Skip to content

Commit 34145ae

Browse files
author
Kalyan Krishna
authored
Merge pull request #36 from Azure-Samples/kkrishna/updates2019
Updated to MSAL and other content updates
2 parents 7e5ca05 + a9ea4a1 commit 34145ae

23 files changed

+1107
-648
lines changed

‎AppCreationScripts/AppCreationScripts.md‎

Lines changed: 46 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,32 @@
11
# Registering the Azure Active Directory applications and updating the configuration files for this sample using PowerShell scripts
22

3+
## Overview
4+
5+
### Quick summary
6+
7+
1. On Windows run PowerShell and navigate to the root of the cloned directory
8+
1. In PowerShell run:
9+
```PowerShell
10+
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force
11+
```
12+
1. Run the script to create your Azure AD application and configure the code of the sample application accordinly. (Other ways of running the scripts are described below)
13+
```PowerShell
14+
.\AppCreationScripts\Configure.ps1
15+
```
16+
1. Open the Visual Studio solution and click start
17+
18+
### More details
19+
20+
The following paragraphs:
21+
22+
- [Present the scripts](#presentation-of-the-scripts) and explain their [usage patterns](#usage-pattern-for-tests-and-devops-scenarios) for test and DevOps scenarios.
23+
- Explain the [pre-requisites](#pre-requisites)
24+
- Explain [four ways of running the scripts](#four-ways-to-run-the-script):
25+
- [Interactively](#option-1-interactive) to create the app in your home tenant
26+
- [Passing credentials](#option-2-non-interactive) to create the app in your home tenant
27+
- [Interactively in a specific tenant](#option-3-interactive-but-create-apps-in-a-specified-tenant)
28+
- [Passing credentials in a specific tenant](#option-4-non-interactive-and-create-apps-in-a-specified-tenant)
29+
330
## Goal of the scripts
431

532
### Presentation of the scripts
@@ -26,21 +53,30 @@ The `Configure.ps1` will stop if it tries to create an Azure AD application whic
2653

2754
### Pre-requisites
2855

29-
To use the app creation scripts:
30-
3156
1. Open PowerShell (On Windows, press `Windows-R` and type `PowerShell` in the search window)
3257
2. Navigate to the root directory of the project.
33-
3. Until you change it, the default Execution Policy for scripts is usually `Restricted`. In order to run the PowerShell script you need to set the Execution Policy to `Unrestricted`. You can set this just for the current PowerShell process by running the command:
58+
3. Until you change it, the default [Execution Policy](https:/go.microsoft.com/fwlink/?LinkID=135170) for scripts is usually `Restricted`. In order to run the PowerShell script you need to set the Execution Policy to `RemoteSigned`. You can set this just for the current PowerShell process by running the command:
3459
```PowerShell
35-
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted
60+
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
3661
```
62+
### (Optionally) install AzureAD PowerShell modules
63+
The scripts install the required PowerShell module (AzureAD) for the current user if needed. However, if you want to install if for all users on the machine, you can follow the following steps:
64+
3765
4. If you have never done it already, in the PowerShell window, install the AzureAD PowerShell modules. For this:
3866
3967
1. Open PowerShell as admin (On Windows, Search Powershell in the search bar, right click on it and select Run as administrator).
4068
2. Type:
41-
```PowerShell
42-
Install-Module AzureAD
43-
```
69+
```PowerShell
70+
Install-Module AzureAD
71+
```
72+
73+
or if you cannot be administrator on your machine, run:
74+
```PowerShell
75+
Install-Module AzureAD -Scope CurrentUser
76+
```
77+
78+
### Run the script and start running
79+
4480
5. Go to the `AppCreationScripts` sub-folder. From the folder where you cloned the repo,
4581
```PowerShell
4682
cd AppCreationScripts
@@ -56,9 +92,9 @@ You're done. this just works!
5692
We advise four ways of running the script:
5793
5894
- Interactive: you will be prompted for credentials, and the scripts decide in which tenant to create the objects,
59-
- non-interactive: you will provide crendentials, and the scripts decide in which tenant to create the objects,
60-
- Interactive in specific tenant: you will be prompted for credentials, and the scripts decide in which tenant to create the objects,
61-
- non-interactive in specific tenant: you will provide crendentials, and the scripts decide in which tenant to create the objects.
95+
- non-interactive: you will provide credentials, and the scripts decide in which tenant to create the objects,
96+
- Interactive in specific tenant: you will provide the tenant in which you want to create the objects and then you will be prompted for credentials, and the scripts will create the objects,
97+
- non-interactive in specific tenant: you will provide tenant in which you want to create the objects and credentials, and the scripts will create the objects.
6298
6399
Here are the details on how to do this.
64100

‎AppCreationScripts/Cleanup.ps1‎

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
1-
param([Parameter(Mandatory=$false)][PSCredential]$Credential=$null, [Parameter(Mandatory=$false)][string]$TenantId)
1+
[CmdletBinding()]
2+
param(
3+
[PSCredential] $Credential,
4+
[Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
5+
[string] $tenantId
6+
)
7+
8+
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
9+
Install-Module "AzureAD" -Scope CurrentUser
10+
}
211
Import-Module AzureAD
312
$ErrorActionPreference = 'Stop'
413

@@ -8,15 +17,7 @@ Function Cleanup
817
.Description
918
This function removes the Azure AD applications for the sample. These applications were created by the Configure.ps1 script
1019
#>
11-
[CmdletBinding()]
12-
param(
13-
[Parameter(HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
14-
[PSCredential] $Credential,
15-
[string] $tenantId
16-
)
1720

18-
process
19-
{
2021
# $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
2122
# into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
2223

@@ -49,22 +50,25 @@ This function removes the Azure AD applications for the sample. These applicatio
4950
Write-Host "Cleaning-up applications from tenant '$tenantName'"
5051

5152
Write-Host "Removing 'service' (TodoListService-ManualJwt) if needed"
52-
$app=Get-AzureADApplication -Filter "identifierUris/any(uri:uri eq 'https://$tenantName/TodoListService-ManualJwt')"
53-
if ($app)
53+
Get-AzureADApplication -Filter "DisplayName eq 'TodoListService-ManualJwt'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
54+
$apps = Get-AzureADApplication -Filter "DisplayName eq 'TodoListService-ManualJwt'"
55+
if ($apps)
5456
{
55-
Remove-AzureADApplication -ObjectId $app.ObjectId
56-
Write-Host "Removed."
57+
Remove-AzureADApplication -ObjectId $apps.ObjectId
5758
}
59+
# Get-AzureRmADServicePrincipal -SearchString "TodoListService-ManualJwt" | ForEach-Object {Remove-AzureRmADServicePrincipal -ObjectId $_.Id -Confirm:$false}
60+
Write-Host "Removed TodoListService-ManualJwt."
5861

5962
Write-Host "Removing 'client' (TodoListClient-ManualJwt) if needed"
60-
$app=Get-AzureADApplication -Filter "DisplayName eq 'TodoListClient-ManualJwt'"
61-
if ($app)
63+
Get-AzureADApplication -Filter "DisplayName eq 'TodoListClient-ManualJwt'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
64+
$apps = Get-AzureADApplication -Filter "DisplayName eq 'TodoListClient-ManualJwt'"
65+
if ($apps)
6266
{
63-
Remove-AzureADApplication -ObjectId $app.ObjectId
64-
Write-Host "Removed."
67+
Remove-AzureADApplication -ObjectId $apps.ObjectId
6568
}
69+
# Get-AzureRmADServicePrincipal -SearchString "TodoListClient-ManualJwt" | ForEach-Object {Remove-AzureRmADServicePrincipal -ObjectId $_.Id -Confirm:$false}
70+
Write-Host "Removed TodoListClient-ManualJwt."
6671

67-
}
6872
}
6973

7074
Cleanup -Credential $Credential -tenantId $TenantId

‎AppCreationScripts/Configure.ps1‎

Lines changed: 54 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
[CmdletBinding()]
2-
param(
3-
[PSCredential] $Credential,
4-
[Parameter(HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
5-
[string] $tenantId
6-
)
2+
param(
3+
[PSCredential] $Credential,
4+
[Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
5+
[string] $tenantId
6+
)
77

88
<#
99
This script creates the Azure AD applications needed for this sample and updates the configuration files
@@ -15,10 +15,6 @@
1515
2) in the PowerShell window, type: Install-Module AzureAD
1616
1717
There are four ways to run this script. For more information, read the AppCreationScripts.md file in the same folder as this script.
18-
19-
# Parameters
20-
# $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
21-
# into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
2218
#>
2319

2420
# Adds the requiredAccesses (expressed as a pipe separated string) to the requiredAccess structure
@@ -66,7 +62,7 @@ Function GetRequiredPermissions([string] $applicationDisplayName, [string] $requ
6662
{
6763
AddResourcePermission $requiredAccess -exposedPermissions $sp.Oauth2Permissions -requiredAccesses $requiredDelegatedPermissions -permissionType "Scope"
6864
}
69-
65+
7066
# $sp.AppRoles | Select Id,AdminConsentDisplayName,Value: To see the list of all the Application permissions for the application
7167
if ($requiredApplicationPermissions)
7268
{
@@ -103,7 +99,10 @@ Function ConfigureApplications
10399
This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the
104100
configuration files in the client and service project of the visual studio solution (App.Config and Web.Config)
105101
so that they are consistent with the Applications parameters
106-
#>
102+
#>
103+
104+
# $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
105+
# into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
107106

108107
# Login to Azure PowerShell (interactive if credentials are not already provided:
109108
# you'll need to sign-in with creds enabling your to create apps in the tenant)
@@ -127,86 +126,99 @@ Function ConfigureApplications
127126
{
128127
$tenantId = $creds.Tenant.Id
129128
}
129+
130130
$tenant = Get-AzureADTenantDetail
131131
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
132132

133+
# Get the user running the script
134+
$user = Get-AzureADUser -ObjectId $creds.Account.Id
135+
133136
# Create the service AAD application
134-
Write-Host "Creating the AAD appplication (TodoListService-ManualJwt)"
137+
Write-Host "Creating the AAD application (TodoListService-ManualJwt)"
135138
$serviceAadApplication = New-AzureADApplication -DisplayName "TodoListService-ManualJwt" `
136139
-HomePage "https://localhost:44324" `
137-
-IdentifierUris "https://$tenantName/TodoListService-ManualJwt" `
138140
-PublicClient $False
139-
141+
$serviceIdentifierUri = 'api://'+$serviceAadApplication.AppId
142+
Set-AzureADApplication -ObjectId $serviceAadApplication.ObjectId -IdentifierUris $serviceIdentifierUri
140143

141144
$currentAppId = $serviceAadApplication.AppId
142145
$serviceServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
143146

144-
# add this user as app owner
145-
$user = Get-AzureADUser -ObjectId $creds.Account.Id
146-
Add-AzureADApplicationOwner -ObjectId $serviceAadApplication.ObjectId -RefObjectId $user.ObjectId
147-
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($serviceAadApplication.DisplayName)'"
147+
# add the user running the script as an app owner if needed
148+
$owner = Get-AzureADApplicationOwner -ObjectId $serviceAadApplication.ObjectId
149+
if ($owner -eq $null)
150+
{
151+
Add-AzureADApplicationOwner -ObjectId $serviceAadApplication.ObjectId -RefObjectId $user.ObjectId
152+
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($serviceServicePrincipal.DisplayName)'"
153+
}
148154

149-
Write-Host "Done."
155+
Write-Host "Done creating the service application (TodoListService-ManualJwt)"
150156

151157
# URL of the AAD application in the Azure portal
152-
$servicePortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_IAM/ApplicationBlade/appId/"+$serviceAadApplication.AppId+"/objectId/"+$serviceAadApplication.ObjectId
158+
# Future? $servicePortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Overview/appId/"+$serviceAadApplication.AppId+"/objectId/"+$serviceAadApplication.ObjectId+"/isMSAApp/"
159+
$servicePortalUrl = "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/"+$serviceAadApplication.AppId+"/objectId/"+$serviceAadApplication.ObjectId+"/isMSAApp/"
153160
Add-Content -Value "<tr><td>service</td><td>$currentAppId</td><td><a href='$servicePortalUrl'>TodoListService-ManualJwt</a></td></tr>" -Path createdApps.html
154161

155162
# Create the client AAD application
156-
Write-Host "Creating the AAD appplication (TodoListClient-ManualJwt)"
163+
Write-Host "Creating the AAD application (TodoListClient-ManualJwt)"
157164
$clientAadApplication = New-AzureADApplication -DisplayName "TodoListClient-ManualJwt" `
158-
-ReplyUrls "https://TodoListClient-ManualJwt" `
165+
-ReplyUrls "urn:ietf:wg:oauth:2.0:oob", "https://login.microsoftonline.com/common/oauth2/nativeclient" `
159166
-PublicClient $True
160167

161-
162168
$currentAppId = $clientAadApplication.AppId
163169
$clientServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
164170

165-
# add this user as app owner
166-
Add-AzureADApplicationOwner -ObjectId $clientAadApplication.ObjectId -RefObjectId $user.ObjectId
167-
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($clientServicePrincipal.DisplayName)'"
171+
# add the user running the script as an app owner if needed
172+
$owner = Get-AzureADApplicationOwner -ObjectId $clientAadApplication.ObjectId
173+
if ($owner -eq $null)
174+
{
175+
Add-AzureADApplicationOwner -ObjectId $clientAadApplication.ObjectId -RefObjectId $user.ObjectId
176+
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($clientServicePrincipal.DisplayName)'"
177+
}
168178

169-
Write-Host "Done."
179+
Write-Host "Done creating the client application (TodoListClient-ManualJwt)"
170180

171181
# URL of the AAD application in the Azure portal
172-
$clientPortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_IAM/ApplicationBlade/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId
182+
# Future? $clientPortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Overview/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId+"/isMSAApp/"
183+
$clientPortalUrl = "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId+"/isMSAApp/"
173184
Add-Content -Value "<tr><td>client</td><td>$currentAppId</td><td><a href='$clientPortalUrl'>TodoListClient-ManualJwt</a></td></tr>" -Path createdApps.html
174185

175186
$requiredResourcesAccess = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.RequiredResourceAccess]
187+
176188
# Add Required Resources Access (from 'client' to 'service')
177189
Write-Host "Getting access from 'client' to 'service'"
178190
$requiredPermissions = GetRequiredPermissions -applicationDisplayName "TodoListService-ManualJwt" `
179-
-requiredDelegatedPermissions "user_impersonation";
191+
-requiredDelegatedPermissions "user_impersonation" `
192+
180193
$requiredResourcesAccess.Add($requiredPermissions)
181-
Set-AzureADApplication -ObjectId $clientAadApplication.ObjectId -RequiredResourceAccess $requiredResourcesAccess
182-
Write-Host "Granted."
183194

184-
# Configure known client applications for service
185-
Write-Host "Configure known client applications for the 'service'"
186-
$knowApplications = New-Object System.Collections.Generic.List[System.String]
187-
$knowApplications.Add($clientAadApplication.AppId)
188-
Set-AzureADApplication -ObjectId $serviceAadApplication.ObjectId -KnownClientApplications $knowApplications
189-
Write-Host "Configured."
195+
196+
Set-AzureADApplication -ObjectId $clientAadApplication.ObjectId -RequiredResourceAccess $requiredResourcesAccess
197+
Write-Host "Granted permissions."
190198

191199
# Update config file for 'service'
192200
$configFile = $pwd.Path + "\..\TodoListService-ManualJwt\Web.Config"
193201
Write-Host "Updating the sample code ($configFile)"
194202
ReplaceSetting -configFilePath $configFile -key "ida:Tenant" -newValue $tenantName
195-
ReplaceSetting -configFilePath $configFile -key "ida:Audience" -newValue $serviceAadApplication.IdentifierUris
203+
ReplaceSetting -configFilePath $configFile -key "ida:Audience" -newValue $serviceIdentifierUri
196204
ReplaceSetting -configFilePath $configFile -key "ida:ClientId" -newValue $serviceAadApplication.AppId
197205

198206
# Update config file for 'client'
199207
$configFile = $pwd.Path + "\..\TodoListClient\App.Config"
200208
Write-Host "Updating the sample code ($configFile)"
201209
ReplaceSetting -configFilePath $configFile -key "ida:Tenant" -newValue $tenantName
202210
ReplaceSetting -configFilePath $configFile -key "ida:ClientId" -newValue $clientAadApplication.AppId
203-
ReplaceSetting -configFilePath $configFile -key "ida:RedirectUri" -newValue $clientAadApplication.ReplyUrls
204-
ReplaceSetting -configFilePath $configFile -key "todo:TodoListResourceId" -newValue $serviceAadApplication.IdentifierUris
211+
ReplaceSetting -configFilePath $configFile -key "todo:TodoListResourceId" -newValue $serviceIdentifierUri
205212
ReplaceSetting -configFilePath $configFile -key "todo:TodoListBaseAddress" -newValue $serviceAadApplication.HomePage
206-
Add-Content -Value "</tbody></table></body></html>" -Path createdApps.html
207-
213+
214+
Add-Content -Value "</tbody></table></body></html>" -Path createdApps.html
208215
}
209216

217+
# Pre-requisites
218+
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
219+
Install-Module "AzureAD" -Scope CurrentUser
220+
}
221+
Import-Module AzureAD
210222

211223
# Run interactively (will ask you for the tenant ID)
212224
ConfigureApplications -Credential $Credential -tenantId $TenantId

0 commit comments

Comments
 (0)