You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Manually validating a JWT access token in a web API
13
+
# Token Validation
14
+
A token represent the outcome of an authentication operation with some artifact that can be unambiguously tied to the Identity Provider that performed the authentication, without relying on any special network infrastructure.
9
15
10
-
This sample demonstrates how to manually process a JWT access token in a web API using the JSON Web Token Handler For the Microsoft .Net Framework 4.5. This sample is equivalent to the NativeClient-DotNet sample, except in the TodoListService instead of using OWIN middleware to process the token, the token is processed manually in application code. The client is unchanged from the NativeClient-DotNet sample.
16
+
With Azure Active Directory taking the full responsibility of verifying user's raw credentials, the token receiver's responsibility shifts from verifying raw credentials to verifying that their caller did indeed go through your identity provider of choice and successfully authenticated. The identity provider represents successful authentication operations by issuing a token, hence the job now becomes to validate that token.
17
+
18
+
# Validate the claims
19
+
When an application receives an ID token upon user sign-in, it should also perform a few checks against the claims in the ID token. These include but are not limited to:
20
+
-**audience** claim, to verify that the ID token was intended to be given to your application
21
+
-**not before** and "expiration time" claims, to verify that the ID token has not expired
22
+
-**issuer** claim, to verify that the token was issued to your app by the v2.0 endpoint
23
+
-**nonce**, as a token replay attack mitigation
24
+
25
+
Though developers are advised to use standard library methods like [JwtSecurityTokenHandler.ValidateToken Method (JwtSecurityToken)](https://msdn.microsoft.com/en-us/library/dn451163(v=vs.114).aspx) to do most of the aforementioned heavy lifting. Developers can further extend the validation process by making decisions based on claims recieved in the token. For example, multi-tenant applications can extend the standard validation by inspecting value of the "tid" claim against a set of pre-selected tenants to ensure they only honor token from tenants of their choice. Details on the claims provided in JWT tokens is listed in the [Azure AD token reference](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and-claims).
26
+
27
+
## About this sample
28
+
This sample demonstrates how to manually process a JWT access token in a web API using the JSON Web Token Handler For the Microsoft .Net Framework 4.5. This sample is equivalent to the [NativeClient-DotNet](https://github.com/Azure-Samples/active-directory-dotnet-native-desktop) sample, except in the TodoListService instead of using OWIN middleware to process the token, the token is processed manually in application code. The client is unchanged from the [NativeClient-DotNet](https://github.com/Azure-Samples/active-directory-dotnet-native-desktop) sample.
11
29
12
30
The manual JWT validation occurs in the `TokenValidationHandler` implementation in the `Global.aspx.cs` file in the TodoListService-ManualJwt project.
31
+
### More information
13
32
14
33
For more information about how the protocols work in this scenario and other scenarios, see [Authentication Scenarios for Azure AD](http://go.microsoft.com/fwlink/?LinkId=394414).
15
34
16
35
> Looking for previous versions of this code sample? Check out the tags on the [releases](../../releases) GitHub page.
17
36
18
37
## How To Run This Sample
19
38
39
+
>[!Note] If you want to run this sample on **Azure Government**, navigate to the "Azure Government Deviations" section at the bottom of this page.
40
+
>
41
+
>
42
+
>
43
+
20
44
To run this sample you will need:
21
-
- Visual Studio 2017
45
+
-[Visual Studio 2017](https://aka.ms/vsdownload)
22
46
- An Internet connection
23
47
- An Azure Active Directory (Azure AD) tenant. For more information on how to get an Azure AD tenant, please see [How to get an Azure AD tenant](https://azure.microsoft.com/en-us/documentation/articles/active-directory-howto-tenant/)
24
-
- A user account in your Azure AD tenant. This sample will not work with a Microsoft account, so if you signed in to the Azure portal with a Microsoft account and have never created a user account in your directory before, you need to do that now.
48
+
- A user account in your Azure AD tenant. This sample will not work with a Microsoft account, so if you signed in to the Azure portal with a Microsoft account and have never created a user account in your directory before, you need to do that now. This sample will not work with a Microsoft account (formerly Windows Live account).
25
49
26
50
### Step 1: Clone or download this repository
27
51
@@ -30,29 +54,33 @@ From your shell or command line:
### Step 2: Register the sample with your Azure Active Directory tenant
57
+
There are two options:
58
+
- Option 1: you run the `Configure.ps1` PowerShell script which creates two applications in the Azure Active Directory, (one for the client and one for the service), and then updates the configuration files in the Visual Studio projects to point to those two newly created apps.
59
+
- Option 2: you do the same manually.
33
60
34
61
There are two projects in this sample. Each needs to be separately registered in your Azure AD tenant.
35
62
36
63
#### Register the TodoListService-ManualJwt web API
37
64
38
65
1. Sign in to the [Azure portal](https://portal.azure.com).
39
66
2. On the top bar, click on your account and under the **Directory** list, choose the Active Directory tenant where you wish to register your application.
40
-
3. Click on **More Services** in the left hand nav, and choose **Azure Active Directory**.
41
-
4. Click on **App registrations** and choose **Add**.
42
-
5. Enter a friendly name for the application, for example 'TodoListService-ManualJwt' and select 'Web Application and/or Web API' as the Application Type. For the sign-on URL, enter the base URL for the sample, which is by default `https://localhost:44324`. For the App ID URI, enter `https://<your_tenant_name>/TodoListService-ManualJwt`, replacing `<your_tenant_name>` with the name of your Azure AD tenant. Click OK to complete the registration. Click on **Create** to create the application.
43
-
6. While still in the Azure portal, choose your application, click on **Settings** and choose **Properties**.
44
-
7. Find the Application ID value and copy it to the clipboard.
67
+
3. Click on **All Services** in the left hand nav, and choose **Azure Active Directory**.
68
+
4. Click on **App registrations** and choose **New application registration**.
69
+
5. Enter a friendly name for the application, for example 'TodoListService-ManualJwt' and select 'Web app / API' as the Application type. For the Sign-on URL, enter the base URL for the sample, which is by default `https://localhost:44324`. Click on **Create** to create the application.
70
+
6. In the succeeding page, Find the **Application ID** value and copy it to the clipboard.
71
+
7. Then click on **Settings** and choose **Properties**.
72
+
8. For the App ID URI, update the existing value https://\<your_tenant_name\>/TodoListService-ManualJwt by replacing \<your_tenant_name\> with the name of your Azure AD tenant.
45
73
46
74
#### Register the TodoListClient app
47
75
48
76
1. Sign in to the [Azure portal](https://portal.azure.com).
49
77
2. On the top bar, click on your account and under the **Directory** list, choose the Active Directory tenant where you wish to register your application.
50
-
3. Click on **More Services** in the left hand nav, and choose **Azure Active Directory**.
51
-
4. Click on **App registrations** and choose **Add**.
52
-
5. Enter a friendly name for the application, for example 'TodoListClient-DotNet' and select 'Native' as the Application Type. For the redirect URI, enter `https://TodoListClient`. Click on **Create** to create the application.
53
-
6.While still in the Azure portal, choose your application, click on **Settings** and choose **Properties**.
54
-
7.Find the Application ID value and copy it to the clipboard.
55
-
8. Configure Permissions for your application - in the Settings menu, choose the 'Required permissions' section, click on **Add**, then **Select an API**, and type 'TodoListService' in the textbox. Then, click on **Select Permissions** and select 'Access TodoListService'.
78
+
3. Click on **All Services** in the left hand nav, and choose **Azure Active Directory**.
79
+
4. Click on **App registrations** and choose **New application registration**.
80
+
5. Enter a friendly name for the application, for example 'TodoListClient-DotNet' and select 'Native' as the Application Type. For the redirect URI, enter `https://TodoListClient`. Please note that the Redirect URI will not be used in this sample, but it needs to be defined nonetheless. Click on **Create** to create the application.
81
+
6.In the succeeding page, Find the **Application ID**value and copy it to the clipboard.
82
+
7.Then click on **Settings**and choose **Properties**.
83
+
8. Configure Permissions for your application - in the Settings menu, choose the **Required permissions** section, click on **Add**, then **Select an API**, and type 'TodoListService' in the textbox and hit enter. Select 'TodoListService-ManualJwt' from the results and click the 'Select' button. Then, click on **Select Permissions** and select 'Access TodoListService-ManualJwt'. Click the 'Select' button again to close this screen. Click on **Done** to finish adding the permission.
56
84
57
85
### Step 3: Configure the sample to use your Azure AD tenant
58
86
@@ -84,12 +112,12 @@ The manual JWT validation occurs in the [TokenValidationHandler](https://github.
84
112
85
113
## How To Recreate This Sample
86
114
87
-
First, in Visual Studio 2017 create an empty solution to host the projects. Then, follow these steps to create each project.
115
+
First, in Visual Studio 2017 create an empty solution to host the projects. Then, follow these steps to create each project.
88
116
89
117
### Creating the TodoListService-ManualJwt Project
90
118
91
-
1. In the solution, create a new ASP.Net MVC web API project called TodoListService-ManualJwt and while creating the project, ensure Authentication is set to No Authentication.
92
-
2. Set SSL Enabled to be True. Note the SSL URL.
119
+
1. In Visual Studio , create a new `Visual C#``ASP.NET Web Application (.NET Framework)`. Choose `Web Api` in the next screen. Leave the project's chosen authentication mode as the default, i.e. `No Authentication`".
120
+
2. Set SSL Enabled to be True. Note the SSL URL.
93
121
3. In the project properties, Web properties, set the Project Url to be the SSL URL.
94
122
4. Add the latest stable JSON Web Token Handler For the Microsoft .Net Framework 4.5 NuGet, System.IdentityModel.Tokens.Jwt, version 4.x to the project. Note: Version 5.x will not work with this sample, as it requires .Net Framework 5.x.
95
123
5. Add an assembly reference to `System.IdentityModel`.
@@ -101,8 +129,8 @@ First, in Visual Studio 2017 create an empty solution to host the projects. Th
101
129
102
130
### Creating the TodoListClient Project
103
131
104
-
1. In the solution, create a new Windows --> WPF Application called TodoListClient.
105
-
2. Add the (stable) Active Directory Authentication Library (ADAL) NuGet, Microsoft.IdentityModel.Clients.ActiveDirectory, version 1.0.3 (or higher) to the project.
132
+
1. In the solution, create a new Windows --> Windows Classic Desktop -> WPF App(.NET Framework) called TodoListClient.
133
+
2. Add the (stable) Active Directory Authentication Library (ADAL) NuGet, `Microsoft.IdentityModel.Clients.ActiveDirectory`, version 1.0.3 (or higher) to the project.
106
134
3. Add assembly references to `System.Net.Http`, `System.Web.Extensions`, and `System.Configuration`.
107
135
4. Add a new class to the project called `TodoItem.cs`. Copy the code from the sample project file of same name into this class, completely replacing the code in the file in the new project.
108
136
5. Add a new class to the project called `CacheHelper.cs`. Copy the code from the sample project file of same name into this class, completely replacing the code in the file in the new project.
@@ -112,3 +140,20 @@ First, in Visual Studio 2017 create an empty solution to host the projects. Th
112
140
9. In `app.config` create keys for `ida:AADInstance`, `ida:Tenant`, `ida:ClientId`, `ida:RedirectUri`, `todo:TodoListResourceId`, and `todo:TodoListBaseAddress` and set them accordingly. For the public Azure cloud, the value of `ida:AADInstance` is `https://login.microsoftonline.com/{0}`.
113
141
114
142
Finally, in the properties of the solution itself, set both projects as startup projects.
143
+
144
+
## Azure Government Deviations
145
+
In order to run this sample on Azure Government you can follow through the steps above with a few variations:
146
+
147
+
- Step 2:
148
+
- You must register this sample for your AAD Tenant in Azure Government by following Step 2 above in the [Azure Government portal](https://portal.azure.us).
149
+
- Step 3:
150
+
- Before configuring the sample, you must make sure your [Visual Studio is connected to Azure Government](https://docs.microsoft.com/azure/azure-government/documentation-government-get-started-connect-with-vs).
151
+
- Navigate to the Web.config file. Replace the `ida:AADInstance` property in the Azure AD section with `https://login.microsoftonline.us/`.
152
+
153
+
Once those changes have been accounted for, you should be able to run this sample on Azure Government.
154
+
155
+
## More information
156
+
For more information see ADAL.NET's conceptual documentation:
157
+
-[Recommanded pattern to acquire a token](https://github.com/AzureAD/azure-activedirectory-library-for-dotnet/wiki/AcquireTokenSilentAsync-using-a-cached-token#recommended-pattern-to-acquire-a-token)
0 commit comments