Task 1924572 Sample 4-1 basher update

[aremo-ms]

Added App Permissions and enhanced new attribute that combines Roles and Scopes altogether.
ToDoList Service Api was refactored for best practices
Readme file was updated as well.

[kalyankrishna1]

1. The client ASP.NET Core Web App uses the Microsoft.Identity.Web to sign-in and obtain a JWT Access Tokens from Azure AD.

to sign-in a user

---

In reply to: 1156836710

---

In reply to: 1156836710

---

In reply to: 1156836710

---

In reply to: 1156836710

---

Refers to: 4-WebApp-your-API/4-1-MyOrg/README.md:37 in 55e3a1c. [](commit_id = 55e3a1c, deletion_comment = False)

[kalyankrishna1]

1. All APIs have to publish a minimum of two scopes, also called Delegated Permissions, for the client's to obtain an access token successfully. To publish a scope, follow these steps:

minimum is one, so change to one here, but the steps below will remain the same

---

In reply to: 1156839720

---

In reply to: 1156839720

---

In reply to: 1156839720

---

Refers to: 4-WebApp-your-API/4-1-MyOrg/README.md:137 in 55e3a1c. [](commit_id = 55e3a1c, deletion_comment = False)

[kalyankrishna1]

1. In the TodoListService project, first the package Microsoft.Identity.Webis added from NuGet.

find the package Microsoft.Identity.Weband add it from NuGet.

---

In reply to: 1156847059

---

In reply to: 1156847059

---

In reply to: 1156847059

---

Refers to: 4-WebApp-your-API/4-1-MyOrg/README.md:281 in 55e3a1c. [](commit_id = 55e3a1c, deletion_comment = False)

[kalyankrishna1]

* at the top of the file, the following two using directives were added:

one :)

---

In reply to: 1156847267

---

In reply to: 1156847267

---

In reply to: 1156847267

---

Refers to: 4-WebApp-your-API/4-1-MyOrg/README.md:285 in 55e3a1c. [](commit_id = 55e3a1c, deletion_comment = False)

[kalyankrishna1]

* `AddMicrosoftIdentityWebApiAuthentication()` protects the Web API by validating Access tokens sent tho this API. Check out [Protected web API: Code configuration](https://docs.microsoft.com/azure/active-directory/develop/scenario-protected-web-api-app-configuration) which explains the inner workings of this method in more detail.

link to "https://docs.microsoft.com/azure/active-directory/develop/access-tokens#validating-tokens"

---

In reply to: 1156847970

---

In reply to: 1156847970

---

In reply to: 1156847970

---

Refers to: 4-WebApp-your-API/4-1-MyOrg/README.md:297 in 55e3a1c. [](commit_id = 55e3a1c, deletion_comment = False)

[kalyankrishna1]

  [RequiredScope(new string[] { "ToDoList.Read", "ToDoList.Write" })

1. list both delegated and app permissions
2. Explain here that "while this sample only uses delegated permissions, the attribute [attribute name], protects this API method for both delegated and app permissions

---

In reply to: 1156850339

---

In reply to: 1156850339

---

In reply to: 1156850339

---

Refers to: 4-WebApp-your-API/4-1-MyOrg/README.md:305 in 55e3a1c. [](commit_id = 55e3a1c, deletion_comment = False)

[kalyankrishna1]

  string owner = User.Identity.Name;

add check here that if there are only delegated permissions , this check is used and so on..

---

In reply to: 1156850993

---

In reply to: 1156850993

---

In reply to: 1156850993

---

Refers to: 4-WebApp-your-API/4-1-MyOrg/README.md:309 in 55e3a1c. [](commit_id = 55e3a1c, deletion_comment = False)

[kalyankrishna1]

* Then in the controllers `TodoListController.cs`, the `[Authorize]` added on top of the class to protect this route.

Change the ToDoListController such that it works w/o any change for both delegated and app only scenarios.
We DO NOT provide separate advise for app only scenario..

---

In reply to: 1156851866

---

In reply to: 1156851866

---

In reply to: 1156851866

---

Refers to: 4-WebApp-your-API/4-1-MyOrg/README.md:299 in 55e3a1c. [](commit_id = 55e3a1c, deletion_comment = False)

[derisen]

Suggested change

	// - a list of scopes for a V2 application (for instance "api://b3682cc7-8b30-4bd2-aaba-080c6bf0fd31/ToDoList.Read api://b3682cc7-8b30-4bd2-aaba-080c6bf0fd31/ToDoList.Write")
	// - a list of scopes for a V2 application (for instance "api://b3682cc7-8b30-4bd2-aaba-080c6bf0fd31/ToDoList.Read api://b3682cc7-8b30-4bd2-aaba-080c6bf0fd31/ToDoList.ReadWrite")