Azure-Samples · kalyankrishna1 · Aug 26, 2022 · Jun 3, 2022 · Jun 8, 2022 · Jun 8, 2022
diff --git a/4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/Configure.ps1 b/4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/Configure.ps1
@@ -205,6 +205,14 @@ Function ConfigureApplications
         Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($serviceServicePrincipal.DisplayName)'"
     }
 
+    # Add application permissions/user roles
+    $appRoles = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphAppRole]
+    $newRole = CreateAppRole -types "Application" -name "ToDoList.Read.All" -description "Application can only read ToDo list"
+    $appRoles.Add($newRole)
+    $newRole = CreateAppRole -types "Application" -name "ToDoList.ReadWrite.All" -description "Application can read and write into ToDo list"
+    $appRoles.Add($newRole)
+    Update-MgApplication -ApplicationId $serviceAadApplication.Id -AppRoles $appRoles
+
     # rename the user_impersonation scope if it exists to match the readme steps or add a new scope
 
     # delete default scope i.e. User_impersonation
@@ -228,14 +236,21 @@ Function ConfigureApplications
     -userConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
     -userConsentDescription "Allow the application to access TodoListService-aspnetcore-webapi on your behalf."  `
     -adminConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
-    -adminConsentDescription "Allows the app to have the same access to information in the directory on behalf of the signed-in user."
+    -adminConsentDescription "Allow the app TodoListService-aspnetcore-webapi to [ex, read ToDo list items]"
 
     $scopes.Add($scope)
     $scope = CreateScope -value ToDoList.Write  `
     -userConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
     -userConsentDescription "Allow the application to access TodoListService-aspnetcore-webapi on your behalf."  `
     -adminConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
-    -adminConsentDescription "Allows the app to have the same access to information in the directory on behalf of the signed-in user."
+    -adminConsentDescription "Allow the app TodoListService-aspnetcore-webapi to [ex, read ToDo list items]"
+
+    $scopes.Add($scope)
+    $scope = CreateScope -value ToDoList.ReadWrite  `
+    -userConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
+    -userConsentDescription "Allow the application to access TodoListService-aspnetcore-webapi on your behalf."  `
+    -adminConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
+    -adminConsentDescription "Allow the app TodoListService-aspnetcore-webapi to [ex, read ToDo list items]"
 
     $scopes.Add($scope)
 
@@ -262,10 +277,13 @@ Function ConfigureApplications
                                                           RedirectUris = "https://localhost:44321/", "https://localhost:44321/signin-oidc"; `
                                                           HomePageUrl = "https://localhost:44321/"; `
                                                           LogoutUrl = "https://localhost:44321/signout-oidc"; `
+                                                          ImplicitGrantSettings = @{ `
+                                                              EnableAccessTokenIssuance=$true; `
+                                                          } `
                                                         } `
                                                        -SignInAudience AzureADMyOrg `
                                                       #end of command
-    #add password to the application
+    #add a secret to the application
     $pwdCredential = Add-MgApplicationPassword -ApplicationId $clientAadApplication.Id -PasswordCredential $key
     $clientAppKey = $pwdCredential.SecretText
     $tenantName = (Get-MgApplication -ApplicationId $clientAadApplication.Id).PublisherDomain
@@ -345,7 +363,7 @@ Function ConfigureApplications
 
     # Update config file for 'client'
     $configFile = $pwd.Path + "\..\Client\appsettings.json"
-    $dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"KeyVaultCertificateName" = $certificateName;"TodoListScopes" = "api://$($serviceAadApplication.AppId)/ToDoList.Read api://$($serviceAadApplication.AppId)/ToDoList.Write";"TodoListBaseAddress" = $serviceAadApplication.Web.HomePageUrl };
+    $dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"KeyVaultCertificateName" = $certificateName;"TodoListScopes" = "api://$($serviceAadApplication.AppId)/ToDoList.Read api://$($serviceAadApplication.AppId)/ToDoList.Write api://$($serviceAadApplication.AppId)/ToDoList.ReadWrite";"TodoListBaseAddress" = $serviceAadApplication.Web.HomePageUrl };
 
     Write-Host "Updating the sample code ($configFile)"
 

diff --git a/4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/sample.json b/4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/sample.json
@@ -94,8 +94,19 @@
         "SampleSubPath": "4-WebApp-Your-API\\4-1-MyOrg",
         "ProjectDirectory": "\\TodoListService"
       },
-      "AppScopes": [ "ToDoList.Read", "ToDoList.Write" ]
-
+      "Scopes": [ "ToDoList.Read", "ToDoList.ReadWrite" ],
+      "AppRoles": [
+        {
+          "Types": [ "Application" ],
+          "Name": "ToDoList.Read.All",
+          "Description": "Application can only read ToDo list"
+        },
+        {
+          "Types": [ "Application" ],
+          "Name": "ToDoList.ReadWrite.All",
+          "Description": "Application can read and write into ToDo list"
+        }
+      ]
     },
     {
       "Id": "client",
@@ -114,6 +125,8 @@
       ],
       "Certificate": "the certificate will be named by application name",
       "ManualSteps": [],
+      "EnableAccessTokenIssuance": "true",
+      "EnableIdTokenIssuance": "false",
       "Sample": {
         "SampleSubPath": "4-WebApp-Your-API\\4-1-MyOrg",
         "ProjectDirectory": "\\Client"

diff --git a/4-WebApp-your-API/4-1-MyOrg/AppCreationScripts/Configure.ps1 b/4-WebApp-your-API/4-1-MyOrg/AppCreationScripts/Configure.ps1
@@ -205,6 +205,14 @@ Function ConfigureApplications
         Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($serviceServicePrincipal.DisplayName)'"
     }
 
+    # Add application permissions/user roles
+    $appRoles = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphAppRole]
+    $newRole = CreateAppRole -types "Application" -name "ToDoList.Read.All" -description "Application can only read ToDo list"
+    $appRoles.Add($newRole)
+    $newRole = CreateAppRole -types "Application" -name "ToDoList.ReadWrite.All" -description "Application can read and write into ToDo list"
+    $appRoles.Add($newRole)
+    Update-MgApplication -ApplicationId $serviceAadApplication.Id -AppRoles $appRoles
+
     # rename the user_impersonation scope if it exists to match the readme steps or add a new scope
 
     # delete default scope i.e. User_impersonation
@@ -228,14 +236,14 @@ Function ConfigureApplications
     -userConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
     -userConsentDescription "Allow the application to access TodoListService-aspnetcore-webapi on your behalf."  `
     -adminConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
-    -adminConsentDescription "Allows the app to have the same access to information in the directory on behalf of the signed-in user."
+    -adminConsentDescription "Allow the app TodoListService-aspnetcore-webapi to [ex, read ToDo list items]"
 
     $scopes.Add($scope)
-    $scope = CreateScope -value ToDoList.Write  `
+    $scope = CreateScope -value ToDoList.ReadWrite  `
     -userConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
     -userConsentDescription "Allow the application to access TodoListService-aspnetcore-webapi on your behalf."  `
     -adminConsentDisplayName "Access TodoListService-aspnetcore-webapi"  `
-    -adminConsentDescription "Allows the app to have the same access to information in the directory on behalf of the signed-in user."
+    -adminConsentDescription "Allow the app TodoListService-aspnetcore-webapi to [ex, read ToDo list items]"
 
     $scopes.Add($scope)
 
@@ -262,6 +270,9 @@ Function ConfigureApplications
                                                           RedirectUris = "https://localhost:44321/", "https://localhost:44321/signin-oidc"; `
                                                           HomePageUrl = "https://localhost:44321/"; `
                                                           LogoutUrl = "https://localhost:44321/signout-oidc"; `
+                                                          ImplicitGrantSettings = @{ `
+                                                              EnableAccessTokenIssuance=$true; `
+                                                          } `
                                                         } `
                                                        -SignInAudience AzureADMyOrg `
                                                       #end of command
@@ -294,7 +305,7 @@ Function ConfigureApplications
     # Add Required Resources Access (from 'client' to 'service')
     Write-Host "Getting access from 'client' to 'service'"
     $requiredPermissions = GetRequiredPermissions -applicationDisplayName "TodoListService-aspnetcore-webapi" `
-        -requiredDelegatedPermissions "ToDoList.Read|ToDoList.Write" `
+        -requiredDelegatedPermissions "ToDoList.Read|ToDoList.ReadWrite" `
 
 
     $requiredResourcesAccess.Add($requiredPermissions)
@@ -311,7 +322,7 @@ Function ConfigureApplications
 
     # Update config file for 'client'
     $configFile = $pwd.Path + "\..\Client\appsettings.json"
-    $dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"ClientSecret" = $pwdCredential.SecretText;"TodoListScopes" = "api://$($serviceAadApplication.AppId)/ToDoList.Read api://$($serviceAadApplication.AppId)/ToDoList.Write";"TodoListBaseAddress" = $serviceAadApplication.Web.HomePageUrl };
+    $dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"ClientSecret" = $pwdCredential.SecretText;"TodoListScopes" = "api://$($serviceAadApplication.AppId)/ToDoList.Read api://$($serviceAadApplication.AppId)/ToDoList.ReadWrite";"TodoListBaseAddress" = $serviceAadApplication.Web.HomePageUrl };
 
     Write-Host "Updating the sample code ($configFile)"
 

diff --git a/4-WebApp-your-API/4-1-MyOrg/AppCreationScripts/sample.json b/4-WebApp-your-API/4-1-MyOrg/AppCreationScripts/sample.json
@@ -94,7 +94,19 @@
         "SampleSubPath": "4-WebApp-Your-API\\4-1-MyOrg",
         "ProjectDirectory": "\\TodoListService"
       },
-      "Scopes": [ "ToDoList.Read", "ToDoList.Write" ]
+      "Scopes": [ "ToDoList.Read", "ToDoList.ReadWrite" ],
+      "AppRoles": [
+        {
+          "Types": [ "Application" ],
+          "Name": "ToDoList.Read.All",
+          "Description": "Application can only read ToDo list"
+        },
+        {
+          "Types": [ "Application" ],
+          "Name": "ToDoList.ReadWrite.All",
+          "Description": "Application can read and write into ToDo list"
+        }
+      ]
     },
     {
       "Id": "client",
@@ -108,10 +120,12 @@
       "RequiredResourcesAccess": [
         {
           "Resource": "service",
-          "DelegatedPermissions": [ "ToDoList.Read", "ToDoList.Write" ]
+          "DelegatedPermissions": [ "ToDoList.Read", "ToDoList.ReadWrite" ]
         }
       ],
       "ManualSteps": [],
+      "EnableAccessTokenIssuance": "true",
+      "EnableIdTokenIssuance": "false",
       "Sample": {
         "SampleSubPath": "4-WebApp-Your-API\\4-1-MyOrg",
         "ProjectDirectory": "\\Client"

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Controllers/TodoListController.cs b/4-WebApp-your-API/4-1-MyOrg/Client/Controllers/TodoListController.cs
@@ -2,8 +2,8 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Identity.Web;
 using System.Threading.Tasks;
+using TodoListClient.Models;
 using TodoListClient.Services;
-using TodoListService.Models;
 
 namespace TodoListClient.Controllers
 {

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Infrastructure/Constants.cs b/4-WebApp-your-API/4-1-MyOrg/Client/Infrastructure/Constants.cs
@@ -4,5 +4,6 @@ public static class Constants
     {
         public const string ScopeUserImpersonation = "user_impersonation";
         public const string BearerAuthorizationScheme = "Bearer";
+        public const string ScopeClaimType = "http://schemas.microsoft.com/identity/claims/scope";
     }
 }
diff --git a/...-MyOrg/TodoListService/Models/TodoItem.cs → ...r-API/4-1-MyOrg/Client/Models/TodoItem.cs b/...-MyOrg/TodoListService/Models/TodoItem.cs → ...r-API/4-1-MyOrg/Client/Models/TodoItem.cs
@@ -1,4 +1,4 @@
-namespace TodoListService.Models
+namespace TodoListClient.Models
 {
     public class Todo
     {

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Services/ITodoListService.cs b/4-WebApp-your-API/4-1-MyOrg/Client/Services/ITodoListService.cs
@@ -24,7 +24,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 
 using System.Collections.Generic;
 using System.Threading.Tasks;
-using TodoListService.Models;
+using TodoListClient.Models;
 
 namespace TodoListClient.Services
 {

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Services/TodoListService.cs b/4-WebApp-your-API/4-1-MyOrg/Client/Services/TodoListService.cs
@@ -12,7 +12,7 @@
 using System.Net.Http.Headers;
 using System.Text;
 using System.Threading.Tasks;
-using TodoListService.Models;
+using TodoListClient.Models;
 
 namespace TodoListClient.Services
 {

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/TodoListClient.csproj b/4-WebApp-your-API/4-1-MyOrg/Client/TodoListClient.csproj
@@ -18,12 +18,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <Compile Include="..\TodoListService\Models\TodoItem.cs" Link="Models\TodoItem.cs" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Microsoft.Identity.Web" Version="1.24.0" />
-    <PackageReference Include="Microsoft.Identity.Web.UI" Version="1.24.0" />
+    <PackageReference Include="Microsoft.Identity.Web" Version="1.25.0" />
+    <PackageReference Include="Microsoft.Identity.Web.UI" Version="1.25.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
   </ItemGroup>
 

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Create.cshtml b/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Create.cshtml
@@ -1,4 +1,4 @@
-@model TodoListService.Models.Todo
+@model TodoListClient.Models.Todo
 @{
     ViewData["Title"] = "Create";
 }

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Delete.cshtml b/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Delete.cshtml
@@ -1,4 +1,4 @@
-@model TodoListService.Models.Todo
+@model TodoListClient.Models.Todo
 
 @{
     ViewData["Title"] = "Delete";

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Details.cshtml b/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Details.cshtml
@@ -1,4 +1,4 @@
-@model TodoListService.Models.Todo
+@model TodoListClient.Models.Todo
 
 @{
     ViewData["Title"] = "Details";

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Edit.cshtml b/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Edit.cshtml
@@ -1,4 +1,4 @@
-@model TodoListService.Models.Todo
+@model TodoListClient.Models.Todo
 @{
     ViewData["Title"] = "Edit";
 }

diff --git a/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Index.cshtml b/4-WebApp-your-API/4-1-MyOrg/Client/Views/TodoList/Index.cshtml
@@ -1,4 +1,4 @@
-@model IEnumerable<TodoListService.Models.Todo>
+@model IEnumerable<TodoListClient.Models.Todo>
 
 @{
     ViewData["Title"] = "Index";