Skip to content

Commit db48a2d

Browse files
author
Kalyan Krishna
committed
Minor edits after architect review
1 parent 6593bc8 commit db48a2d

File tree

8 files changed

+100
-186
lines changed

8 files changed

+100
-186
lines changed

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/Cleanup.ps1

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -38,15 +38,17 @@ Function Cleanup
3838
Write-Host "Removing 'service' (TodoListService-aspnetcore-webapi) if needed"
3939
try
4040
{
41-
Get-MgApplication -Filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
41+
Get-MgApplication -Filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
4242
}
4343
catch
4444
{
45-
Write-Host "Unable to remove the application 'TodoListService-aspnetcore-webapi' . Try deleting manually." -ForegroundColor White -BackgroundColor Red
45+
$message = $_
46+
Write-Warning $Error[0]
47+
Write-Host "Unable to remove the application 'TodoListService-aspnetcore-webapi'. Error is $message. Try deleting manually." -ForegroundColor White -BackgroundColor Red
4648
}
4749

4850
Write-Host "Making sure there are no more (TodoListService-aspnetcore-webapi) applications found, will remove if needed..."
49-
$apps = Get-MgApplication -Filter "DisplayName eq 'TodoListService-aspnetcore-webapi'"
51+
$apps = Get-MgApplication -Filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | Format-List Id, DisplayName, AppId, SignInAudience, PublisherDomain
5052

5153
if ($apps)
5254
{
@@ -62,24 +64,28 @@ Function Cleanup
6264
# also remove service principals of this app
6365
try
6466
{
65-
Get-MgServicePrincipal -filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | ForEach-Object {Remove-MgServicePrincipal -ApplicationId $_.Id -Confirm:$false}
67+
Get-MgServicePrincipal -filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | ForEach-Object {Remove-MgServicePrincipal -ServicePrincipalId $_.Id -Confirm:$false}
6668
}
6769
catch
6870
{
69-
Write-Host "Unable to remove ServicePrincipal 'TodoListService-aspnetcore-webapi' . Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
71+
$message = $_
72+
Write-Warning $Error[0]
73+
Write-Host "Unable to remove ServicePrincipal 'TodoListService-aspnetcore-webapi'. Error is $message. Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
7074
}
7175
Write-Host "Removing 'client' (TodoListClient-aspnetcore-webapi) if needed"
7276
try
7377
{
74-
Get-MgApplication -Filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
78+
Get-MgApplication -Filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
7579
}
7680
catch
7781
{
78-
Write-Host "Unable to remove the application 'TodoListClient-aspnetcore-webapi' . Try deleting manually." -ForegroundColor White -BackgroundColor Red
82+
$message = $_
83+
Write-Warning $Error[0]
84+
Write-Host "Unable to remove the application 'TodoListClient-aspnetcore-webapi'. Error is $message. Try deleting manually." -ForegroundColor White -BackgroundColor Red
7985
}
8086

8187
Write-Host "Making sure there are no more (TodoListClient-aspnetcore-webapi) applications found, will remove if needed..."
82-
$apps = Get-MgApplication -Filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'"
88+
$apps = Get-MgApplication -Filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | Format-List Id, DisplayName, AppId, SignInAudience, PublisherDomain
8389

8490
if ($apps)
8591
{
@@ -95,11 +101,13 @@ Function Cleanup
95101
# also remove service principals of this app
96102
try
97103
{
98-
Get-MgServicePrincipal -filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | ForEach-Object {Remove-MgServicePrincipal -ApplicationId $_.Id -Confirm:$false}
104+
Get-MgServicePrincipal -filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | ForEach-Object {Remove-MgServicePrincipal -ServicePrincipalId $_.Id -Confirm:$false}
99105
}
100106
catch
101107
{
102-
Write-Host "Unable to remove ServicePrincipal 'TodoListClient-aspnetcore-webapi' . Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
108+
$message = $_
109+
Write-Warning $Error[0]
110+
Write-Host "Unable to remove ServicePrincipal 'TodoListClient-aspnetcore-webapi'. Error is $message. Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
103111
}
104112
# remove self-signed certificate
105113
Write-Host "Removing CN=TodoListClient-aspnetcore-webapi certificate from Cert:/CurrentUser/My"

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/Configure.ps1

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -358,27 +358,37 @@ Function ConfigureApplications
358358

359359
# Add Required Resources Access (from 'client' to 'service')
360360
Write-Host "Getting access from 'client' to 'service'"
361-
$requiredPermissions = GetRequiredPermissions -applicationDisplayName "TodoListService-aspnetcore-webapi" `
361+
$requiredPermission = GetRequiredPermissions -applicationDisplayName "TodoListService-aspnetcore-webapi" `
362362
-requiredDelegatedPermissions "ToDoList.Read|ToDoList.ReadWrite" `
363-
364363

365-
$requiredResourcesAccess.Add($requiredPermissions)
364+
$requiredResourcesAccess.Add($requiredPermission)
366365
Update-MgApplication -ApplicationId $clientAadApplication.Id -RequiredResourceAccess $requiredResourcesAccess
367366
Write-Host "Granted permissions."
367+
368+
Write-Host "Successfully registered and configured that app registration for 'TodoListClient-aspnetcore-webapi' at" -ForegroundColor Green
369+
370+
# print the registered app portal URL for any further navigation
371+
$clientPortalUrl
368372

369373
# Update config file for 'service'
370-
$configFile = $pwd.Path + "\..\TodoListService\appsettings.json"
374+
# $configFile = $pwd.Path + "\..\TodoListService\appsettings.json"
375+
$configFile = $(Resolve-Path ($pwd.Path + "\..\TodoListService\appsettings.json"))
376+
371377
$dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $serviceAadApplication.AppId };
372378

373-
Write-Host "Updating the sample code ($configFile)"
379+
Write-Host "Updating the sample config '$configFile' with the following config values"
380+
$dictionary
374381

375382
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
376383

377384
# Update config file for 'client'
378-
$configFile = $pwd.Path + "\..\Client\appsettings.json"
385+
# $configFile = $pwd.Path + "\..\Client\appsettings.json"
386+
$configFile = $(Resolve-Path ($pwd.Path + "\..\Client\appsettings.json"))
387+
379388
$dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"KeyVaultCertificateName" = $certificateName;"TodoListScopes" = "api://$($serviceAadApplication.AppId)/ToDoList.Read api://$($serviceAadApplication.AppId)/ToDoList.ReadWrite";"TodoListBaseAddress" = $serviceAadApplication.Web.HomePageUrl };
380389

381-
Write-Host "Updating the sample code ($configFile)"
390+
Write-Host "Updating the sample config '$configFile' with the following config values"
391+
$dictionary
382392

383393
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
384394
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
@@ -410,7 +420,16 @@ Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the
410420
$ErrorActionPreference = "Stop"
411421

412422
# Run interactively (will ask you for the tenant ID)
413-
ConfigureApplications -tenantId $tenantId -environment $azureEnvironmentName
414423

424+
try
425+
{
426+
ConfigureApplications -tenantId $tenantId -environment $azureEnvironmentName
427+
}
428+
catch
429+
{
430+
$message = $_
431+
Write-Warning $Error[0]
432+
Write-Host "Unable to register apps. Error is $message." -ForegroundColor White -BackgroundColor Red
433+
}
415434
Write-Host "Disconnecting from tenant"
416435
Disconnect-MgGraph

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/sample.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@
99
"Endpoint": "AAD v2.0",
1010
"Description": "This sample demonstrates an ASP.NET Core client Web App calling an ASP.NET Core Web API that is secured using Azure AD.",
1111
"Languages": [ "csharp" ],
12-
"Products": [ "aspnet-core", "azure-active-directory" ]
12+
"Products": [ "aspnet-core", "azure-active-directory" ],
13+
"Platform": "AspNetCore"
1314
},
1415

1516
/*
@@ -127,7 +128,7 @@
127128
"OptionalClaims": {
128129
"IdTokenClaims": [ "acct" ]
129130
},
130-
"Certificate":"the name will be assigned automatically by PowerShell script and it will be equal to the Application name",
131+
"Certificate": "the name will be assigned automatically by PowerShell script and it will be equal to the Application name",
131132
"ManualSteps": [],
132133
"Sample": {
133134
"SampleSubPath": "4-WebApp-Your-API\\4-1-MyOrg",

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts/Cleanup.ps1

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -38,15 +38,17 @@ Function Cleanup
3838
Write-Host "Removing 'service' (TodoListService-aspnetcore-webapi) if needed"
3939
try
4040
{
41-
Get-MgApplication -Filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
41+
Get-MgApplication -Filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
4242
}
4343
catch
4444
{
45-
Write-Host "Unable to remove the application 'TodoListService-aspnetcore-webapi' . Try deleting manually." -ForegroundColor White -BackgroundColor Red
45+
$message = $_
46+
Write-Warning $Error[0]
47+
Write-Host "Unable to remove the application 'TodoListService-aspnetcore-webapi'. Error is $message. Try deleting manually." -ForegroundColor White -BackgroundColor Red
4648
}
4749

4850
Write-Host "Making sure there are no more (TodoListService-aspnetcore-webapi) applications found, will remove if needed..."
49-
$apps = Get-MgApplication -Filter "DisplayName eq 'TodoListService-aspnetcore-webapi'"
51+
$apps = Get-MgApplication -Filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | Format-List Id, DisplayName, AppId, SignInAudience, PublisherDomain
5052

5153
if ($apps)
5254
{
@@ -62,24 +64,28 @@ Function Cleanup
6264
# also remove service principals of this app
6365
try
6466
{
65-
Get-MgServicePrincipal -filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | ForEach-Object {Remove-MgServicePrincipal -ApplicationId $_.Id -Confirm:$false}
67+
Get-MgServicePrincipal -filter "DisplayName eq 'TodoListService-aspnetcore-webapi'" | ForEach-Object {Remove-MgServicePrincipal -ServicePrincipalId $_.Id -Confirm:$false}
6668
}
6769
catch
6870
{
69-
Write-Host "Unable to remove ServicePrincipal 'TodoListService-aspnetcore-webapi' . Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
71+
$message = $_
72+
Write-Warning $Error[0]
73+
Write-Host "Unable to remove ServicePrincipal 'TodoListService-aspnetcore-webapi'. Error is $message. Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
7074
}
7175
Write-Host "Removing 'client' (TodoListClient-aspnetcore-webapi) if needed"
7276
try
7377
{
74-
Get-MgApplication -Filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
78+
Get-MgApplication -Filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
7579
}
7680
catch
7781
{
78-
Write-Host "Unable to remove the application 'TodoListClient-aspnetcore-webapi' . Try deleting manually." -ForegroundColor White -BackgroundColor Red
82+
$message = $_
83+
Write-Warning $Error[0]
84+
Write-Host "Unable to remove the application 'TodoListClient-aspnetcore-webapi'. Error is $message. Try deleting manually." -ForegroundColor White -BackgroundColor Red
7985
}
8086

8187
Write-Host "Making sure there are no more (TodoListClient-aspnetcore-webapi) applications found, will remove if needed..."
82-
$apps = Get-MgApplication -Filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'"
88+
$apps = Get-MgApplication -Filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | Format-List Id, DisplayName, AppId, SignInAudience, PublisherDomain
8389

8490
if ($apps)
8591
{
@@ -95,11 +101,13 @@ Function Cleanup
95101
# also remove service principals of this app
96102
try
97103
{
98-
Get-MgServicePrincipal -filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | ForEach-Object {Remove-MgServicePrincipal -ApplicationId $_.Id -Confirm:$false}
104+
Get-MgServicePrincipal -filter "DisplayName eq 'TodoListClient-aspnetcore-webapi'" | ForEach-Object {Remove-MgServicePrincipal -ServicePrincipalId $_.Id -Confirm:$false}
99105
}
100106
catch
101107
{
102-
Write-Host "Unable to remove ServicePrincipal 'TodoListClient-aspnetcore-webapi' . Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
108+
$message = $_
109+
Write-Warning $Error[0]
110+
Write-Host "Unable to remove ServicePrincipal 'TodoListClient-aspnetcore-webapi'. Error is $message. Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
103111
}
104112
}
105113

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts/Configure.ps1

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -348,27 +348,37 @@ Function ConfigureApplications
348348

349349
# Add Required Resources Access (from 'client' to 'service')
350350
Write-Host "Getting access from 'client' to 'service'"
351-
$requiredPermissions = GetRequiredPermissions -applicationDisplayName "TodoListService-aspnetcore-webapi" `
351+
$requiredPermission = GetRequiredPermissions -applicationDisplayName "TodoListService-aspnetcore-webapi" `
352352
-requiredDelegatedPermissions "ToDoList.Read|ToDoList.ReadWrite" `
353-
354353

355-
$requiredResourcesAccess.Add($requiredPermissions)
354+
$requiredResourcesAccess.Add($requiredPermission)
356355
Update-MgApplication -ApplicationId $clientAadApplication.Id -RequiredResourceAccess $requiredResourcesAccess
357356
Write-Host "Granted permissions."
357+
358+
Write-Host "Successfully registered and configured that app registration for 'TodoListClient-aspnetcore-webapi' at" -ForegroundColor Green
359+
360+
# print the registered app portal URL for any further navigation
361+
$clientPortalUrl
358362

359363
# Update config file for 'service'
360-
$configFile = $pwd.Path + "\..\TodoListService\appsettings.json"
364+
# $configFile = $pwd.Path + "\..\TodoListService\appsettings.json"
365+
$configFile = $(Resolve-Path ($pwd.Path + "\..\TodoListService\appsettings.json"))
366+
361367
$dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $serviceAadApplication.AppId };
362368

363-
Write-Host "Updating the sample code ($configFile)"
369+
Write-Host "Updating the sample config '$configFile' with the following config values"
370+
$dictionary
364371

365372
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
366373

367374
# Update config file for 'client'
368-
$configFile = $pwd.Path + "\..\Client\appsettings.json"
375+
# $configFile = $pwd.Path + "\..\Client\appsettings.json"
376+
$configFile = $(Resolve-Path ($pwd.Path + "\..\Client\appsettings.json"))
377+
369378
$dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"ClientSecret" = $pwdCredential.SecretText;"TodoListScopes" = "api://$($serviceAadApplication.AppId)/ToDoList.Read api://$($serviceAadApplication.AppId)/ToDoList.ReadWrite";"TodoListBaseAddress" = $serviceAadApplication.Web.HomePageUrl };
370379

371-
Write-Host "Updating the sample code ($configFile)"
380+
Write-Host "Updating the sample config '$configFile' with the following config values"
381+
$dictionary
372382

373383
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
374384
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
@@ -400,7 +410,16 @@ Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the
400410
$ErrorActionPreference = "Stop"
401411

402412
# Run interactively (will ask you for the tenant ID)
403-
ConfigureApplications -tenantId $tenantId -environment $azureEnvironmentName
404413

414+
try
415+
{
416+
ConfigureApplications -tenantId $tenantId -environment $azureEnvironmentName
417+
}
418+
catch
419+
{
420+
$message = $_
421+
Write-Warning $Error[0]
422+
Write-Host "Unable to register apps. Error is $message." -ForegroundColor White -BackgroundColor Red
423+
}
405424
Write-Host "Disconnecting from tenant"
406425
Disconnect-MgGraph

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts/sample.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@
1010
"Description": "This sample demonstrates an ASP.NET Core Web App signing-in a user and calling an ASP.NET Core Web API that is secured with Azure AD.",
1111
"Languages": [ "csharp" ],
1212
"Products": [ "aspnet-core", "azure-active-directory" ],
13-
"Library":["Microsoft.Identity.Web"]
13+
"Library": [ "Microsoft.Identity.Web" ],
14+
"Platform": "AspNetCore"
1415
},
1516

1617
/*

‎4-WebApp-your-API/4-1-MyOrg/README.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -300,9 +300,11 @@ To provide a recommendation, visit the following [User Voice page](https://feedb
300300
* `AddMicrosoftIdentityWebApiAuthentication()` protects the Web API by [validating Access tokens](https://docs.microsoft.com/azure/active-directory/develop/access-tokens#validating-tokens) sent tho this API. Check out [Protected web API: Code configuration](https://docs.microsoft.com/azure/active-directory/develop/scenario-protected-web-api-app-configuration) which explains the inner workings of this method in more detail.
301301
302302
* There is a bit of code (commented) provided under this method that can be used to used do **extended token validation** and do checks based on additional claims, such as:
303-
* check if the client app's appid (azp) is in some sort of an allowed list via the 'azp' claim, in case you wanted to restrict the API to a list of client apps.
304-
* check if the caller's account is homed or guest via the 'acct' optional claim
305-
* check if the caller belongs to right roles or groups via the 'roles' or 'groups' claim, respectively
303+
* check if the client app's `appid (azp)` is in some sort of an allowed list via the 'azp' claim, in case you wanted to restrict the API to a list of client apps.
304+
* check if the caller's account is homed or guest via the `acct` optional claim
305+
* check if the caller belongs to right roles or groups via the `roles` or `groups` claim, respectively
306+
307+
See [How to manually validate a JWT access token using the Microsoft identity platform](https://aka.ms/extendtokenvalidation) for more details on to further verify the caller using this method.
306308
307309
1. Then in the controllers `TodoListController.cs`, the `[Authorize]` added on top of the class to protect this route.
308310
* Further in the controller, the [RequiredScopeOrAppPermission](https://github.com/AzureAD/microsoft-identity-web/wiki/web-apis#checking-for-scopes-or-app-permissions=) is used to list the ([Delegated permissions](https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent)), that the user should consent for, before the method can be called.

0 commit comments

Comments
 (0)