
LeulPrince
 
PDF
Sun and Bloombase Spitfire StoreSafe End-to-end Storage Security Solution
Bloombase
 
DOC
UTEP毕业证学历认证,宾夕法尼亚克拉里恩大学毕业证未毕业
oqwcyqe
 
PPTX
Lecture 5 Software Requirement Engineering
Huda Nasir
 
PDF
Microsoft Office 365 Crack Download Free
wasibhadar
 
PDF
CCleaner 6.39.11548 Crack 2025 License Key
viktamscs
 
PPTX
Python is a high-level, interpreted programming language
kesavansa2002
 
PDF
E-Commerce Website Development Companyin india
Digital India
 
PPTX
4Seller: The All-in-One Multi-Channel E-Commerce Management Platform for Glob...
4Seller Multi-channel Ecommerce Tool
 
AI Guide for Business Growth - Arna Softech
Arna Softech
 
CapCut PRO for PC Crack New Download (Fully Activated 2025)
imang66g
 
string python Python Strings: Literals, Slicing, Methods, Formatting, and Pra...
Vijayakumari829030
 
ROI Analysis for Newspaper Industry with Odoo ERP
SatishKumar2651
 
Plex Media Server 1.28.2.6151 With Crac5 2022 Free .
cariaelif911
 
Website Design & Development_ Professional Web Design Services.pdf
narayanaduggempudi88
 
Full-Stack Developer Courses That Actually Land You Jobs
Ask the C Expert
 
Airline CRS | Airline CRS Systems | CRS System
yugababu033
 
Workplace Software and Skills - OpenStax
tranviettoan19672001
 
Download Adobe Photoshop Crack 2025 Free
kokilasc86
 
R-Studio Crack Free Download 2025 Latest
elifk7615
 
Chapter 1 - Transaction Processing and Mgt.pptx
LeulPrince
 
Sun and Bloombase Spitfire StoreSafe End-to-end Storage Security Solution
Bloombase
 
UTEP毕业证学历认证,宾夕法尼亚克拉里恩大学毕业证未毕业
oqwcyqe
 
Lecture 5 Software Requirement Engineering
Huda Nasir
 
Microsoft Office 365 Crack Download Free
wasibhadar
 
CCleaner 6.39.11548 Crack 2025 License Key
viktamscs
 
Python is a high-level, interpreted programming language
kesavansa2002
 
E-Commerce Website Development Companyin india
Digital India
 
4Seller: The All-in-One Multi-Channel E-Commerce Management Platform for Glob...
4Seller Multi-channel Ecommerce Tool
 

Programming with Azure Active Directory

  • 1. PROGRAMMING WITH AZURE AD JOONAS WESTLIN
  • 2. STANDARD SPEAKER INTRO • Joonas Westlin • Azure Developer at Kompozure • Azure MVP, MCSD, MCSE • Active on Stack Overflow o Currently #4 All-time for Azure AD @JoonasWestlin joonasw.net
  • 3. STANDARD AGENDA SLIDE • Intro to Azure Active Directory o How we can manage a directory • Registering apps o Important settings • Authentication flows o Different ways to authenticate users and get tokens to call secured APIs • Demo, back-end Web app calling MS Graph API
  • 4. AZURE ACTIVE DIRECTORY • “Azure Active Directory (Azure AD) is a cloud identity service that allows developers to securely sign in users with a Microsoft work or school account.” • The login system underneath Office 365 and Azure • Global, multi-tenant, identity and access management service • Single Sign-On for cloud services • If you have ever signed in to O365 or Azure, you have used Azure AD • Quite different from on-premises Windows Server AD https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-developers-guide
  • 5. MANAGING AAD • Can use portal.azure.com • Find Azure Active Directory from the left or from under All services • Pro-tip: Use https://aad.portal.azure.com • PowerShell: https://docs.microsoft.com/en- us/powershell/azure/active- directory/install-adv2?view=azureadps- 2.0 • AAD Graph Explorer: https://graphexplorer.azurewebsites.net/
  • 6. AZURE AD “TENANTS” • Tenant = One Azure AD “instance” • Container for users, their passwords, groups etc. • An organization typically has one tenant • You already have one if you use Azure or Office 365 • You can create more tenants from the Azure Portal https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-howto-tenant
  • 7. REGISTERING APPS • Registering an app you are developing can be done from App registrations • Name: display name for the app • Sign-on URL: the URL given to users in https://myapps.microsoft.com • Name and Sign-on URL can be changed later • Application type: next slide https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-integrating-applications
  • 8. APPLICATION TYPES • The Portal options are a bit confusing • Web app / API = App which can keep a secret o Runs on device you control o APIs, back-end Web apps, Azure Web Jobs • Native = App which cannot keep a secret o Runs on user’s device o SPA, Mobile, any app installed on user’s device • Correspond to publicClient property on Application o Public client = Native https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory- authentication-scenarios#application-types-and-scenarios
  • 9. APPLICATIONS & SERVICE PRINCIPALS • An Application object is created when you register an app • It then gets an identity in the directory in the form of a Service Principal • Multi-tenant apps get a Service Principal in every directory they are integrated in o Application stays in original tenant • Enterprise Applications = Service Principals in portal https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-application-objects
  • 10. SINGLE-TENANT VS MULTI-TENANT • Set in application’s Properties • A single-tenant app can only be used by one organization o Line-of-business apps • A multi-tenant app can be used by any organization o SaaS apps Overview for MT: https://docs.microsoft.com/en-us/azure/active-directory/develop/active- directory-devhowto-multi-tenant-overview MT sample: https://azure.microsoft.com/en-us/resources/samples/active-directory-dotnet- webapp-multitenant-openidconnect/
  • 11. REPLY URLS • Set of URLs to which Azure AD can redirect the user back to after logging in • The redirect can contain user’s personal info in a token, reason why this exists
  • 12. APPLICATION KEYS • Non-Native apps can have keys • Either client secrets or public keys from key pairs • Used by the app to authenticate itself • NEVER PUT CLIENT SECRETS IN CODE THAT RUNS ON USER DEVICE
  • 13. PERMISSIONS & GRANTING THEM • An Application can require permission on APIs • Two types o Application: Org-wide access for the app o Delegated: Access as a single user • Required permissions must also be granted o User can consent when logging in o Grant Permissions grants for whole org o One of the biggest causes for problems people have is permissions are not granted https://joonasw.net/view/the-grant-requires-admin-permission
  • 14. THE APP MANIFEST • Found via the Manifest button • JSON representation of the Application object • Can edit in Portal • Advanced scenarios o Scopes for APIs and roles for users in apps https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-application- manifest https://joonasw.net/view/defining-permissions-and- roles-in-aad
  • 15. AUTHENTICATION FLOWS • An app usually needs to do one or both of: o Authenticate user o Call Azure AD protected API(s) • Various flows exist for this purpose for different scenarios and application types • The examples I give here apply to OpenID Connect and OAuth o Protocols commonly used by modern apps • Libraries are available for major platforms that help with implementation o ADAL (.NET, Java, JavaScript, iOS, macOS, Android, Node.JS, Python) • Azure AD supports WS-Federation and SAML too https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-authentication-scenarios
  • 16. TOKENS • Tokens in OIDC and OAuth are JSON Web Tokens (JWTs) • Id token contains info about a user o Can be gotten after user signs in • Access token is used by an app to call a protected API o Can contain user info if acquired with user context • When getting access token, the resource parameter specifies which API you want to use o MS Graph API: https://graph.microsoft.com o Your APIs: Properties -> App ID URI https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and- claims
  • 17. INSPECTING TOKENS • JSON Web Tokens are base 64-encoded (use e.g. https://jwt.ms) • Contain a set of claims { "aud": "https://graph.microsoft.com", "iss": "https://sts.windows.net/c5e5d73b-e74c-48b3-a1ad-b0af0cf7f751/", "iat": 1519065056, "nbf": 1519065056, "exp": 1519068956, "acr": "1", "aio": "Y2NgYGC+ti31U9grU6mW", "amr": [ "pwd" ], "app_displayname": "AspNetCoreAadDemo", "appid": "6f934905-6567-44c4-a599-b780a555a98f", "appidacr": "1", "e_exp": 262800, "family_name": "Westlin", "given_name": "Joonas", "ipaddr": "XXX.XXX.XXX.XXX", "name": "Joonas Westlin", "oid": "73c38a25-23eb-44eb-bf63-4aa987b2ef19", "platf": "3", "puid": "1003000098", "scp": "User.Read", "sub": "xLaF0g0DPYcmtpPN1bt9xQ7NdBjNuF", "tid": "c5e5d73b-e74c-48b3-a1ad-b0af0cf7f751", "unique_name": "[email protected]", "upn": "[email protected]", "uti": "w6-48cSPn0imual9sNkxAA", "ver": "1.0" } { "aud": "6f934905-6567-44c4-a599-b780a555a98f", "iss": "https://sts.windows.net/c5e5d73b-e74c-48b3-a1ad-b0af0cf7f751/", "iat": 1519065056, "nbf": 1519065056, "exp": 1519068956, "aio": "Y2NgYHjk9XOd1TGlgF1ZlZsVGc", "amr": [ "pwd" ], "family_name": "Westlin", "given_name": "Joonas", "ipaddr": "XXX.XXX.XXX.XXX", "name": "Joonas Westlin", "nonce": "636546621256195592.OWV", "oid": "73c38a25-23eb-44eb-bf63-4aa987b2ef19", "sub": "mHgciVvkOrE6YD-LgHul4oGZuWV5owJ4", "tid": "c5e5d73b-e74c-48b3-a1ad-b0af0cf7f751", "unique_name": "[email protected]", "upn": "[email protected]", "uti": "w6-48cSPn0imual9sNkxAA", "ver": "1.0" }
  • 18. AUTHORIZATION CODE FLOW • Used mainly by back-end Web apps • App redirects user to Azure AD login page • After user logs in, your app gets back an authorization code • The app back-end can exchange the code + its client id and secret for an Id token, access token, and a refresh token o Refresh token used to get new access tokens • So it requires a little OpenID Connect dance ☺ • App will use delegated permissions in this case https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-openid- connect-code
  • 19. AUTHORIZATION CODE FLOW PT.1 https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-openid- connect-code User + browser App back-end /oauth2/authorize Clicks Sign In 302 redirect Client id + reply URL Navigate Client id + reply URL Login Form POST to reply URL Authorization code
  • 20. AUTHORIZATION CODE FLOW PT.2 https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-openid- connect-code User + browser App back-end /oauth2/token Establish session Session cookie HTTP POST Authorization code, client id, client secret, resource Access token, refresh token, id token
  • 23. CLIENT CREDENTIALS • Authentication for scripts, Azure Web Jobs etc. • App sends client id and client secret to token endpoint • Receives access token • Application Permissions used https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth- service-to-service
  • 24. OTHERS • Implicit o Single Page Apps: https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-authentication-scenarios#single-page- application-spa • Device code o For text-only clients: https://joonasw.net/view/device-code-flow • On-behalf-of o Calling an API from another API as the user: https://joonasw.net/view/azure-ad-on-behalf-of-aspnet-core • Resource Owner Password Credentials Grant o Don’t. https://www.scottbrady91.com/OAuth/Why-the-Resource-Owner- Password-Credentials-Grant-Type-is-not-Authentication-nor-Suitable-for- Modern-Applications o There are use cases for it, but you should avoid it if possible
  • 26. AZURE AD V2? • New ”converged” endpoint for authentication • Some new capabilities • Azure AD or personal MS accounts can be used • MS Graph API allows calling with either for some endpoints (e.g. Mail and Calendar) https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-appmodel-v2- overview
  • 27. V2: MAIN DIFFERENCES FROM V1 • New portal! https://apps.dev.microsoft.com/ o Login with MSA -> Apps created *somewhere* o Login with AAD -> Apps created in user home tenant • Personal MS accounts allowed • Native + Web App + Web API under same application identity • All apps are multi-tenant https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-compare
  • 28. V2: SCOPES • In v1, you would ask for a token with: o resource=https://graph.microsoft.com o Requires you to specify which permissions you need ahead of time o User has to accept all of them • Now you can ask for a token with: o scope=https://graph.microsoft.com/User.Read o This is actually standards-compliant now
  • 29. V2: INCREMENTAL CONSENT • Your app can, at any time ask for another scope • Don’t have to mention needed scopes at all when defining app • Users can opt-in to features of the app • No need to ask for consent for everything https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2- compare#incremental-and-dynamic-consent
  • 30. V2: MSAL • With v1, you would use Azure AD Authentication Library (ADAL) • Microsoft Authentication Library replaces ADAL in v2 • API is a bit different • .NET, JS, and Android versions are in ”production-ready preview” https://github.com/AzureAD/microsoft-authentication-library-for-dotnet
  • 31. SUMMARY • Azure AD and identity in general are hard topics • My suggestion: Practice, practice, and digging through examples • Loads of sample apps on GitHub • The apps that Visual Studio generates are pretty good samples too • If you have trouble, ask on Stack Overflow ;)
  • 32. SOME THINGS NOT COVERED • Azure AD B2C: https://docs.microsoft.com/en-us/azure/active-directory- b2c/ • New v2 endpoint: https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-appmodel-v2-overview • IT Pro topics o Multi-Factor Authentication: https://docs.microsoft.com/en- us/azure/multi-factor-authentication/multi-factor-authentication o On-prem sync with AAD Connect: https://docs.microsoft.com/en- us/azure/active-directory/connect/active-directory-aadconnect • Pricing: https://azure.microsoft.com/en-us/pricing/details/active-directory/ o Spoiler: basic stuff can be done for free
  • 33. LINKS • Documentation: https://docs.microsoft.com/en-us/azure/active- directory/active-directory-whatis • Developer guide: https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-developers-guide • Samples: https://docs.microsoft.com/en-us/azure/active- directory/develop/active-directory-code-samples • MS Graph API: https://developer.microsoft.com/en- us/graph/docs/concepts/overview • My posts on AAD: https://joonasw.net/tag/azure-ad