Skip to content

Commit 31bf1ae

Browse files
author
Tiago Brenck
authored
Merge pull request #126 from Azure-Samples/tibre/112
Fixed MSA sample
2 parents bd5bd59 + 3dfea34 commit 31bf1ae

File tree

7 files changed

+99
-192
lines changed

7 files changed

+99
-192
lines changed

‎3.-Web-api-call-Microsoft-graph-for-personal-accounts/AppCreationScripts/AppCreationScripts.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Registering the sample apps with Microsoft Identity Platform and updating the configuration files using PowerShell scripts
1+
# Registering the sample apps with Microsoft identity platform and updating the configuration files using PowerShell scripts
22

33
## Overview
44

@@ -11,7 +11,8 @@
1111
```
1212
1. Run the script to create your Azure AD application and configure the code of the sample application accordingly. (Other ways of running the scripts are described below)
1313
```PowerShell
14-
.\AppCreationScripts\Configure.ps1
14+
cd .\AppCreationScripts\
15+
.\Configure.ps1
1516
```
1617
1. Open the Visual Studio solution and click start
1718

‎3.-Web-api-call-Microsoft-graph-for-personal-accounts/AppCreationScripts/Cleanup.ps1‎

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,9 @@ This function removes the Azure AD applications for the sample. These applicatio
4949
# Removes the applications
5050
Write-Host "Cleaning-up applications from tenant '$tenantName'"
5151

52-
Write-Host "Removing 'service' (TodoListService (active-directory-dotnet-native-aspnetcore-v2)) if needed"
53-
Get-AzureADApplication -Filter "DisplayName eq 'TodoListService (active-directory-dotnet-native-aspnetcore-v2)'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
54-
$apps = Get-AzureADApplication -Filter "DisplayName eq 'TodoListService (active-directory-dotnet-native-aspnetcore-v2)'"
52+
Write-Host "Removing 'service' (TodoListClient-and-Service) if needed"
53+
Get-AzureADApplication -Filter "DisplayName eq 'TodoListClient-and-Service'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
54+
$apps = Get-AzureADApplication -Filter "DisplayName eq 'TodoListClient-and-Service'"
5555
if ($apps)
5656
{
5757
Remove-AzureADApplication -ObjectId $apps.ObjectId
@@ -60,26 +60,10 @@ This function removes the Azure AD applications for the sample. These applicatio
6060
foreach ($app in $apps)
6161
{
6262
Remove-AzureADApplication -ObjectId $app.ObjectId
63-
Write-Host "Removed TodoListService (active-directory-dotnet-native-aspnetcore-v2).."
63+
Write-Host "Removed TodoListClient-and-Service.."
6464
}
6565
# also remove service principals of this app
66-
Get-AzureADServicePrincipal -filter "DisplayName eq 'TodoListService (active-directory-dotnet-native-aspnetcore-v2)'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
67-
68-
Write-Host "Removing 'client' (TodoListClient (active-directory-dotnet-native-aspnetcore-v2)) if needed"
69-
Get-AzureADApplication -Filter "DisplayName eq 'TodoListClient (active-directory-dotnet-native-aspnetcore-v2)'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
70-
$apps = Get-AzureADApplication -Filter "DisplayName eq 'TodoListClient (active-directory-dotnet-native-aspnetcore-v2)'"
71-
if ($apps)
72-
{
73-
Remove-AzureADApplication -ObjectId $apps.ObjectId
74-
}
75-
76-
foreach ($app in $apps)
77-
{
78-
Remove-AzureADApplication -ObjectId $app.ObjectId
79-
Write-Host "Removed TodoListClient (active-directory-dotnet-native-aspnetcore-v2).."
80-
}
81-
# also remove service principals of this app
82-
Get-AzureADServicePrincipal -filter "DisplayName eq 'TodoListClient (active-directory-dotnet-native-aspnetcore-v2)'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
66+
Get-AzureADServicePrincipal -filter "DisplayName eq 'TodoListClient-and-Service'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
8367

8468
}
8569

‎3.-Web-api-call-Microsoft-graph-for-personal-accounts/AppCreationScripts/Configure.ps1‎

Lines changed: 19 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -235,14 +235,14 @@ Function ConfigureApplications
235235
$user = Get-AzureADUser -ObjectId $creds.Account.Id
236236

237237
# Create the service AAD application
238-
Write-Host "Creating the AAD application (TodoListService (active-directory-dotnet-native-aspnetcore-v2))"
238+
Write-Host "Creating the AAD application (TodoListClient-and-Service)"
239239
# Get a 2 years application key for the service Application
240240
$pw = ComputePassword
241241
$fromDate = [DateTime]::Now;
242242
$key = CreateAppKey -fromDate $fromDate -durationInYears 2 -pw $pw
243243
$serviceAppKey = $pw
244244
# create the application
245-
$serviceAadApplication = New-AzureADApplication -DisplayName "TodoListService (active-directory-dotnet-native-aspnetcore-v2)" `
245+
$serviceAadApplication = New-AzureADApplication -DisplayName "TodoListClient-and-Service" `
246246
-HomePage "https://localhost:44351/" `
247247
-AvailableToOtherTenants $True `
248248
-PasswordCredentials $key `
@@ -280,9 +280,9 @@ Function ConfigureApplications
280280
{
281281
# Add scope
282282
$scope = CreateScope -value "access_as_user" `
283-
-userConsentDisplayName "Access TodoListService (active-directory-dotnet-native-aspnetcore-v2)" `
284-
-userConsentDescription "Allow the application to access TodoListService (active-directory-dotnet-native-aspnetcore-v2) on your behalf." `
285-
-adminConsentDisplayName "Access TodoListService (active-directory-dotnet-native-aspnetcore-v2)" `
283+
-userConsentDisplayName "Access TodoListClient-and-Service" `
284+
-userConsentDescription "Allow the application to access TodoListClient-and-Service on your behalf." `
285+
-adminConsentDisplayName "Access TodoListClient-and-Service" `
286286
-adminConsentDescription "Allows the app to have the same access to information in the directory on behalf of the signed-in user."
287287

288288
$scopes.Add($scope)
@@ -292,12 +292,12 @@ Function ConfigureApplications
292292
# add/update scopes
293293
Set-AzureADApplication -ObjectId $serviceAadApplication.ObjectId -OAuth2Permission $scopes
294294

295-
Write-Host "Done creating the service application (TodoListService (active-directory-dotnet-native-aspnetcore-v2))"
295+
Write-Host "Done creating the service application (TodoListClient-and-Service)"
296296

297297
# URL of the AAD application in the Azure portal
298298
# Future? $servicePortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Overview/appId/"+$serviceAadApplication.AppId+"/objectId/"+$serviceAadApplication.ObjectId+"/isMSAApp/"
299299
$servicePortalUrl = "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/"+$serviceAadApplication.AppId+"/objectId/"+$serviceAadApplication.ObjectId+"/isMSAApp/"
300-
Add-Content -Value "<tr><td>service</td><td>$currentAppId</td><td><a href='$servicePortalUrl'>TodoListService (active-directory-dotnet-native-aspnetcore-v2)</a></td></tr>" -Path createdApps.html
300+
Add-Content -Value "<tr><td>service</td><td>$currentAppId</td><td><a href='$servicePortalUrl'>TodoListClient-and-Service</a></td></tr>" -Path createdApps.html
301301

302302
$requiredResourcesAccess = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.RequiredResourceAccess]
303303

@@ -308,81 +308,47 @@ Function ConfigureApplications
308308

309309
$requiredResourcesAccess.Add($requiredPermissions)
310310

311-
312-
Set-AzureADApplication -ObjectId $serviceAadApplication.ObjectId -RequiredResourceAccess $requiredResourcesAccess
313-
Write-Host "Granted permissions."
314-
315-
# Create the client AAD application
316-
Write-Host "Creating the AAD application (TodoListClient (active-directory-dotnet-native-aspnetcore-v2))"
317-
# create the application
318-
$clientAadApplication = New-AzureADApplication -DisplayName "TodoListClient (active-directory-dotnet-native-aspnetcore-v2)" `
319-
-ReplyUrls "https://login.microsoftonline.com/common/oauth2/nativeclient" `
320-
-AvailableToOtherTenants $True `
321-
-PublicClient $True
322-
323-
# create the service principal of the newly created application
324-
$currentAppId = $clientAadApplication.AppId
325-
$clientServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
326-
327-
# add the user running the script as an app owner if needed
328-
$owner = Get-AzureADApplicationOwner -ObjectId $clientAadApplication.ObjectId
329-
if ($owner -eq $null)
330-
{
331-
Add-AzureADApplicationOwner -ObjectId $clientAadApplication.ObjectId -RefObjectId $user.ObjectId
332-
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($clientServicePrincipal.DisplayName)'"
333-
}
334-
335-
336-
Write-Host "Done creating the client application (TodoListClient (active-directory-dotnet-native-aspnetcore-v2))"
337-
338-
# URL of the AAD application in the Azure portal
339-
# Future? $clientPortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Overview/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId+"/isMSAApp/"
340-
$clientPortalUrl = "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId+"/isMSAApp/"
341-
Add-Content -Value "<tr><td>client</td><td>$currentAppId</td><td><a href='$clientPortalUrl'>TodoListClient (active-directory-dotnet-native-aspnetcore-v2)</a></td></tr>" -Path createdApps.html
342-
343-
$requiredResourcesAccess = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.RequiredResourceAccess]
344-
345-
# Add Required Resources Access (from 'client' to 'service')
346-
Write-Host "Getting access from 'client' to 'service'"
347-
$requiredPermissions = GetRequiredPermissions -applicationDisplayName "TodoListService (active-directory-dotnet-native-aspnetcore-v2)" `
311+
# Add Required Resources Access (from 'service' to 'service')
312+
Write-Host "Getting access from 'service' to 'service'"
313+
$requiredPermissions = GetRequiredPermissions -applicationDisplayName "TodoListClient-and-Service" `
348314
-requiredDelegatedPermissions "access_as_user" `
349315

350316
$requiredResourcesAccess.Add($requiredPermissions)
351317

352318

353-
Set-AzureADApplication -ObjectId $clientAadApplication.ObjectId -RequiredResourceAccess $requiredResourcesAccess
319+
Set-AzureADApplication -ObjectId $serviceAadApplication.ObjectId -RequiredResourceAccess $requiredResourcesAccess
354320
Write-Host "Granted permissions."
355321

356322
# Configure known client applications for service
357323
Write-Host "Configure known client applications for the 'service'"
358324
$knowApplications = New-Object System.Collections.Generic.List[System.String]
359-
$knowApplications.Add($clientAadApplication.AppId)
325+
$knowApplications.Add($serviceAadApplication.AppId)
360326
Set-AzureADApplication -ObjectId $serviceAadApplication.ObjectId -KnownClientApplications $knowApplications
361327
Write-Host "Configured."
362328

363329

364330
# Update config file for 'service'
365331
$configFile = $pwd.Path + "\..\TodoListService\appsettings.json"
366332
Write-Host "Updating the sample code ($configFile)"
367-
$dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $serviceAadApplication.AppId;"ClientSecret" = $serviceAppKey };
333+
$dictionary = @{ "Domain" = $tenantName;"ClientId" = $serviceAadApplication.AppId;"ClientSecret" = $serviceAppKey };
368334
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
369335

370336
# Update config file for 'client'
371337
$configFile = $pwd.Path + "\..\TodoListClient\App.Config"
372338
Write-Host "Updating the sample code ($configFile)"
373-
ReplaceSetting -configFilePath $configFile -key "ida:ClientId" -newValue $clientAadApplication.AppId
374-
ReplaceSetting -configFilePath $configFile -key "todo:TodoListScope" -newValue ("api://"+$serviceAadApplication.AppId+"/access_as_user")
375-
ReplaceSetting -configFilePath $configFile -key "todo:TodoListBaseAddress" -newValue $serviceAadApplication.HomePage
339+
ReplaceSetting -configFilePath $configFile -key "ida:ClientId" -newValue ($serviceAadApplication.AppId)
340+
ReplaceSetting -configFilePath $configFile -key "todo:TodoListScope" -newValue ('https://'+$tenantName+"/TodoListClient-and-Service/access_as_user")
341+
ReplaceSetting -configFilePath $configFile -key "todo:TodoListBaseAddress" -newValue ($serviceAadApplication.HomePage)
376342
Write-Host ""
377343
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
378344
Write-Host "IMPORTANT: Please follow the instructions below to complete a few manual step(s) in the Azure portal":
379345
Write-Host "- For 'service'"
380346
Write-Host " - Navigate to '$servicePortalUrl'"
347+
Write-Host " - Navigate to the Authentication blade, click 'Add a platform' then check the option https://login.microsoftonline.com/common/oauth2/nativeclient" -ForegroundColor Red
348+
Write-Host " - Navigate to the Expose an API blade and change the Application ID URI to use the https pattern. i.e. https://<tenant_domain>/<app_name>" -ForegroundColor Red
381349
Write-Host " - Navigate to the Manifest page and change 'signInAudience' to 'AzureADandPersonalMicrosoftAccount'." -ForegroundColor Red
350+
Write-Host " - Navigate to the Manifest page and change 'accessTokenAcceptedVersion' to 2." -ForegroundColor Red
382351
Write-Host " - [Optional] If you are a tenant admin, you can navigate to the API Permisions page and select 'Grant admin consent for (your tenant)'" -ForegroundColor Red
383-
Write-Host "- For 'client'"
384-
Write-Host " - Navigate to '$clientPortalUrl'"
385-
Write-Host " - Navigate to the Manifest page and change 'signInAudience' to 'AzureADandPersonalMicrosoftAccount'." -ForegroundColor Red
386352

387353
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
388354

‎3.-Web-api-call-Microsoft-graph-for-personal-accounts/AppCreationScripts/sample.json‎

Lines changed: 17 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -14,39 +14,35 @@
1414
"AADApps": [
1515
{
1616
"Id": "service",
17-
"Name": "TodoListService (active-directory-dotnet-native-aspnetcore-v2)",
17+
"Name": "TodoListClient-and-Service",
1818
"Kind": "WebApi",
1919
"HomePage": "https://localhost:44351/",
2020
"PasswordCredentials": "Auto",
2121
"RequiredResourcesAccess": [
2222
{
2323
"Resource": "Microsoft Graph",
2424
"DelegatedPermissions": [ "User.Read" ]
25-
}
25+
},
26+
{
27+
"Resource": "service",
28+
"DelegatedPermissions": [ "access_as_user" ]
29+
}
2630
],
2731
"ManualSteps": [
2832
{
29-
"Comment": "Navigate to the Manifest page and change 'signInAudience' to 'AzureADandPersonalMicrosoftAccount'."
33+
"Comment": "Navigate to the Authentication blade, click 'Add a platform' then check the option https://login.microsoftonline.com/common/oauth2/nativeclient"
3034
},
3135
{
32-
"Comment": "[Optional] If you are a tenant admin, you can navigate to the API Permisions page and select 'Grant admin consent for (your tenant)'"
33-
}
34-
]
35-
},
36-
{
37-
"Id": "client",
38-
"Name": "TodoListClient (active-directory-dotnet-native-aspnetcore-v2)",
39-
"Kind": "Desktop",
40-
"ReplyUrls": "https://login.microsoftonline.com/common/oauth2/nativeclient",
41-
"RequiredResourcesAccess": [
42-
{
43-
"Resource": "service",
44-
"DelegatedPermissions": [ "access_as_user" ]
45-
}
46-
],
47-
"ManualSteps": [
36+
"Comment": "Navigate to the Expose an API blade and change the Application ID URI to use the https pattern. i.e. https://<tenant_domain>/<app_name>"
37+
},
4838
{
4939
"Comment": "Navigate to the Manifest page and change 'signInAudience' to 'AzureADandPersonalMicrosoftAccount'."
40+
},
41+
{
42+
"Comment": "Navigate to the Manifest page and change 'accessTokenAcceptedVersion' to 2."
43+
},
44+
{
45+
"Comment": "[Optional] If you are a tenant admin, you can navigate to the API Permisions page and select 'Grant admin consent for (your tenant)'"
5046
}
5147
]
5248
}
@@ -68,10 +64,6 @@
6864
"key": "Domain",
6965
"value": "$tenantName"
7066
},
71-
{
72-
"key": "TenantId",
73-
"value": "$tenantId"
74-
},
7567
{
7668
"key": "ClientId",
7769
"value": "service.AppId"
@@ -88,17 +80,13 @@
8880
"SettingKind": "XML",
8981
"SettingFile": "\\..\\TodoListClient\\App.Config",
9082
"Mappings": [
91-
//{
92-
// "key": "ida:Tenant",
93-
// "value": "$tenantName"
94-
//},
9583
{
9684
"key": "ida:ClientId",
97-
"value": ".AppId"
85+
"value": "service.AppId"
9886
},
9987
{
10088
"key": "todo:TodoListScope",
101-
"value": "service.Scope"
89+
"value": "'https://'+$tenantName+\"/TodoListClient-and-Service/access_as_user\""
10290
},
10391
{
10492
"key": "todo:TodoListBaseAddress",

0 commit comments

Comments
 (0)