Skip to content

Commit 9a790f1

Browse files
author
Kalyan Krishna
authored
Merge pull request #263 from Azure-Samples/kkrishna/minoredits
Minor edits, mostly to readme and comments
2 parents 94d81b8 + 73c0dba commit 9a790f1

File tree

43 files changed

+839
-633
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+839
-633
lines changed

‎1-WebApp-OIDC/1-1-MyOrg/AppCreationScripts/AppCreationScripts.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Registering the Azure Active Directory applications and updating the configuration files for this sample using PowerShell scripts
1+
# Registering the sample apps with Microsoft identity platform and updating the configuration files using PowerShell scripts
22

33
## Overview
44

@@ -9,9 +9,10 @@
99
```PowerShell
1010
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force
1111
```
12-
1. Run the script to create your Azure AD application and configure the code of the sample application accordinly. (Other ways of running the scripts are described below)
12+
1. Run the script to create your Azure AD application and configure the code of the sample application accordingly. (Other ways of running the scripts are described below)
1313
```PowerShell
14-
.\AppCreationScripts\Configure.ps1
14+
cd .\AppCreationScripts\
15+
.\Configure.ps1
1516
```
1617
1. Open the Visual Studio solution and click start
1718

‎1-WebApp-OIDC/1-1-MyOrg/AppCreationScripts/Cleanup.ps1‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ param(
55
[string] $tenantId
66
)
77

8-
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
8+
if ($null -eq (Get-Module -ListAvailable -Name "AzureAD")) {
99
Install-Module "AzureAD" -Scope CurrentUser
1010
}
1111
Import-Module AzureAD
12-
$ErrorActionPreference = 'Stop'
12+
$ErrorActionPreference = "Stop"
1313

1414
Function Cleanup
1515
{
@@ -44,20 +44,27 @@ This function removes the Azure AD applications for the sample. These applicatio
4444
$tenantId = $creds.Tenant.Id
4545
}
4646
$tenant = Get-AzureADTenantDetail
47-
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
47+
$tenantName = ($tenant.VerifiedDomains | Where-Object { $_._Default -eq $True }).Name
4848

4949
# Removes the applications
5050
Write-Host "Cleaning-up applications from tenant '$tenantName'"
5151

5252
Write-Host "Removing 'webApp' (WebApp) if needed"
53-
$app=Get-AzureADApplication -Filter "DisplayName eq 'WebApp'"
53+
Get-AzureADApplication -Filter "DisplayName eq 'WebApp'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
54+
$apps = Get-AzureADApplication -Filter "DisplayName eq 'WebApp'"
55+
if ($apps)
56+
{
57+
Remove-AzureADApplication -ObjectId $apps.ObjectId
58+
}
5459

55-
if ($app)
60+
foreach ($app in $apps)
5661
{
5762
Remove-AzureADApplication -ObjectId $app.ObjectId
58-
Write-Host "Removed."
63+
Write-Host "Removed WebApp.."
5964
}
60-
65+
# also remove service principals of this app
66+
Get-AzureADServicePrincipal -filter "DisplayName eq 'WebApp'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
67+
6168
}
6269

63-
Cleanup -Credential $Credential -tenantId $TenantId
70+
Cleanup -Credential $Credential -tenantId $TenantId

‎1-WebApp-OIDC/1-1-MyOrg/AppCreationScripts/Configure.ps1‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,16 @@ Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable]
5656
Set-Content -Value "<html><body><table>" -Path createdApps.html
5757
Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the Azure portal</th></tr></thead><tbody>" -Path createdApps.html
5858

59+
$ErrorActionPreference = "Stop"
60+
5961
Function ConfigureApplications
6062
{
6163
<#.Description
6264
This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the
6365
configuration files in the client and service project of the visual studio solution (App.Config and Web.Config)
6466
so that they are consistent with the Applications parameters
6567
#>
68+
$commonendpoint = "common"
6669

6770
# $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
6871
# into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
@@ -93,11 +96,12 @@ Function ConfigureApplications
9396
$tenant = Get-AzureADTenantDetail
9497
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
9598

96-
# Get the user running the script
99+
# Get the user running the script to add the user as the app owner
97100
$user = Get-AzureADUser -ObjectId $creds.Account.Id
98101

99102
# Create the webApp AAD application
100103
Write-Host "Creating the AAD application (WebApp)"
104+
# create the application
101105
$webAppAadApplication = New-AzureADApplication -DisplayName "WebApp" `
102106
-HomePage "https://localhost:44321/" `
103107
-LogoutUrl "https://localhost:44321/signout-oidc" `
@@ -106,17 +110,19 @@ Function ConfigureApplications
106110
-Oauth2AllowImplicitFlow $true `
107111
-PublicClient $False
108112

113+
# create the service principal of the newly created application
109114
$currentAppId = $webAppAadApplication.AppId
110115
$webAppServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
111116

112117
# add the user running the script as an app owner if needed
113118
$owner = Get-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId
114119
if ($owner -eq $null)
115120
{
116-
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
117-
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
121+
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
122+
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
118123
}
119124

125+
120126
Write-Host "Done creating the webApp application (WebApp)"
121127

122128
# URL of the AAD application in the Azure portal
@@ -130,14 +136,15 @@ Function ConfigureApplications
130136
Write-Host "Updating the sample code ($configFile)"
131137
$dictionary = @{ "ClientId" = $webAppAadApplication.AppId;"TenantId" = $tenantId;"Domain" = $tenantName };
132138
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
133-
139+
134140
Add-Content -Value "</tbody></table></body></html>" -Path createdApps.html
135141
}
136142

137143
# Pre-requisites
138144
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
139145
Install-Module "AzureAD" -Scope CurrentUser
140-
}
146+
}
147+
141148
Import-Module AzureAD
142149

143150
# Run interactively (will ask you for the tenant ID)

‎1-WebApp-OIDC/1-1-MyOrg/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@ There is one project in this sample. To register it, you can:
4848
3. Run the script to create your Azure AD application and configure the code of the sample application accordingly
4949
5050
```PowerShell
51-
.\AppCreationScripts\Configure.ps1
51+
cd .\AppCreationScripts\
52+
.\Configure.ps1
5253
```
5354
5455
> Other ways of running the scripts are described in [App Creation Scripts](./AppCreationScripts/AppCreationScripts.md)

‎1-WebApp-OIDC/1-2-AnyOrg/AppCreationScripts/AppCreationScripts.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Registering the Azure Active Directory applications and updating the configuration files for this sample using PowerShell scripts
1+
# Registering the sample apps with Microsoft identity platform and updating the configuration files using PowerShell scripts
22

33
## Overview
44

@@ -9,9 +9,10 @@
99
```PowerShell
1010
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force
1111
```
12-
1. Run the script to create your Azure AD application and configure the code of the sample application accordinly. (Other ways of running the scripts are described below)
12+
1. Run the script to create your Azure AD application and configure the code of the sample application accordingly. (Other ways of running the scripts are described below)
1313
```PowerShell
14-
.\AppCreationScripts\Configure.ps1
14+
cd .\AppCreationScripts\
15+
.\Configure.ps1
1516
```
1617
1. Open the Visual Studio solution and click start
1718

‎1-WebApp-OIDC/1-2-AnyOrg/AppCreationScripts/Cleanup.ps1‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ param(
55
[string] $tenantId
66
)
77

8-
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
8+
if ($null -eq (Get-Module -ListAvailable -Name "AzureAD")) {
99
Install-Module "AzureAD" -Scope CurrentUser
1010
}
1111
Import-Module AzureAD
12-
$ErrorActionPreference = 'Stop'
12+
$ErrorActionPreference = "Stop"
1313

1414
Function Cleanup
1515
{
@@ -44,20 +44,27 @@ This function removes the Azure AD applications for the sample. These applicatio
4444
$tenantId = $creds.Tenant.Id
4545
}
4646
$tenant = Get-AzureADTenantDetail
47-
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
47+
$tenantName = ($tenant.VerifiedDomains | Where-Object { $_._Default -eq $True }).Name
4848

4949
# Removes the applications
5050
Write-Host "Cleaning-up applications from tenant '$tenantName'"
5151

5252
Write-Host "Removing 'webApp' (WebApp) if needed"
53-
$app=Get-AzureADApplication -Filter "DisplayName eq 'WebApp'"
53+
Get-AzureADApplication -Filter "DisplayName eq 'WebApp'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
54+
$apps = Get-AzureADApplication -Filter "DisplayName eq 'WebApp'"
55+
if ($apps)
56+
{
57+
Remove-AzureADApplication -ObjectId $apps.ObjectId
58+
}
5459

55-
if ($app)
60+
foreach ($app in $apps)
5661
{
5762
Remove-AzureADApplication -ObjectId $app.ObjectId
58-
Write-Host "Removed."
63+
Write-Host "Removed WebApp.."
5964
}
60-
65+
# also remove service principals of this app
66+
Get-AzureADServicePrincipal -filter "DisplayName eq 'WebApp'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
67+
6168
}
6269

63-
Cleanup -Credential $Credential -tenantId $TenantId
70+
Cleanup -Credential $Credential -tenantId $TenantId

‎1-WebApp-OIDC/1-2-AnyOrg/AppCreationScripts/Configure.ps1‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,16 @@ Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable]
5656
Set-Content -Value "<html><body><table>" -Path createdApps.html
5757
Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the Azure portal</th></tr></thead><tbody>" -Path createdApps.html
5858

59+
$ErrorActionPreference = "Stop"
60+
5961
Function ConfigureApplications
6062
{
6163
<#.Description
6264
This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the
6365
configuration files in the client and service project of the visual studio solution (App.Config and Web.Config)
6466
so that they are consistent with the Applications parameters
6567
#>
68+
$commonendpoint = "common"
6669

6770
# $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
6871
# into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
@@ -93,11 +96,12 @@ Function ConfigureApplications
9396
$tenant = Get-AzureADTenantDetail
9497
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
9598

96-
# Get the user running the script
99+
# Get the user running the script to add the user as the app owner
97100
$user = Get-AzureADUser -ObjectId $creds.Account.Id
98101

99102
# Create the webApp AAD application
100103
Write-Host "Creating the AAD application (WebApp)"
104+
# create the application
101105
$webAppAadApplication = New-AzureADApplication -DisplayName "WebApp" `
102106
-HomePage "https://localhost:44321/" `
103107
-LogoutUrl "https://localhost:44321/signout-oidc" `
@@ -107,17 +111,19 @@ Function ConfigureApplications
107111
-Oauth2AllowImplicitFlow $true `
108112
-PublicClient $False
109113

114+
# create the service principal of the newly created application
110115
$currentAppId = $webAppAadApplication.AppId
111116
$webAppServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
112117

113118
# add the user running the script as an app owner if needed
114119
$owner = Get-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId
115120
if ($owner -eq $null)
116121
{
117-
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
118-
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
122+
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
123+
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
119124
}
120125

126+
121127
Write-Host "Done creating the webApp application (WebApp)"
122128

123129
# URL of the AAD application in the Azure portal
@@ -131,14 +137,15 @@ Function ConfigureApplications
131137
Write-Host "Updating the sample code ($configFile)"
132138
$dictionary = @{ "ClientId" = $webAppAadApplication.AppId;"TenantId" = "organizations";"Domain" = $tenantName };
133139
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
134-
140+
135141
Add-Content -Value "</tbody></table></body></html>" -Path createdApps.html
136142
}
137143

138144
# Pre-requisites
139145
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
140146
Install-Module "AzureAD" -Scope CurrentUser
141-
}
147+
}
148+
142149
Import-Module AzureAD
143150

144151
# Run interactively (will ask you for the tenant ID)

‎1-WebApp-OIDC/1-2-AnyOrg/AppCreationScripts/sample.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"Sample": {
3-
"Title": "An ASP.NET Core 2.x Web App which lets sign-in users with work and school in any org",
3+
"Title": "An ASP.NET Core Web App which lets sign-in users with work and school in any org",
44
"Level": 200,
5-
"Client": "ASP.NET Core 2.x Web App",
5+
"Client": "ASP.NET Core Web App",
66
"Service": "Microsoft Graph",
77
"RepositoryUrl": "microsoft-identity-platform-aspnetcore-webapp-tutorial",
88
"Endpoint": "AAD v2.0"
@@ -41,7 +41,7 @@
4141
},
4242
{
4343
"key": "TenantId",
44-
"value": "organizations"
44+
"value": "\"organizations\""
4545
},
4646
{
4747
"key": "Domain",

‎1-WebApp-OIDC/1-2-AnyOrg/README-1-1-to-1-2.md‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,18 @@
22
services: active-directory
33
platforms: dotnet
44
author: jmprieur
5-
level: 100
5+
level: 200
66
client: ASP.NET Core Web App
77
endpoint: Microsoft identity platform
8+
page_type: sample
9+
languages:
10+
- csharp
11+
products:
12+
- azure
13+
- azure-active-directory
14+
- dotnet
15+
- office-ms-graph
16+
description: "Change your ASP.NET Core Web app to sign-in users in any org with the Microsoft identity platform"
817
---
918
# Change your ASP.NET Core Web app to sign-in users in any org with the Microsoft identity platform
1019

@@ -44,11 +53,11 @@ The actual sign-in audience (accounts to sign-in) is the lowest set of what is s
4453
- setting in the portal the **Supported account types** to **Accounts in any organizational directory and personal Microsoft accounts (e.g. Skype, Xbox, Outlook.com)** and set the `TenantId` value to `"organizations"` in the **appsettings.json** file
4554
- setting in the portal the **Supported account types** to **Accounts in any organizational directory** and set the `TenantId` value to `"common"` in the **appsettings.json** file
4655

47-
## How to restrict users from specific organizations to sign-in to your web app
56+
## How to restrict users from specific organizations from signing-in your web app
4857

49-
In order to restrict users from specific organizations to sign-in to your web app, you'll need to follow the steps above, and customize a bit more the code to restrict the valid token issuers. The token issuers are really the tenanted Azure AD authority which are allowed to issue a token to access your web application.
58+
In order to restrict users from specific organizations from signing-in to your web app, you'll need to customize your code a bit more to restrict issuers. In Azure AD, the token issuers are the Azure AD tenants which issue tokens to applications.
5059

51-
In the `Startup.cs` file, in the `ConfigureServices` method, after `services.AddMicrosoftIdentityPlatformAuthentication(Configuration)` add some code to validate specific issuers by overriding the `TokenValidationParameters.IssuerValidator` delegate.
60+
In the `Startup.cs` file, in the `ConfigureServices` method, after `services.AddMicrosoftIdentityPlatformAuthentication(Configuration)` add some code to filter issuers by overriding the `TokenValidationParameters.IssuerValidator` delegate.
5261

5362
```CSharp
5463
public void ConfigureServices(IServiceCollection services)
@@ -79,7 +88,7 @@ An example of code for `ValidateSpecificIssuers` is the following:
7988
}
8089
else
8190
{
82-
throw new SecurityTokenInvalidIssuerException("The accounts does not belong to one of the tenants that this Web App accepts to sign-in.");
91+
throw new SecurityTokenInvalidIssuerException("The sign-in user's account does not belong to one of the tenants that this Web App accepts users from.");
8392
}
8493
}
8594

@@ -97,6 +106,8 @@ An example of code for `ValidateSpecificIssuers` is the following:
97106
}
98107
```
99108

109+
> If you are building a SaaS application that will be used in multiple Azure AD tenants, the please note that there are a number of steps that a SaaS developer should be aware of and is beyond the scope of this article. You are advised to go through the the multi-tenant app developer's guide [Build a multi-tenant SaaS web application that calls Microsoft Graph using Azure AD & OpenID Connect](../2-WebApp-graph-user/2-3-Multi-Tenant/Readme.md) as well.
110+
100111
## Next steps
101112

102113
- Learn how to enable [any Microsoft accounts](../1-3-AnyOrgOrPersonal) to sign-in to your application

0 commit comments

Comments
 (0)