diff --git a/1-Authentication/7-sign-in-express-mfa/.vscode/extensions.json b/1-Authentication/7-sign-in-express-mfa/.vscode/extensions.json new file mode 100644 index 000000000..ffb3679d8 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/.vscode/extensions.json @@ -0,0 +1,6 @@ +{ + // See http://go.microsoft.com/fwlink/?LinkId=827846 + // for the documentation about the extensions.json format + "recommendations": ["ms-azuretools.ms-entra"] + } + \ No newline at end of file diff --git a/1-Authentication/7-sign-in-express-mfa/App/app.js b/1-Authentication/7-sign-in-express-mfa/App/app.js new file mode 100644 index 000000000..3a50080b2 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/app.js @@ -0,0 +1,68 @@ +/* + * Copyright (c) Microsoft Corporation. All rights reserved. + * Licensed under the MIT License. + */ + +require('dotenv').config(); + +var path = require('path'); +var express = require('express'); +var session = require('express-session'); +var createError = require('http-errors'); +var cookieParser = require('cookie-parser'); +var logger = require('morgan'); + +var indexRouter = require('./routes/index'); +var usersRouter = require('./routes/users'); +var authRouter = require('./routes/auth'); + +// initialize express +var app = express(); + +/** + * Using express-session middleware for persistent user session. Be sure to + * familiarize yourself with available options. Visit: https://www.npmjs.com/package/express-session + */ +app.use( + session({ + secret: process.env.EXPRESS_SESSION_SECRET || 'Enter_the_Express_Session_Secret_Here', + resave: false, + saveUninitialized: false, + cookie: { + httpOnly: true, + secure: false, // set this to true on production + }, + }) +); + +// view engine setup +app.set('views', path.join(__dirname, 'views')); +app.set('view engine', 'hbs'); + +app.use(logger('dev')); +app.use(express.json()); +app.use(cookieParser()); +app.use(express.urlencoded({ extended: false })); +app.use(express.static(path.join(__dirname, 'public'))); + +app.use('/', indexRouter); +app.use('/users', usersRouter); +app.use('/auth', authRouter); + +// catch 404 and forward to error handler +app.use(function (req, res, next) { + next(createError(404)); +}); + +// error handler +app.use(function (err, req, res, next) { + // set locals, only providing error in development + res.locals.message = err.message; + res.locals.error = req.app.get('env') === 'development' ? err : {}; + + // render the error page + res.status(err.status || 500); + res.render('error'); +}); + +module.exports = app; diff --git a/1-Authentication/7-sign-in-express-mfa/App/auth/AuthProvider.js b/1-Authentication/7-sign-in-express-mfa/App/auth/AuthProvider.js new file mode 100644 index 000000000..e90fb6b1a --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/auth/AuthProvider.js @@ -0,0 +1,246 @@ +const msal = require('@azure/msal-node'); +const axios = require('axios'); +const { msalConfig, TENANT_SUBDOMAIN, REDIRECT_URI, POST_LOGOUT_REDIRECT_URI } = require('../authConfig'); + +class AuthProvider { + config; + cryptoProvider; + + constructor(config) { + this.config = config; + this.cryptoProvider = new msal.CryptoProvider(); + } + + getMsalInstance(msalConfig) { + return new msal.ConfidentialClientApplication(msalConfig); + } + + async login(req, res, next, options = {}) { + // create a GUID for crsf + req.session.csrfToken = this.cryptoProvider.createNewGuid(); + + /** + * The MSAL Node library allows you to pass your custom state as state parameter in the Request object. + * The state parameter can also be used to encode information of the app's state before redirect. + * You can pass the user's state in the app, such as the page or view they were on, as input to this parameter. + */ + const state = this.cryptoProvider.base64Encode( + JSON.stringify({ + csrfToken: req.session.csrfToken, + redirectTo: '/', + }) + ); + + const authCodeUrlRequestParams = { + state: state, + + /** + * By default, MSAL Node will add OIDC scopes to the auth code url request. For more information, visit: + * https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent#openid-connect-scopes + */ + scopes: options.scopes ?? [], + }; + + const authCodeRequestParams = { + state: state, + + /** + * By default, MSAL Node will add OIDC scopes to the auth code request. For more information, visit: + * https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent#openid-connect-scopes + */ + scopes: options.scopes ?? [], + }; + + /** + * If the current msal configuration does not have cloudDiscoveryMetadata or authorityMetadata, we will + * make a request to the relevant endpoints to retrieve the metadata. This allows MSAL to avoid making + * metadata discovery calls, thereby improving performance of token acquisition process. + */ + if (!this.config.msalConfig.auth.authorityMetadata) { + const authorityMetadata = await this.getAuthorityMetadata(); + this.config.msalConfig.auth.authorityMetadata = JSON.stringify(authorityMetadata); + } + + const msalInstance = this.getMsalInstance(this.config.msalConfig); + + // trigger the first leg of auth code flow + return this.redirectToAuthCodeUrl( + req, + res, + next, + authCodeUrlRequestParams, + authCodeRequestParams, + msalInstance + ); + } + + async handleRedirect(req, res, next) { + const authCodeRequest = { + ...req.session.authCodeRequest, + code: req.body.code, // authZ code + codeVerifier: req.session.pkceCodes.verifier, // PKCE Code Verifier + }; + + try { + const msalInstance = this.getMsalInstance(this.config.msalConfig); + msalInstance.getTokenCache().deserialize(req.session.tokenCache); + + const tokenResponse = await msalInstance.acquireTokenByCode(authCodeRequest, req.body); + + req.session.tokenCache = msalInstance.getTokenCache().serialize(); + req.session.accessToken = tokenResponse.accessToken; + req.session.idToken = tokenResponse.idToken; + req.session.account = tokenResponse.account; + req.session.isAuthenticated = true; + + const state = JSON.parse(this.cryptoProvider.base64Decode(req.body.state)); + res.redirect(state.redirectTo); + } catch (error) { + next(error); + } + } + + /** + * + * @param req: Express request object + * @param res: Express response object + * @param next: Express next function + * @param scopes: Array of strings + * @param redirectUri: redirect Url + */ + getToken(scopes, redirectUri = "http://localhost:3000/") { + return async function (req, res, next) { + console.log(scopes); + const msalInstance = authProvider.getMsalInstance(authProvider.config.msalConfig); + try { + msalInstance.getTokenCache().deserialize(req.session.tokenCache); + + const silentRequest = { + account: req.session.account, + scopes: scopes, + }; + + const tokenResponse = await msalInstance.acquireTokenSilent(silentRequest); + + req.session.tokenCache = msalInstance.getTokenCache().serialize(); + req.session.accessToken = tokenResponse.accessToken; + next(); + } catch (error) { + if (error instanceof msal.InteractionRequiredAuthError) { + req.session.csrfToken = authProvider.cryptoProvider.createNewGuid(); + + const state = authProvider.cryptoProvider.base64Encode( + JSON.stringify({ + redirectTo: 'http://localhost:3000/users/updateProfile', + csrfToken: req.session.csrfToken, + }) + ); + + const authCodeUrlRequestParams = { + state: state, + scopes: scopes, + }; + + const authCodeRequestParams = { + state: state, + scopes: scopes, + }; + + authProvider.redirectToAuthCodeUrl( + req, + res, + next, + authCodeUrlRequestParams, + authCodeRequestParams, + msalInstance + ); + } + + next(error); + } + }; + } + + async logout(req, res, next) { + /** + * Construct a logout URI and redirect the user to end the + * session with Azure AD. For more information, visit: + * https://docs.microsoft.com/azure/active-directory/develop/v2-protocols-oidc#send-a-sign-out-request + */ + const logoutUri = `${this.config.msalConfig.auth.authority}${TENANT_SUBDOMAIN}.onmicrosoft.com/oauth2/v2.0/logout?post_logout_redirect_uri=${this.config.postLogoutRedirectUri}`; + + req.session.destroy(() => { + res.redirect(logoutUri); + }); + } + + /** + * Prepares the auth code request parameters and initiates the first leg of auth code flow + * @param req: Express request object + * @param res: Express response object + * @param next: Express next function + * @param authCodeUrlRequestParams: parameters for requesting an auth code url + * @param authCodeRequestParams: parameters for requesting tokens using auth code + */ + async redirectToAuthCodeUrl(req, res, next, authCodeUrlRequestParams, authCodeRequestParams, msalInstance) { + // Generate PKCE Codes before starting the authorization flow + const { verifier, challenge } = await this.cryptoProvider.generatePkceCodes(); + + // Set generated PKCE codes and method as session vars + req.session.pkceCodes = { + challengeMethod: 'S256', + verifier: verifier, + challenge: challenge, + }; + + /** + * By manipulating the request objects below before each request, we can obtain + * auth artifacts with desired claims. For more information, visit: + * https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_node.html#authorizationurlrequest + * https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_node.html#authorizationcoderequest + **/ + + req.session.authCodeUrlRequest = { + ...authCodeUrlRequestParams, + redirectUri: this.config.redirectUri, + responseMode: 'form_post', // recommended for confidential clients + codeChallenge: req.session.pkceCodes.challenge, + codeChallengeMethod: req.session.pkceCodes.challengeMethod, + }; + + req.session.authCodeRequest = { + ...authCodeRequestParams, + redirectUri: this.config.redirectUri, + code: '', + }; + + try { + const authCodeUrlResponse = await msalInstance.getAuthCodeUrl(req.session.authCodeUrlRequest); + res.redirect(authCodeUrlResponse); + } catch (error) { + next(error); + } + } + + /** + * Retrieves oidc metadata from the openid endpoint + * @returns + */ + async getAuthorityMetadata() { + const endpoint = `${this.config.msalConfig.auth.authority}${TENANT_SUBDOMAIN}.onmicrosoft.com/v2.0/.well-known/openid-configuration`; + try { + const response = await axios.get(endpoint); + return await response.data; + } catch (error) { + console.log(error); + } + } +} + +const authProvider = new AuthProvider({ + msalConfig: msalConfig, + redirectUri: REDIRECT_URI, + postLogoutRedirectUri: POST_LOGOUT_REDIRECT_URI, +}); + +module.exports = authProvider; diff --git a/1-Authentication/7-sign-in-express-mfa/App/authConfig.js b/1-Authentication/7-sign-in-express-mfa/App/authConfig.js new file mode 100644 index 000000000..712297431 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/authConfig.js @@ -0,0 +1,49 @@ +/* + * Copyright (c) Microsoft Corporation. All rights reserved. + * Licensed under the MIT License. + */ + +require('dotenv').config({ path: '.env.dev' }); + +const TENANT_SUBDOMAIN = process.env.TENANT_SUBDOMAIN || 'Enter_the_Tenant_Subdomain_Here'; +const REDIRECT_URI = process.env.REDIRECT_URI || 'http://localhost:3000/auth/redirect'; +const POST_LOGOUT_REDIRECT_URI = process.env.POST_LOGOUT_REDIRECT_URI || 'http://localhost:3000'; + +/** + * Configuration object to be passed to MSAL instance on creation. + * For a full list of MSAL Node configuration parameters, visit: + * https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-node/docs/configuration.md + */ +const msalConfig = { + auth: { + clientId: process.env.CLIENT_ID || 'Enter_the_Application_Id_Here', // 'Application (client) ID' of app registration in Azure portal - this value is a GUID + authority: process.env.AUTHORITY || `https://${TENANT_SUBDOMAIN}.ciamlogin.com/`, // Replace the placeholder with your tenant name + clientSecret: process.env.CLIENT_SECRET || 'Enter_the_Client_Secret_Here', // Client secret generated from the app registration in Azure portal + }, + system: { + loggerOptions: { + loggerCallback(loglevel, message, containsPii) { + console.log(message); + }, + piiLoggingEnabled: false, + logLevel: 'Info', + }, + }, +}; + +const GRAPH_API_ENDPOINT = process.env.GRAPH_API_ENDPOINT || "graph_end_point"; +// Refers to the user that is single user singed in. +// https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http +const GRAPH_ME_ENDPOINT = GRAPH_API_ENDPOINT + "v1.0/me"; + +const mfaProtectedResourceScope = process.env.MFA_PROTECTED_SCOPE || 'Add_your_protected_scope_here'; + +module.exports = { + msalConfig, + mfaProtectedResourceScope, + REDIRECT_URI, + POST_LOGOUT_REDIRECT_URI, + TENANT_SUBDOMAIN, + GRAPH_API_ENDPOINT, + GRAPH_ME_ENDPOINT, +}; diff --git a/1-Authentication/7-sign-in-express-mfa/App/controller/authController.js b/1-Authentication/7-sign-in-express-mfa/App/controller/authController.js new file mode 100644 index 000000000..d9af7cd6a --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/controller/authController.js @@ -0,0 +1,13 @@ +const authProvider = require('../auth/AuthProvider'); + +exports.signIn = async (req, res, next) => { + return authProvider.login(req, res, next, {scopes:["User.Read"]}); +}; + +exports.handleRedirect = async (req, res, next) => { + return authProvider.handleRedirect(req, res, next); +} + +exports.signOut = async (req, res, next) => { + return authProvider.logout(req, res, next); +}; diff --git a/1-Authentication/7-sign-in-express-mfa/App/fetch.js b/1-Authentication/7-sign-in-express-mfa/App/fetch.js new file mode 100644 index 000000000..c000fb8b5 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/fetch.js @@ -0,0 +1,33 @@ +var axios = require('axios'); +var authProvider = require("./auth/AuthProvider"); + +/** + * Makes an Authorization "Bearer" request with the given accessToken to the given endpoint. + * @param endpoint + * @param accessToken + * @param method + */ +const fetch = async (endpoint, accessToken, method = "GET", data = null) => { + const options = { + headers: { + Authorization: `Bearer ${accessToken}`, + }, + }; + console.log(`request made to ${endpoint} at: ` + new Date().toString()); + + switch (method) { + case 'GET': + const response = await axios.get(endpoint, options); + return await response.data; + case 'POST': + return await axios.post(endpoint, data, options); + case 'DELETE': + return await axios.delete(endpoint + `/${data}`, options); + case 'PATCH': + return await axios.patch(endpoint, ReqBody = data, options); + default: + return null; + } +}; + +module.exports = { fetch }; diff --git a/1-Authentication/7-sign-in-express-mfa/App/package-lock.json b/1-Authentication/7-sign-in-express-mfa/App/package-lock.json new file mode 100644 index 000000000..9dece07d7 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/package-lock.json @@ -0,0 +1,1141 @@ +{ + "name": "msal-node-auth-code", + "version": "1.0.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "msal-node-auth-code", + "version": "1.0.0", + "license": "MIT", + "dependencies": { + "@azure/msal-node": "^1.17.2", + "axios": "^1.0.0", + "cookie-parser": "^1.4.6", + "dotenv": "^16.0.3", + "express": "^4.18.1", + "express-session": "^1.17.3", + "hbs": "^4.2.0", + "http-errors": "^2.0.0", + "morgan": "^1.10.0" + } + }, + "node_modules/@azure/msal-common": { + "version": "13.3.1", + "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-13.3.1.tgz", + "integrity": "sha512-Lrk1ozoAtaP/cp53May3v6HtcFSVxdFrg2Pa/1xu5oIvsIwhxW6zSPibKefCOVgd5osgykMi5jjcZHv8XkzZEQ==", + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/@azure/msal-node": { + "version": "1.18.4", + "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-1.18.4.tgz", + "integrity": "sha512-Kc/dRvhZ9Q4+1FSfsTFDME/v6+R2Y1fuMty/TfwqE5p9GTPw08BPbKgeWinE8JRHRp+LemjQbUZsn4Q4l6Lszg==", + "deprecated": "A newer major version of this library is available. Please upgrade to the latest available version.", + "dependencies": { + "@azure/msal-common": "13.3.1", + "jsonwebtoken": "^9.0.0", + "uuid": "^8.3.0" + }, + "engines": { + "node": "10 || 12 || 14 || 16 || 18" + } + }, + "node_modules/accepts": { + "version": "1.3.8", + "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz", + "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==", + "dependencies": { + "mime-types": "~2.1.34", + "negotiator": "0.6.3" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/array-flatten": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz", + "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==" + }, + "node_modules/asynckit": { + "version": "0.4.0", + "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", + "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==" + }, + "node_modules/axios": { + "version": "1.6.8", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.8.tgz", + "integrity": "sha512-v/ZHtJDU39mDpyBoFVkETcd/uNdxrWRrg3bKpOKzXFA6Bvqopts6ALSMU3y6ijYxbw2B+wPrIv46egTzJXCLGQ==", + "dependencies": { + "follow-redirects": "^1.15.6", + "form-data": "^4.0.0", + "proxy-from-env": "^1.1.0" + } + }, + "node_modules/basic-auth": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz", + "integrity": "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==", + "dependencies": { + "safe-buffer": "5.1.2" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/basic-auth/node_modules/safe-buffer": { + "version": "5.1.2", + "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz", + "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==" + }, + "node_modules/body-parser": { + "version": "1.20.2", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz", + "integrity": "sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6R7ajOPw0g/J1PvK4qNy7s5bA==", + "dependencies": { + "bytes": "3.1.2", + "content-type": "~1.0.5", + "debug": "2.6.9", + "depd": "2.0.0", + "destroy": "1.2.0", + "http-errors": "2.0.0", + "iconv-lite": "0.4.24", + "on-finished": "2.4.1", + "qs": "6.11.0", + "raw-body": "2.5.2", + "type-is": "~1.6.18", + "unpipe": "1.0.0" + }, + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + } + }, + "node_modules/buffer-equal-constant-time": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz", + "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==" + }, + "node_modules/bytes": { + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", + "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/call-bind": { + "version": "1.0.7", + "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.7.tgz", + "integrity": "sha512-GHTSNSYICQ7scH7sZ+M2rFopRoLh8t2bLSW6BbgrtLsahOIB5iyAVJf9GjWK3cYTDaMj4XdBpM1cA6pIS0Kv2w==", + "dependencies": { + "es-define-property": "^1.0.0", + "es-errors": "^1.3.0", + "function-bind": "^1.1.2", + "get-intrinsic": "^1.2.4", + "set-function-length": "^1.2.1" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/combined-stream": { + "version": "1.0.8", + "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz", + "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==", + "dependencies": { + "delayed-stream": "~1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/content-disposition": { + "version": "0.5.4", + "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz", + "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==", + "dependencies": { + "safe-buffer": "5.2.1" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/content-type": { + "version": "1.0.5", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz", + "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie": { + "version": "0.4.1", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz", + "integrity": "sha512-ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie-parser": { + "version": "1.4.6", + "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.6.tgz", + "integrity": "sha512-z3IzaNjdwUC2olLIB5/ITd0/setiaFMLYiZJle7xg5Fe9KWAceil7xszYfHHBtDFYLSgJduS2Ty0P1uJdPDJeA==", + "dependencies": { + "cookie": "0.4.1", + "cookie-signature": "1.0.6" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/cookie-signature": { + "version": "1.0.6", + "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz", + "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==" + }, + "node_modules/debug": { + "version": "2.6.9", + "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz", + "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/define-data-property": { + "version": "1.1.4", + "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz", + "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==", + "dependencies": { + "es-define-property": "^1.0.0", + "es-errors": "^1.3.0", + "gopd": "^1.0.1" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/delayed-stream": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz", + "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==", + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/depd": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", + "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/destroy": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz", + "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==", + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + } + }, + "node_modules/dotenv": { + "version": "16.4.5", + "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.4.5.tgz", + "integrity": "sha512-ZmdL2rui+eB2YwhsWzjInR8LldtZHGDoQ1ugH85ppHKwpUHL7j7rN0Ti9NCnGiQbhaZ11FpR+7ao1dNsmduNUg==", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://dotenvx.com" + } + }, + "node_modules/ecdsa-sig-formatter": { + "version": "1.0.11", + "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz", + "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==", + "dependencies": { + "safe-buffer": "^5.0.1" + } + }, + "node_modules/ee-first": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", + "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==" + }, + "node_modules/encodeurl": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz", + "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/es-define-property": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.0.tgz", + "integrity": "sha512-jxayLKShrEqqzJ0eumQbVhTYQM27CfT1T35+gCgDFoL82JLsXqTJ76zv6A0YLOgEnLUMvLzsDsGIrl8NFpT2gQ==", + "dependencies": { + "get-intrinsic": "^1.2.4" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-errors": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", + "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/escape-html": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz", + "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==" + }, + "node_modules/etag": { + "version": "1.8.1", + "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz", + "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/express": { + "version": "4.19.2", + "resolved": "https://registry.npmjs.org/express/-/express-4.19.2.tgz", + "integrity": "sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==", + "dependencies": { + "accepts": "~1.3.8", + "array-flatten": "1.1.1", + "body-parser": "1.20.2", + "content-disposition": "0.5.4", + "content-type": "~1.0.4", + "cookie": "0.6.0", + "cookie-signature": "1.0.6", + "debug": "2.6.9", + "depd": "2.0.0", + "encodeurl": "~1.0.2", + "escape-html": "~1.0.3", + "etag": "~1.8.1", + "finalhandler": "1.2.0", + "fresh": "0.5.2", + "http-errors": "2.0.0", + "merge-descriptors": "1.0.1", + "methods": "~1.1.2", + "on-finished": "2.4.1", + "parseurl": "~1.3.3", + "path-to-regexp": "0.1.7", + "proxy-addr": "~2.0.7", + "qs": "6.11.0", + "range-parser": "~1.2.1", + "safe-buffer": "5.2.1", + "send": "0.18.0", + "serve-static": "1.15.0", + "setprototypeof": "1.2.0", + "statuses": "2.0.1", + "type-is": "~1.6.18", + "utils-merge": "1.0.1", + "vary": "~1.1.2" + }, + "engines": { + "node": ">= 0.10.0" + } + }, + "node_modules/express-session": { + "version": "1.18.0", + "resolved": "https://registry.npmjs.org/express-session/-/express-session-1.18.0.tgz", + "integrity": "sha512-m93QLWr0ju+rOwApSsyso838LQwgfs44QtOP/WBiwtAgPIo/SAh1a5c6nn2BR6mFNZehTpqKDESzP+fRHVbxwQ==", + "dependencies": { + "cookie": "0.6.0", + "cookie-signature": "1.0.7", + "debug": "2.6.9", + "depd": "~2.0.0", + "on-headers": "~1.0.2", + "parseurl": "~1.3.3", + "safe-buffer": "5.2.1", + "uid-safe": "~2.1.5" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/express-session/node_modules/cookie": { + "version": "0.6.0", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz", + "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/express-session/node_modules/cookie-signature": { + "version": "1.0.7", + "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz", + "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==" + }, + "node_modules/express/node_modules/cookie": { + "version": "0.6.0", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz", + "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/finalhandler": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.2.0.tgz", + "integrity": "sha512-5uXcUVftlQMFnWC9qu/svkWv3GTd2PfUhK/3PLkYNAe7FbqJMt3515HaxE6eRL74GdsriiwujiawdaB1BpEISg==", + "dependencies": { + "debug": "2.6.9", + "encodeurl": "~1.0.2", + "escape-html": "~1.0.3", + "on-finished": "2.4.1", + "parseurl": "~1.3.3", + "statuses": "2.0.1", + "unpipe": "~1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/follow-redirects": { + "version": "1.15.6", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz", + "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==", + "funding": [ + { + "type": "individual", + "url": "https://github.com/sponsors/RubenVerborgh" + } + ], + "engines": { + "node": ">=4.0" + }, + "peerDependenciesMeta": { + "debug": { + "optional": true + } + } + }, + "node_modules/foreachasync": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/foreachasync/-/foreachasync-3.0.0.tgz", + "integrity": "sha512-J+ler7Ta54FwwNcx6wQRDhTIbNeyDcARMkOcguEqnEdtm0jKvN3Li3PDAb2Du3ubJYEWfYL83XMROXdsXAXycw==" + }, + "node_modules/form-data": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz", + "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==", + "dependencies": { + "asynckit": "^0.4.0", + "combined-stream": "^1.0.8", + "mime-types": "^2.1.12" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/forwarded": { + "version": "0.2.0", + "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz", + "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/fresh": { + "version": "0.5.2", + "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz", + "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/function-bind": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", + "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-intrinsic": { + "version": "1.2.4", + "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.4.tgz", + "integrity": "sha512-5uYhsJH8VJBTv7oslg4BznJYhDoRI6waYCxMmCdnTrcCrHA/fCFKoTFz2JKKE0HdDFUF7/oQuhzumXJK7paBRQ==", + "dependencies": { + "es-errors": "^1.3.0", + "function-bind": "^1.1.2", + "has-proto": "^1.0.1", + "has-symbols": "^1.0.3", + "hasown": "^2.0.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/gopd": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz", + "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==", + "dependencies": { + "get-intrinsic": "^1.1.3" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/handlebars": { + "version": "4.7.7", + "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.7.tgz", + "integrity": "sha512-aAcXm5OAfE/8IXkcZvCepKU3VzW1/39Fb5ZuqMtgI/hT8X2YgoMvBY5dLhq/cpOvw7Lk1nK/UF71aLG/ZnVYRA==", + "dependencies": { + "minimist": "^1.2.5", + "neo-async": "^2.6.0", + "source-map": "^0.6.1", + "wordwrap": "^1.0.0" + }, + "bin": { + "handlebars": "bin/handlebars" + }, + "engines": { + "node": ">=0.4.7" + }, + "optionalDependencies": { + "uglify-js": "^3.1.4" + } + }, + "node_modules/has-property-descriptors": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz", + "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==", + "dependencies": { + "es-define-property": "^1.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-proto": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.3.tgz", + "integrity": "sha512-SJ1amZAJUiZS+PhsVLf5tGydlaVB8EdFpaSO4gmiUKUOxk8qzn5AIy4ZeJUmh22znIdk/uMAUT2pl3FxzVUH+Q==", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-symbols": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz", + "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/hasown": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz", + "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==", + "dependencies": { + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/hbs": { + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/hbs/-/hbs-4.2.0.tgz", + "integrity": "sha512-dQwHnrfWlTk5PvG9+a45GYpg0VpX47ryKF8dULVd6DtwOE6TEcYQXQ5QM6nyOx/h7v3bvEQbdn19EDAcfUAgZg==", + "dependencies": { + "handlebars": "4.7.7", + "walk": "2.3.15" + }, + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + } + }, + "node_modules/http-errors": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz", + "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==", + "dependencies": { + "depd": "2.0.0", + "inherits": "2.0.4", + "setprototypeof": "1.2.0", + "statuses": "2.0.1", + "toidentifier": "1.0.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/iconv-lite": { + "version": "0.4.24", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz", + "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==", + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/inherits": { + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==" + }, + "node_modules/ipaddr.js": { + "version": "1.9.1", + "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz", + "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==", + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/jsonwebtoken": { + "version": "9.0.2", + "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.2.tgz", + "integrity": "sha512-PRp66vJ865SSqOlgqS8hujT5U4AOgMfhrwYIuIhfKaoSCZcirrmASQr8CX7cUg+RMih+hgznrjp99o+W4pJLHQ==", + "dependencies": { + "jws": "^3.2.2", + "lodash.includes": "^4.3.0", + "lodash.isboolean": "^3.0.3", + "lodash.isinteger": "^4.0.4", + "lodash.isnumber": "^3.0.3", + "lodash.isplainobject": "^4.0.6", + "lodash.isstring": "^4.0.1", + "lodash.once": "^4.0.0", + "ms": "^2.1.1", + "semver": "^7.5.4" + }, + "engines": { + "node": ">=12", + "npm": ">=6" + } + }, + "node_modules/jsonwebtoken/node_modules/ms": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==" + }, + "node_modules/jwa": { + "version": "1.4.1", + "resolved": "https://registry.npmjs.org/jwa/-/jwa-1.4.1.tgz", + "integrity": "sha512-qiLX/xhEEFKUAJ6FiBMbes3w9ATzyk5W7Hvzpa/SLYdxNtng+gcurvrI7TbACjIXlsJyr05/S1oUhZrc63evQA==", + "dependencies": { + "buffer-equal-constant-time": "1.0.1", + "ecdsa-sig-formatter": "1.0.11", + "safe-buffer": "^5.0.1" + } + }, + "node_modules/jws": { + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/jws/-/jws-3.2.2.tgz", + "integrity": "sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==", + "dependencies": { + "jwa": "^1.4.1", + "safe-buffer": "^5.0.1" + } + }, + "node_modules/lodash.includes": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz", + "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==" + }, + "node_modules/lodash.isboolean": { + "version": "3.0.3", + "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz", + "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==" + }, + "node_modules/lodash.isinteger": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz", + "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==" + }, + "node_modules/lodash.isnumber": { + "version": "3.0.3", + "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz", + "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==" + }, + "node_modules/lodash.isplainobject": { + "version": "4.0.6", + "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz", + "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==" + }, + "node_modules/lodash.isstring": { + "version": "4.0.1", + "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz", + "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==" + }, + "node_modules/lodash.once": { + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz", + "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==" + }, + "node_modules/lru-cache": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", + "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/media-typer": { + "version": "0.3.0", + "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz", + "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/merge-descriptors": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz", + "integrity": "sha512-cCi6g3/Zr1iqQi6ySbseM1Xvooa98N0w31jzUYrXPX2xqObmFGHJ0tQ5u74H3mVh7wLouTseZyYIq39g8cNp1w==" + }, + "node_modules/methods": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz", + "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime": { + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz", + "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==", + "bin": { + "mime": "cli.js" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/mime-db": { + "version": "1.52.0", + "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", + "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime-types": { + "version": "2.1.35", + "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", + "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", + "dependencies": { + "mime-db": "1.52.0" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/minimist": { + "version": "1.2.8", + "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz", + "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/morgan": { + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz", + "integrity": "sha512-AbegBVI4sh6El+1gNwvD5YIck7nSA36weD7xvIxG4in80j/UoK8AEGaWnnz8v1GxonMCltmlNs5ZKbGvl9b1XQ==", + "dependencies": { + "basic-auth": "~2.0.1", + "debug": "2.6.9", + "depd": "~2.0.0", + "on-finished": "~2.3.0", + "on-headers": "~1.0.2" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/morgan/node_modules/on-finished": { + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz", + "integrity": "sha512-ikqdkGAAyf/X/gPhXGvfgAytDZtDbr+bkNUJ0N9h5MI/dmdgCs3l6hoHrcUv41sRKew3jIwrp4qQDXiK99Utww==", + "dependencies": { + "ee-first": "1.1.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/ms": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz", + "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==" + }, + "node_modules/negotiator": { + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz", + "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/neo-async": { + "version": "2.6.2", + "resolved": "https://registry.npmjs.org/neo-async/-/neo-async-2.6.2.tgz", + "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==" + }, + "node_modules/object-inspect": { + "version": "1.13.1", + "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.1.tgz", + "integrity": "sha512-5qoj1RUiKOMsCCNLV1CBiPYE10sziTsnmNxkAI/rZhiD63CF7IqdFGC/XzjWjpSgLf0LxXX3bDFIh0E18f6UhQ==", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/on-finished": { + "version": "2.4.1", + "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", + "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", + "dependencies": { + "ee-first": "1.1.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/on-headers": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz", + "integrity": "sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/parseurl": { + "version": "1.3.3", + "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz", + "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/path-to-regexp": { + "version": "0.1.7", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz", + "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ==" + }, + "node_modules/proxy-addr": { + "version": "2.0.7", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", + "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "dependencies": { + "forwarded": "0.2.0", + "ipaddr.js": "1.9.1" + }, + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/proxy-from-env": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz", + "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==" + }, + "node_modules/qs": { + "version": "6.11.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz", + "integrity": "sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==", + "dependencies": { + "side-channel": "^1.0.4" + }, + "engines": { + "node": ">=0.6" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/random-bytes": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz", + "integrity": "sha512-iv7LhNVO047HzYR3InF6pUcUsPQiHTM1Qal51DcGSuZFBil1aBBWG5eHPNek7bvILMaYJ/8RU1e8w1AMdHmLQQ==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/range-parser": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz", + "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/raw-body": { + "version": "2.5.2", + "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz", + "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==", + "dependencies": { + "bytes": "3.1.2", + "http-errors": "2.0.0", + "iconv-lite": "0.4.24", + "unpipe": "1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/safe-buffer": { + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", + "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ] + }, + "node_modules/safer-buffer": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==" + }, + "node_modules/semver": { + "version": "7.6.0", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.0.tgz", + "integrity": "sha512-EnwXhrlwXMk9gKu5/flx5sv/an57AkRplG3hTK68W7FRDN+k+OWBj65M7719OkA82XLBxrcX0KSHj+X5COhOVg==", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/send": { + "version": "0.18.0", + "resolved": "https://registry.npmjs.org/send/-/send-0.18.0.tgz", + "integrity": "sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==", + "dependencies": { + "debug": "2.6.9", + "depd": "2.0.0", + "destroy": "1.2.0", + "encodeurl": "~1.0.2", + "escape-html": "~1.0.3", + "etag": "~1.8.1", + "fresh": "0.5.2", + "http-errors": "2.0.0", + "mime": "1.6.0", + "ms": "2.1.3", + "on-finished": "2.4.1", + "range-parser": "~1.2.1", + "statuses": "2.0.1" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/send/node_modules/ms": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==" + }, + "node_modules/serve-static": { + "version": "1.15.0", + "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.15.0.tgz", + "integrity": "sha512-XGuRDNjXUijsUL0vl6nSD7cwURuzEgglbOaFuZM9g3kwDXOWVTck0jLzjPzGD+TazWbboZYu52/9/XPdUgne9g==", + "dependencies": { + "encodeurl": "~1.0.2", + "escape-html": "~1.0.3", + "parseurl": "~1.3.3", + "send": "0.18.0" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/set-function-length": { + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz", + "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==", + "dependencies": { + "define-data-property": "^1.1.4", + "es-errors": "^1.3.0", + "function-bind": "^1.1.2", + "get-intrinsic": "^1.2.4", + "gopd": "^1.0.1", + "has-property-descriptors": "^1.0.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/setprototypeof": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", + "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==" + }, + "node_modules/side-channel": { + "version": "1.0.6", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.6.tgz", + "integrity": "sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==", + "dependencies": { + "call-bind": "^1.0.7", + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.4", + "object-inspect": "^1.13.1" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/source-map": { + "version": "0.6.1", + "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz", + "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/statuses": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz", + "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/toidentifier": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz", + "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==", + "engines": { + "node": ">=0.6" + } + }, + "node_modules/type-is": { + "version": "1.6.18", + "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz", + "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==", + "dependencies": { + "media-typer": "0.3.0", + "mime-types": "~2.1.24" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/uglify-js": { + "version": "3.17.4", + "resolved": "https://registry.npmjs.org/uglify-js/-/uglify-js-3.17.4.tgz", + "integrity": "sha512-T9q82TJI9e/C1TAxYvfb16xO120tMVFZrGA3f9/P4424DNu6ypK103y0GPFVa17yotwSyZW5iYXgjYHkGrJW/g==", + "optional": true, + "bin": { + "uglifyjs": "bin/uglifyjs" + }, + "engines": { + "node": ">=0.8.0" + } + }, + "node_modules/uid-safe": { + "version": "2.1.5", + "resolved": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.5.tgz", + "integrity": "sha512-KPHm4VL5dDXKz01UuEd88Df+KzynaohSL9fBh096KWAxSKZQDI2uBrVqtvRM4rwrIrRRKsdLNML/lnaaVSRioA==", + "dependencies": { + "random-bytes": "~1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/unpipe": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz", + "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/utils-merge": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz", + "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==", + "engines": { + "node": ">= 0.4.0" + } + }, + "node_modules/uuid": { + "version": "8.3.2", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz", + "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==", + "bin": { + "uuid": "dist/bin/uuid" + } + }, + "node_modules/vary": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz", + "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/walk": { + "version": "2.3.15", + "resolved": "https://registry.npmjs.org/walk/-/walk-2.3.15.tgz", + "integrity": "sha512-4eRTBZljBfIISK1Vnt69Gvr2w/wc3U6Vtrw7qiN5iqYJPH7LElcYh/iU4XWhdCy2dZqv1ToMyYlybDylfG/5Vg==", + "dependencies": { + "foreachasync": "^3.0.0" + } + }, + "node_modules/wordwrap": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz", + "integrity": "sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==" + }, + "node_modules/yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + } + } +} diff --git a/1-Authentication/7-sign-in-express-mfa/App/package.json b/1-Authentication/7-sign-in-express-mfa/App/package.json new file mode 100644 index 000000000..2c88dda12 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/package.json @@ -0,0 +1,21 @@ +{ + "name": "msal-node-auth-code", + "version": "1.0.0", + "description": "sample web app for msal-node", + "scripts": { + "start": "node server.js" + }, + "author": "Microsoft", + "license": "MIT", + "dependencies": { + "@azure/msal-node": "^1.17.2", + "axios": "^1.0.0", + "cookie-parser": "^1.4.6", + "dotenv": "^16.0.3", + "express": "^4.18.1", + "express-session": "^1.17.3", + "hbs": "^4.2.0", + "http-errors": "^2.0.0", + "morgan": "^1.10.0" + } +} diff --git a/1-Authentication/7-sign-in-express-mfa/App/public/stylesheets/style.css b/1-Authentication/7-sign-in-express-mfa/App/public/stylesheets/style.css new file mode 100644 index 000000000..9453385b9 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/public/stylesheets/style.css @@ -0,0 +1,8 @@ +body { + padding: 50px; + font: 14px "Lucida Grande", Helvetica, Arial, sans-serif; +} + +a { + color: #00B7FF; +} diff --git a/1-Authentication/7-sign-in-express-mfa/App/routes/auth.js b/1-Authentication/7-sign-in-express-mfa/App/routes/auth.js new file mode 100644 index 000000000..0b2982817 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/routes/auth.js @@ -0,0 +1,9 @@ +const express = require('express'); +const authController = require('../controller/authController'); +const router = express.Router(); + +router.get('/signin', authController.signIn); +router.get('/signout', authController.signOut); +router.post('/redirect', authController.handleRedirect); + +module.exports = router; diff --git a/1-Authentication/7-sign-in-express-mfa/App/routes/index.js b/1-Authentication/7-sign-in-express-mfa/App/routes/index.js new file mode 100644 index 000000000..d0465d3e9 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/routes/index.js @@ -0,0 +1,17 @@ +/* + * Copyright (c) Microsoft Corporation. All rights reserved. + * Licensed under the MIT License. + */ + +const express = require('express'); +const router = express.Router(); + +router.get('/', function (req, res, next) { + res.render('index', { + title: 'MSAL Node & Express Web App', + isAuthenticated: req.session.isAuthenticated, + username: req.session.account?.username !== '' ? req.session.account?.username : req.session.account?.name, + }); +}); + +module.exports = router; diff --git a/1-Authentication/7-sign-in-express-mfa/App/routes/users.js b/1-Authentication/7-sign-in-express-mfa/App/routes/users.js new file mode 100644 index 000000000..c3572cea4 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/routes/users.js @@ -0,0 +1,80 @@ +/* + * Copyright (c) Microsoft Corporation. All rights reserved. + * Licensed under the MIT License. + */ + +const express = require('express'); +const router = express.Router(); +const authProvider = require('../auth/AuthProvider'); +var { fetch } = require("../fetch"); +const { GRAPH_ME_ENDPOINT, + mfaProtectedResourceScope } = require('../authConfig'); + +// custom middleware to check auth state +function isAuthenticated(req, res, next) { + if (!req.session.isAuthenticated) { + return res.redirect('/auth/signin'); // redirect to sign-in route + } + + next(); +}; + +router.get('/id', + isAuthenticated, // check if user is authenticated + async function (req, res, next) { + res.render('id', { idTokenClaims: req.session.account.idTokenClaims }); + } +); + +router.get( + '/updateProfile', + isAuthenticated, // check if user is authenticated + authProvider.getToken(["User.ReadWrite"]), // check for mfa + async function (req, res, next) { + const graphResponse = await fetch( + GRAPH_ME_ENDPOINT, + req.session.accessToken + ); + res.render("updateProfile", { + profile: graphResponse, + }); + } +); + +router.post( + '/update', + isAuthenticated, // check if user is authenticated + authProvider.getToken(["User.ReadWrite", mfaProtectedResourceScope]), // check for mfa + async function (req, res, next) { + try { + if (!!req.body) { + let body = req.body; + const graphEndpoint = GRAPH_ME_ENDPOINT; + // API that calls for a single singed in user. + // more infromation for this endpoint found here + // https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http + fetch(graphEndpoint, req.session.accessToken, "PATCH", { + displayName: body.displayName, + givenName: body.givenName, + surname: body.surname, + mail: body.mail, + }) + .then((response) => { + if (response.status === 204) { + return res.redirect("/"); + } else { + next("Not updated"); + } + }) + .catch((error) => { + next(error); + }); + } else { + throw { error: "empty request" }; + } + } catch (error) { + next(error); + } + } +); +module.exports = router; diff --git a/1-Authentication/7-sign-in-express-mfa/App/server.js b/1-Authentication/7-sign-in-express-mfa/App/server.js new file mode 100644 index 000000000..9ca694e2f --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/server.js @@ -0,0 +1,90 @@ +/** + * Module dependencies. + */ + +var app = require('./app'); +var debug = require('debug')('msal:server'); +var http = require('http'); + +/** + * Get port from environment and store in Express. + */ + +var port = normalizePort(process.env.PORT || '3000'); +app.set('port', port); + +/** + * Create HTTP server. + */ + +var server = http.createServer(app); + +/** + * Listen on provided port, on all network interfaces. + */ + +server.listen(port); +server.on('error', onError); +server.on('listening', onListening); + +/** + * Normalize a port into a number, string, or false. + */ + +function normalizePort(val) { + var port = parseInt(val, 10); + + if (isNaN(port)) { + // named pipe + return val; + } + + if (port >= 0) { + // port number + return port; + } + + return false; +} + +/** + * Event listener for HTTP server "error" event. + */ + +function onError(error) { + if (error.syscall !== 'listen') { + throw error; + } + + var bind = typeof port === 'string' + ? 'Pipe ' + port + : 'Port ' + port; + + // handle specific listen errors with friendly messages + switch (error.code) { + case 'EACCES': + console.error(bind + ' requires elevated privileges'); + process.exit(1); + break; + case 'EADDRINUSE': + console.error(bind + ' is already in use'); + process.exit(1); + break; + default: + throw error; + } +} + +/** + * Event listener for HTTP server "listening" event. + */ + +function onListening() { + console.log(`Server listening on port ${port}`); + + var addr = server.address(); + var bind = typeof addr === 'string' + ? 'pipe ' + addr + : 'port ' + addr.port; + debug('Listening on ' + bind); +} diff --git a/1-Authentication/7-sign-in-express-mfa/App/views/error.hbs b/1-Authentication/7-sign-in-express-mfa/App/views/error.hbs new file mode 100644 index 000000000..065976562 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/views/error.hbs @@ -0,0 +1,3 @@ +

{{message}}

+

{{error.status}}

+
{{error.stack}}
diff --git a/1-Authentication/7-sign-in-express-mfa/App/views/id.hbs b/1-Authentication/7-sign-in-express-mfa/App/views/id.hbs new file mode 100644 index 000000000..92ddfc7f5 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/views/id.hbs @@ -0,0 +1,16 @@ +

Azure AD

+

ID Token

+ + + {{#each idTokenClaims}} + + + + + {{/each}} + +
{{@key}}{{this}}
+
+Learn about claims in this ID token +
+Go back diff --git a/1-Authentication/7-sign-in-express-mfa/App/views/index.hbs b/1-Authentication/7-sign-in-express-mfa/App/views/index.hbs new file mode 100644 index 000000000..ca87488a2 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/views/index.hbs @@ -0,0 +1,12 @@ +

{{title}}

+{{#if isAuthenticated }} +

Hi {{username}}!

+View ID token claims +
+Profile editing +
+Sign out +{{else}} +

Welcome to {{title}}

+Sign in +{{/if}} diff --git a/1-Authentication/7-sign-in-express-mfa/App/views/layout.hbs b/1-Authentication/7-sign-in-express-mfa/App/views/layout.hbs new file mode 100644 index 000000000..069e5b294 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/views/layout.hbs @@ -0,0 +1,13 @@ + + + + + {{title}} + + + + + {{{body}}} + + + diff --git a/1-Authentication/7-sign-in-express-mfa/App/views/updateProfile.hbs b/1-Authentication/7-sign-in-express-mfa/App/views/updateProfile.hbs new file mode 100644 index 000000000..a4991bb60 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/App/views/updateProfile.hbs @@ -0,0 +1,26 @@ +

Microsoft Graph API

+

/me endpoint response

+
+
+ + +
+ + +
+ + +
+ + + +
+ + + +
+ + +
+
+Go back diff --git a/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/AppCreationScripts.md b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/AppCreationScripts.md new file mode 100644 index 000000000..624c702ac --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/AppCreationScripts.md @@ -0,0 +1,138 @@ +# Registering sample apps with the Microsoft identity platform and updating configuration files using PowerShell + +## Overview + +### Quick summary + +1. Run the script to create your Azure AD application and configure the code of the sample application accordingly. + + ```PowerShell + cd .\AppCreationScripts\ + .\Configure.ps1 -TenantId "your test tenant's id" -AzureEnvironmentName "[Optional] - Azure environment, defaults to 'Global'" + ``` + +### More details + +- [Goal of the provided scripts](#goal-of-the-provided-scripts) + - [Presentation of the scripts](#presentation-of-the-scripts) + - [Usage pattern for tests and DevOps scenarios](#usage-pattern-for-tests-and-DevOps-scenarios) +- [How to use the app creation scripts?](#how-to-use-the-app-creation-scripts) + - [Pre-requisites](#pre-requisites) + - [Run the script and start running](#run-the-script-and-start-running) + - [Four ways to run the script](#four-ways-to-run-the-script) + - [Option 1 (interactive)](#option-1-interactive) + - [Option 2 (Interactive, but create apps in a specified tenant)](#option-3-Interactive-but-create-apps-in-a-specified-tenant) + - [Running the script on Azure Sovereign clouds](#running-the-script-on-Azure-Sovereign-clouds) + +## Goal of the provided scripts + +### Presentation of the scripts + +This sample comes with two PowerShell scripts, which automate the creation of the Azure Active Directory applications, and the configuration of the code for this sample. Once you run them, you will only need to build the solution and you are good to test. + +These scripts are: + +- `Configure.ps1` which: + - creates Azure AD applications and their related objects (permissions, dependencies, secrets, app roles), + - changes the configuration files in the sample projects. + - creates a summary file named `createdApps.html` in the folder from which you ran the script, and containing, for each Azure AD application it created: + - the identifier of the application + - the AppId of the application + - the url of its registration in the [Azure portal](https://portal.azure.com). + +- `Cleanup.ps1` which cleans-up the Azure AD objects created by `Configure.ps1`. Note that this script does not revert the changes done in the configuration files, though. You will need to undo the change from source control (from Visual Studio, or from the command line using, for instance, `git reset`). + +> :information_source: If the sample supports using certificates instead of client secrets, this folder will contain an additional set of scripts: `Configure-WithCertificates.ps1` and `Cleanup-WithCertificates.ps1`. You can use them in the same way to register app(s) that use certificates instead of client secrets. + +### Usage pattern for tests and DevOps scenarios + +The `Configure.ps1` will stop if it tries to create an Azure AD application which already exists in the tenant. For this, if you are using the script to try/test the sample, or in DevOps scenarios, you might want to run `Cleanup.ps1` just before `Configure.ps1`. This is what is shown in the steps below. + +## How to use the app creation scripts? + +### Pre-requisites + +1. PowerShell 7 or later (see: [installing PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell)) +1. Open PowerShell (On Windows, press `Windows-R` and type `PowerShell` in the search window) + +### (Optionally) install Microsoft.Graph.Applications PowerShell modules + +The scripts install the required PowerShell module (Microsoft.Graph.Applications) for the current user if needed. However, if you want to install if for all users on the machine, you can follow the following steps: + +1. If you have never done it already, in the PowerShell window, install the Microsoft.Graph.Applications PowerShell modules. For this: + + 1. Open PowerShell + 2. Type: + + ```PowerShell + Install-Module Microsoft.Graph.Applications + ``` + + or if you want the modules to be installed for the current user only, run: + + ```PowerShell + Install-Module Microsoft.Graph.Applications -Scope CurrentUser + ``` + +### Run the script and start running + +1. Go to the `AppCreationScripts` sub-folder. From the folder where you cloned the repo, + + ```PowerShell + cd AppCreationScripts + ``` + +1. Run the scripts. See below for the [four options](#four-ways-to-run-the-script) to do that. +1. Open the Visual Studio solution, and in the solution's context menu, choose **Set Startup Projects**. +1. select **Start** for the projects + +You're done! + +### Two ways to run the script + +We advise four ways of running the script: + +- Interactive: you will be prompted for credentials, and the scripts decide in which tenant to create the objects, +- Interactive in specific tenant: you will provide the tenant in which you want to create the objects and then you will be prompted for credentials, and the scripts will create the objects, + +Here are the details on how to do this. + +#### Option 1 (interactive) + +- Just run ``.\Configure.ps1``, and you will be prompted to sign-in (email address, password, and if needed MFA). +- The script will be run as the signed-in user and will use the tenant in which the user is defined. + +Note that the script will choose the tenant in which to create the applications, based on the user. Also to run the `Cleanup.ps1` script, you will need to re-sign-in. + +#### Option 2 (Interactive, but create apps in a specified tenant) + + if you want to create the apps in a particular tenant, you can use the following option: + +- Open the [Azure portal](https://portal.azure.com) +- Select the Azure Active directory you are interested in (in the combo-box below your name on the top right of the browser window) +- Find the "Active Directory" object in this tenant +- Go to **Properties** and copy the content of the **Directory Id** property +- Then use the full syntax to run the scripts: + +```PowerShell +$tenantId = "yourTenantIdGuid" +. .\Cleanup.ps1 -TenantId $tenantId +. .\Configure.ps1 -TenantId $tenantId +``` + +### Running the script on Azure Sovereign clouds + +All the four options listed above can be used on any Azure Sovereign clouds. By default, the script targets `AzureCloud`, but it can be changed using the parameter `-AzureEnvironmentName`. + +The acceptable values for this parameter are: + +- AzureCloud +- AzureChinaCloud +- AzureUSGovernment + +Example: + + ```PowerShell + . .\Cleanup.ps1 -AzureEnvironmentName "AzureUSGovernment" + . .\Configure.ps1 -AzureEnvironmentName "AzureUSGovernment" + ``` diff --git a/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/Cleanup.ps1 b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/Cleanup.ps1 new file mode 100644 index 000000000..90270d8a0 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/Cleanup.ps1 @@ -0,0 +1,152 @@ +#Requires -Version 7 + +[CmdletBinding()] +param( + [Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')] + [string] $tenantId, + [Parameter(Mandatory=$False, HelpMessage='Azure environment to use while running the script. Default = Global')] + [string] $azureEnvironmentName +) + + +Function Cleanup +{ + if (!$azureEnvironmentName) + { + $azureEnvironmentName = "Global" + } + + <# + .Description + This function removes the Azure AD applications for the sample. These applications were created by the Configure.ps1 script + #> + + # $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant + # into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD. + + # Connect to the Microsoft Graph API + Write-Host "Connecting to Microsoft Graph" + + + if ($tenantId -eq "") + { + Connect-MgGraph -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All" -Environment $azureEnvironmentName + } + else + { + Connect-MgGraph -TenantId $tenantId -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All" -Environment $azureEnvironmentName + } + + $context = Get-MgContext + $tenantId = $context.TenantId + + # Get the user running the script + $currentUserPrincipalName = $context.Account + $user = Get-MgUser -Filter "UserPrincipalName eq '$($context.Account)'" + + # get the tenant we signed in to + $Tenant = Get-MgOrganization + $tenantName = $Tenant.DisplayName + + $verifiedDomain = $Tenant.VerifiedDomains | where {$_.Isdefault -eq $true} + $verifiedDomainName = $verifiedDomain.Name + $tenantId = $Tenant.Id + + Write-Host ("Connected to Tenant {0} ({1}) as account '{2}'. Domain is '{3}'" -f $Tenant.DisplayName, $Tenant.Id, $currentUserPrincipalName, $verifiedDomainName) + + # Removes the applications + Write-Host "Cleaning-up applications from tenant '$tenantId'" + + Write-Host "Removing 'client' (ciam-msal-node-webapp) if needed" + try + { + Get-MgApplication -Filter "DisplayName eq 'ciam-msal-node-webapp'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id } + } + catch + { + $message = $_ + Write-Warning $Error[0] + Write-Host "Unable to remove the application 'ciam-msal-node-webapp'. Error is $message. Try deleting manually." -ForegroundColor White -BackgroundColor Red + } + + Write-Host "Making sure there are no more (ciam-msal-node-webapp) applications found, will remove if needed..." + $apps = Get-MgApplication -Filter "DisplayName eq 'ciam-msal-node-webapp'" | Format-List Id, DisplayName, AppId, SignInAudience, PublisherDomain + + if ($apps) + { + Remove-MgApplication -ApplicationId $apps.Id + } + + foreach ($app in $apps) + { + Remove-MgApplication -ApplicationId $app.Id + Write-Host "Removed ciam-msal-node-webapp.." + } + + # also remove service principals of this app + try + { + Get-MgServicePrincipal -filter "DisplayName eq 'ciam-msal-node-webapp'" | ForEach-Object {Remove-MgServicePrincipal -ServicePrincipalId $_.Id -Confirm:$false} + } + catch + { + $message = $_ + Write-Warning $Error[0] + Write-Host "Unable to remove ServicePrincipal 'ciam-msal-node-webapp'. Error is $message. Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red + } +} + +# Pre-requisites +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph")) { + Install-Module "Microsoft.Graph" -Scope CurrentUser +} + +#Import-Module Microsoft.Graph + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Authentication")) { + Install-Module "Microsoft.Graph.Authentication" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Authentication + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Identity.DirectoryManagement")) { + Install-Module "Microsoft.Graph.Identity.DirectoryManagement" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Identity.DirectoryManagement + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Applications")) { + Install-Module "Microsoft.Graph.Applications" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Applications + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Groups")) { + Install-Module "Microsoft.Graph.Groups" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Groups + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Users")) { + Install-Module "Microsoft.Graph.Users" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Users + +$ErrorActionPreference = "Stop" + + +try +{ + Cleanup -tenantId $tenantId -environment $azureEnvironmentName +} +catch +{ + $_.Exception.ToString() | out-host + $message = $_ + Write-Warning $Error[0] + Write-Host "Unable to register apps. Error is $message." -ForegroundColor White -BackgroundColor Red +} + +Write-Host "Disconnecting from tenant" +Disconnect-MgGraph diff --git a/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/Configure.ps1 b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/Configure.ps1 new file mode 100644 index 000000000..c7afff900 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/Configure.ps1 @@ -0,0 +1,352 @@ +#Requires -Version 7 + +[CmdletBinding()] +param( + [Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')] + [string] $tenantId, + [Parameter(Mandatory=$False, HelpMessage='Azure environment to use while running the script. Default = Global')] + [string] $azureEnvironmentName +) + +<# + This script creates the Azure AD applications needed for this sample and updates the configuration files + for the visual Studio projects from the data in the Azure AD applications. + + In case you don't have Microsoft.Graph.Applications already installed, the script will automatically install it for the current user + + There are two ways to run this script. For more information, read the AppCreationScripts.md file in the same folder as this script. +#> + +# Create an application key +# See https://www.sabin.io/blog/adding-an-azure-active-directory-application-and-key-using-powershell/ +Function CreateAppKey([DateTime] $fromDate, [double] $durationInMonths) +{ + $key = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphPasswordCredential + + $key.StartDateTime = $fromDate + $key.EndDateTime = $fromDate.AddMonths($durationInMonths) + $key.KeyId = (New-Guid).ToString() + $key.DisplayName = "app secret" + + return $key +} + +# Adds the requiredAccesses (expressed as a pipe separated string) to the requiredAccess structure +# The exposed permissions are in the $exposedPermissions collection, and the type of permission (Scope | Role) is +# described in $permissionType +Function AddResourcePermission($requiredAccess, ` + $exposedPermissions, [string]$requiredAccesses, [string]$permissionType) +{ + foreach($permission in $requiredAccesses.Trim().Split("|")) + { + foreach($exposedPermission in $exposedPermissions) + { + if ($exposedPermission.Value -eq $permission) + { + $resourceAccess = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphResourceAccess + $resourceAccess.Type = $permissionType # Scope = Delegated permissions | Role = Application permissions + $resourceAccess.Id = $exposedPermission.Id # Read directory data + $requiredAccess.ResourceAccess += $resourceAccess + } + } + } +} + +# +# Example: GetRequiredPermissions "Microsoft Graph" "Graph.Read|User.Read" +# See also: http://stackoverflow.com/questions/42164581/how-to-configure-a-new-azure-ad-application-through-powershell +Function GetRequiredPermissions([string] $applicationDisplayName, [string] $requiredDelegatedPermissions, [string]$requiredApplicationPermissions, $servicePrincipal) +{ + # If we are passed the service principal we use it directly, otherwise we find it from the display name (which might not be unique) + if ($servicePrincipal) + { + $sp = $servicePrincipal + } + else + { + $sp = Get-MgServicePrincipal -Filter "DisplayName eq '$applicationDisplayName'" + } + $appid = $sp.AppId + $requiredAccess = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphRequiredResourceAccess + $requiredAccess.ResourceAppId = $appid + $requiredAccess.ResourceAccess = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphResourceAccess] + + # $sp.Oauth2Permissions | Select Id,AdminConsentDisplayName,Value: To see the list of all the Delegated permissions for the application: + if ($requiredDelegatedPermissions) + { + AddResourcePermission $requiredAccess -exposedPermissions $sp.Oauth2PermissionScopes -requiredAccesses $requiredDelegatedPermissions -permissionType "Scope" + } + + # $sp.AppRoles | Select Id,AdminConsentDisplayName,Value: To see the list of all the Application permissions for the application + if ($requiredApplicationPermissions) + { + AddResourcePermission $requiredAccess -exposedPermissions $sp.AppRoles -requiredAccesses $requiredApplicationPermissions -permissionType "Role" + } + return $requiredAccess +} + + +<#.Description + This function takes a string input as a single line, matches a key value and replaces with the replacement value +#> +Function UpdateLine([string] $line, [string] $value) +{ + $index = $line.IndexOf(':') + $lineEnd = '' + + if($line[$line.Length - 1] -eq ','){ $lineEnd = ',' } + + if ($index -ige 0) + { + $line = $line.Substring(0, $index+1) + " " + '"' + $value+ '"' + $lineEnd + } + return $line +} + +<#.Description + This function takes a dictionary of keys to search and their replacements and replaces the placeholders in a text file +#> +Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable] $dictionary) +{ + $lines = Get-Content $configFilePath + $index = 0 + while($index -lt $lines.Length) + { + $line = $lines[$index] + foreach($key in $dictionary.Keys) + { + if ($line.Contains($key)) + { + $lines[$index] = UpdateLine $line $dictionary[$key] + } + } + $index++ + } + + Set-Content -Path $configFilePath -Value $lines -Force +} + +<#.Description + This function takes a string input as a single line, matches a key value and replaces with the replacement value +#> +Function ReplaceInLine([string] $line, [string] $key, [string] $value) +{ + $index = $line.IndexOf($key) + if ($index -ige 0) + { + $index2 = $index+$key.Length + $line = $line.Substring(0, $index) + $value + $line.Substring($index2) + } + return $line +} + +<#.Description + This function takes a dictionary of keys to search and their replacements and replaces the placeholders in a text file +#> +Function ReplaceInTextFile([string] $configFilePath, [System.Collections.HashTable] $dictionary) +{ + $lines = Get-Content $configFilePath + $index = 0 + while($index -lt $lines.Length) + { + $line = $lines[$index] + foreach($key in $dictionary.Keys) + { + if ($line.Contains($key)) + { + $lines[$index] = ReplaceInLine $line $key $dictionary[$key] + } + } + $index++ + } + + Set-Content -Path $configFilePath -Value $lines -Force +} + + +<#.Description + Primary entry method to create and configure app registrations +#> +Function ConfigureApplications +{ + <#.Description + This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the + configuration files in the client and service project of the visual studio solution (App.Config and Web.Config) + so that they are consistent with the Applications parameters + #> + + if (!$azureEnvironmentName) + { + $azureEnvironmentName = "Global" + } + + # Connect to the Microsoft Graph API, non-interactive is not supported for the moment (Oct 2021) + Write-Host "Connecting to Microsoft Graph" + if ($tenantId -eq "") { + Connect-MgGraph -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All" -Environment $azureEnvironmentName + } + else { + Connect-MgGraph -TenantId $tenantId -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All" -Environment $azureEnvironmentName + } + + $context = Get-MgContext + $tenantId = $context.TenantId + + # Get the user running the script + $currentUserPrincipalName = $context.Account + $user = Get-MgUser -Filter "UserPrincipalName eq '$($context.Account)'" + + # get the tenant we signed in to + $Tenant = Get-MgOrganization + $tenantName = $Tenant.DisplayName + + $verifiedDomain = $Tenant.VerifiedDomains | where {$_.Isdefault -eq $true} + $verifiedDomainName = $verifiedDomain.Name + $tenantId = $Tenant.Id + + Write-Host ("Connected to Tenant {0} ({1}) as account '{2}'. Domain is '{3}'" -f $Tenant.DisplayName, $Tenant.Id, $currentUserPrincipalName, $verifiedDomainName) + + # Create the client AAD application + Write-Host "Creating the AAD application (ciam-msal-node-webapp)" + # Get a 6 months application key for the client Application + $fromDate = [DateTime]::Now; + $key = CreateAppKey -fromDate $fromDate -durationInMonths 6 + + # create the application + $clientAadApplication = New-MgApplication -DisplayName "ciam-msal-node-webapp" ` + -Web ` + @{ ` + RedirectUris = "http://localhost:3000", "http://localhost:3000/auth/redirect"; ` + HomePageUrl = "http://localhost:3000"; ` + } ` + -SignInAudience AzureADMyOrg ` + #end of command + + #add a secret to the application + $pwdCredential = Add-MgApplicationPassword -ApplicationId $clientAadApplication.Id -PasswordCredential $key + $clientAppKey = $pwdCredential.SecretText + + $currentAppId = $clientAadApplication.AppId + $currentAppObjectId = $clientAadApplication.Id + + $tenantName = (Get-MgApplication -ApplicationId $currentAppObjectId).PublisherDomain + #Update-MgApplication -ApplicationId $currentAppObjectId -IdentifierUris @("https://$tenantName/ciam-msal-node-webapp") + + # create the service principal of the newly created application + $clientServicePrincipal = New-MgServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp} + + # add the user running the script as an app owner if needed + $owner = Get-MgApplicationOwner -ApplicationId $currentAppObjectId + if ($owner -eq $null) + { + New-MgApplicationOwnerByRef -ApplicationId $currentAppObjectId -BodyParameter @{"@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$user.ObjectId"} + Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($clientServicePrincipal.DisplayName)'" + } + Write-Host "Done creating the client application (ciam-msal-node-webapp)" + + # URL of the AAD application in the Azure portal + # Future? $clientPortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Overview/appId/"+$currentAppId+"/objectId/"+$currentAppObjectId+"/isMSAApp/" + $clientPortalUrl = "https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Overview/appId/"+$currentAppId+"/isMSAApp~/false" + + Add-Content -Value "client$currentAppIdciam-msal-node-webapp" -Path createdApps.html + # Declare a list to hold RRA items + $requiredResourcesAccess = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphRequiredResourceAccess] + + # Add Required Resources Access (from 'client' to 'Microsoft Graph') + Write-Host "Getting access from 'client' to 'Microsoft Graph'" + $requiredPermission = GetRequiredPermissions -applicationDisplayName "Microsoft Graph"` + -requiredDelegatedPermissions "openid|offline_access" + + $requiredResourcesAccess.Add($requiredPermission) + Write-Host "Added 'Microsoft Graph' to the RRA list." + # Useful for RRA additions troubleshooting + # $requiredResourcesAccess.Count + # $requiredResourcesAccess + + Update-MgApplication -ApplicationId $currentAppObjectId -RequiredResourceAccess $requiredResourcesAccess + Write-Host "Granted permissions." + + + # print the registered app portal URL for any further navigation + Write-Host "Successfully registered and configured that app registration for 'ciam-msal-node-webapp' at `n $clientPortalUrl" -ForegroundColor Green + + # Update config file for 'client' + # $configFile = $pwd.Path + "\..\App\authConfig.js" + $configFile = $(Resolve-Path ($pwd.Path + "\..\App\authConfig.js")) + + $dictionary = @{ "Enter_the_Application_Id_Here" = $clientAadApplication.AppId; "Enter_the_Tenant_Subdomain_Here" = $tenantName.Split(".onmicrosoft.com")[0]; "Enter_the_Client_Secret_Here" = $clientAppKey }; + + Write-Host "Updating the sample config '$configFile' with the following config values:" -ForegroundColor Yellow + $dictionary + Write-Host "-----------------" + + ReplaceInTextFile -configFilePath $configFile -dictionary $dictionary + Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------" + Write-Host "IMPORTANT: Please follow the instructions below to complete a few manual step(s) in the Azure portal": + Write-Host "- For client" + Write-Host " - Navigate to $clientPortalUrl" + Write-Host " - Navigate to your tenant and create user flows to allow users to sign up for the application." -ForegroundColor Red + Write-Host " - The delegated permissions for the 'client' application require admin consent. Do remember to navigate to the application registration in the app portal and consent for those." -ForegroundColor Red + Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------" + +Add-Content -Value "" -Path createdApps.html +} # end of ConfigureApplications function + +# Pre-requisites + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph")) { + Install-Module "Microsoft.Graph" -Scope CurrentUser +} + +#Import-Module Microsoft.Graph + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Authentication")) { + Install-Module "Microsoft.Graph.Authentication" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Authentication + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Identity.DirectoryManagement")) { + Install-Module "Microsoft.Graph.Identity.DirectoryManagement" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Identity.DirectoryManagement + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Applications")) { + Install-Module "Microsoft.Graph.Applications" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Applications + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Groups")) { + Install-Module "Microsoft.Graph.Groups" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Groups + +if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Users")) { + Install-Module "Microsoft.Graph.Users" -Scope CurrentUser +} + +Import-Module Microsoft.Graph.Users + +Set-Content -Value "" -Path createdApps.html +Add-Content -Value "" -Path createdApps.html + +$ErrorActionPreference = "Stop" + +# Run interactively (will ask you for the tenant ID) + +try +{ + ConfigureApplications -tenantId $tenantId -environment $azureEnvironmentName +} +catch +{ + $_.Exception.ToString() | out-host + $message = $_ + Write-Warning $Error[0] + Write-Host "Unable to register apps. Error is $message." -ForegroundColor White -BackgroundColor Red +} +Write-Host "Disconnecting from tenant" +Disconnect-MgGraph \ No newline at end of file diff --git a/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/apps.json b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/apps.json new file mode 100644 index 000000000..a60bfc9f3 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/apps.json @@ -0,0 +1,60 @@ +{ + "Sample": { + "Title": "A JavaScript single-page application using MSAL Angular to authenticate users against Azure AD for Customers", + "Client": "Node (Express) web app", + "Level": 100 + }, + "AppRegistrations": [ + { + "x-ms-id": "ciam-express-webapp", + "x-ms-name": "ms-identity-ciam-express-webapp", + "x-ms-version": "2.0", + "replyUrlsWithType": [ + { + "url": "http://localhost:3000/", + "type": "Web" + }, + { + "url": "http://localhost:3000/auth/redirect", + "type": "Web" + } + ], + "oauth2AllowImplicitFlow": false, + "oauth2AllowIdTokenImplicitFlow": false, + "x-ms-passwordCredentials": "Auto", + "passwordCredentials": [ + { + "value": "{auto}" + } + ], + "requiredResourceAccess": [ + { + "x-ms-resourceAppName": "Microsoft Graph", + "resourceAppId": "00000003-0000-0000-c000-000000000000", + "resourceAccess": [ + { + "id": "37f7f235-527c-4136-accd-4a02d197296e", + "type": "Scope", + "x-ms-name": "openid" + }, + { + "id": "7427e0e9-2fba-42fe-b0c0-848c9e6a8182", + "type": "Scope", + "x-ms-name": "offline_access" + } + ] + } + ], + "codeConfigurations": [ + { + "settingFile": "App/authConfig.js", + "replaceTokens": { + "appId": "Enter_the_Application_Id_Here", + "tenantName": "Enter_the_Tenant_Subdomain_Here", + "clientSecret": "Enter_the_Client_Secret_Here" + } + } + ] + } + ] +} \ No newline at end of file diff --git a/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/quickstart.md b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/quickstart.md new file mode 100644 index 000000000..32450451e --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/quickstart.md @@ -0,0 +1,30 @@ +--- +title: "Portal quickstart for Node (Express) web app" +description: Learn how to run a sample Node (Express) web application to sign in users +services: active-directory +author: kengaderdus +manager: mwongerapk +ms.author: kengaderdus +ms.service: active-directory +ms.workload: identity +ROBOTS: NOINDEX +ms.subservice: ciam +ms.topic: portal +ms.date: 04/19/2023 +--- +# Portal quickstart for Node (Express) web app + +> [!div renderon="portal" id="display-on-portal" class="sxs-lookup"] +> In this quickstart, you download and run a code sample that demonstrates how a Node (Express) web application that can sign in users with Azure AD for Customers. +> +> 1. Make sure you've installed [Node.js](https://nodejs.org/download/). +> 1. Unzip the sample. +> 1. Locate the sample folder in your terminal, then run the following commands: +> +> ```console +> cd App && npm install && npm start +> ``` +> +> 1. Visit `http://localhost:3000` in your browser. +> 1. Select **Sign-in** on the navigation bar, then follow the prompts. +> \ No newline at end of file diff --git a/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/sample.json b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/sample.json new file mode 100644 index 000000000..b73ab7c73 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/AppCreationScripts/sample.json @@ -0,0 +1,67 @@ +{ + "Sample": { + "Title": "A Node.js & Express web app authenticating users against Azure AD for Customers with MSAL Node", + "Level": 100, + "Client": "Node.js & Express web app", + "Languages": [ + "javascript" + ], + "Products": [ + "azure-active-directory", + "msal-node" + ], + "RepositoryUrl": "ms-identity-ciam-javascript-tutorial", + "Endpoint": "AAD v2.0", + "Provider": "CIAM", + "Platform": "JavaScript", + "description": "This sample demonstrates a Node.js & Express web app authenticating users against Azure Active Directory Customer Identity Access Management (Azure AD for Customers) with Microsoft Authentication Library for Node (MSAL Node)" + }, + "AADApps": [ + { + "Id": "client", + "Name": "ciam-msal-node-webapp", + "Kind": "WebApp", + "Audience": "AzureADMyOrg", + "HomePage": "http://localhost:3000", + "ReplyUrls": "http://localhost:3000, http://localhost:3000/auth/redirect", + "PasswordCredentials": "Auto", + "SDK": "MsalNode", + "SampleSubPath": "1-Authentication\\5-sign-in-express\\App", + "RequiredResourcesAccess": [ + { + "Resource": "Microsoft Graph", + "DelegatedPermissions": [ + "openid", + "offline_access" + ] + } + ], + "ManualSteps": [ + { + "Comment": "Navigate to your tenant and create user flows to allow users to sign up for the application." + } + ] + } + ], + "CodeConfiguration": [ + { + "App": "client", + "SettingKind": "Replace", + "SettingFile": "\\..\\App\\authConfig.js", + "Mappings": [ + { + "key": "Enter_the_Application_Id_Here", + "value": ".AppId" + }, + { + "key": "Enter_the_Tenant_Subdomain_Here", + "value": "$tenantName" + }, + { + "key": "Enter_the_Client_Secret_Here", + "value": ".AppKey" + } + ] + } + ] +} \ No newline at end of file diff --git a/1-Authentication/7-sign-in-express-mfa/README-use-certificate.md b/1-Authentication/7-sign-in-express-mfa/README-use-certificate.md new file mode 100644 index 000000000..d44415902 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/README-use-certificate.md @@ -0,0 +1,311 @@ + +# How to use certificates instead of secrets in your application(s) + +Microsoft identity platform supports two types of authentication for [confidential client applications](https://learn.microsoft.com/azure/active-directory/develop/msal-client-applications): password-based authentication (i.e. client secret) and certificate-based authentication. For a higher level of security, we recommend using a certificate (instead of a client secret) as a credential in your confidential client applications. + +In production, you should purchase a certificate signed by a well-known certificate authority, and use [Azure Key Vault](https://azure.microsoft.com/services/key-vault/) to manage certificate access and lifetime for you. For testing purposes, follow the steps below to create a self-signed certificate and configure your apps to authenticate with certificates. + +## Using certificates + +
+:information_source: Expand this to use automation + +> :warning: Make sure you have OpenSSL installed on your machine. After installation, you may need to start a new command line instance for the `openssl` command to be available on system path. +> +> ```console +> choco install openssl +> ``` + +Alternatively, download and build **OpenSSL** for your **OS** following the guide at [github.com/openssl](https://github.com/openssl/openssl#build-and-install). If you like to skip building and get a binary distributable from the community instead, check the [OpenSSL Wiki: Binaries](https://wiki.openssl.org/index.php/Binaries) page. + + +1. While inside *AppCreationScripts* folder, open a terminal. + +2. Run the [Cleanup-withCertCertificates.ps1](./Cleanup-withCertCertificates.ps1) script to delete any existing app registrations and certificates for the sample. + +```console + .\Cleanup-withCertCertificates.ps1 +``` + +3. Run the [Configure-withCertCertificates.ps1](./Configure-withCertCertificates.ps1) script to re-create the App Registration. The script will also create `.pfx` file(s) (e.g. ciam-msal-node-webapp.pfx) that you can upload to Key Vault later. When asked about a password, do remember it - you will need the password when uploading the certificate. + +```console + .\Configure-withCertCertificates.ps1 +``` + +4. Proceed to [step 3](#configure-your-apps-to-use-a-certificate) to configure application settings. + +
+ +- **Step 1: [Create a self-signed certificate](#create-a-self-signed-certificate)** + - Option 1: [create self-signed certificate on local machine](#create-self-signed-certificate-on-local-machine) + - Option 2: [create self-signed certificate on Key Vault](#create-self-signed-certificate-on-key-vault) +- **Step 2: [Configure an Azure AD app registration to use a certificate](#configure-an-azure-ad-app-registration-to-use-a-certificate)** +- **Step 3: [Configure your app(s) to use a certificate](#configure-your-apps-to-use-a-certificate)** + - Option 1: [using an existing certificate from local machine](#using-an-existing-certificate-from-local-machine) + - Option 2: [using an existing certificate from Key Vault](#using-an-existing-certificate-from-key-vault) + +If you plan to deploy your app(s) to [Azure App Service](https://learn.microsoft.com/azure/app-service/overview) afterwards, we recommend [Azure Managed Identity](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview) to completely eliminate secrets, certificates, connection strings and etc. from your source code. See [Using Managed Identity](#using-managed-identity) below for more. + +### Create a self-signed certificate + +You can skip this step if you already have a valid self-signed certificate at hand. + +#### Create self-signed certificate on local machine + +If you wish to generate a new self-signed certificate yourself, follow the steps below. +
+Click here to use OpenSSL + +Download and build **OpenSSL** for your **OS** following the guide at [github.com/openssl](https://github.com/openssl/openssl#build-and-install). If you like to skip building and get a binary distributable from the community instead, check the [OpenSSL Wiki: Binaries](https://wiki.openssl.org/index.php/Binaries) page. Afterwards, add the path to **OpenSSL** to your **environment variables** so that you can call it from anywhere. + +Type the following in a terminal. The files will be generated in the terminals current directory. + +```bash +openssl req -x509 -newkey rsa:2048 -keyout ciam-msal-node-webapp.key -out ciam-msal-node-webapp.cer -subj "/CN=ciam-msal-node-webapp" -nodes + +Generating a RSA private key +......................................................... +writing new private key to 'ciam-msal-node-webapp.key' +``` + +The following files should be generated: *ciam-msal-node-webapp.key*, *ciam-msal-node-webapp.cer* + +If you need, you can generate a ciam-msal-node-webapp.pfx (certificate + private key combination) with the command below: + +```bash +openssl pkcs12 -export -out CertificateName.pfx -inkey ciam-msal-node-webapp.key -in ciam-msal-node-webapp.cer +``` + +Enter an export password when prompted and make a note of it. The following file should be generated: *ciam-msal-node-webapp.pfx*. + +Proceed to [Step 2](#configure-an-azure-ad-app-registration-to-use-a-certificate). + +
+ +> :information_source: If you wish so, you can upload your locally generated self-signed certificate to Azure Key Vault later on. See: [Import a certificate in Azure Key Vault](https://learn.microsoft.com/azure/key-vault/certificates/tutorial-import-certificate) + +#### Create self-signed certificate on Key Vault + +You can use Azure Key Vault to generate a self-signed certificate for you. Doing so will have the additional benefits of assigning a partner Certificate Authority (CA) and automating certificate rotation. + +> :information_source: Azure Key Vault can export certificates and private keys in `pem` format (see: [Export stored certificates](https://docs.microsoft.com/azure/key-vault/certificates/how-to-export-certificate?tabs=azure-cli#export-stored-certificates)), if **Content Type** was chosen as `pem` during certificate generation (see: [Create a certificate in Key Vault](https://docs.microsoft.com/azure/key-vault/certificates/tutorial-rotate-certificates#create-a-certificate-in-key-vault)). If for some reason this is not the case, OpenSSL can be used for conversions. +> +> ```console +> cat ciam-msal-node-webapp.crt ciam-msal-node-webapp.key > ciam-msal-node-webapp.pem ## if powershell: Get-Content ciam-msal-node-webapp.crt, ciam-msal-node-webapp.key | Set-Content ciam-msal-node-webapp.pem +> openssl pkcs12 -in ciam-msal-node-webapp.pfx -out ciam-msal-node-webapp.pem +> ``` + +
+Click here to use Azure Portal + +Follow the guide: [Set and retrieve a certificate from Azure Key Vault using the Azure portal](https://learn.microsoft.com/azure/key-vault/certificates/quick-create-portal) + +Afterwards, proceed to [Step 2](#configure-an-azure-ad-app-registration-to-use-a-certificate). + +
+ +
+Click here to use Powershell + +Follow the guide: [Set and retrieve a certificate from Azure Key Vault using Azure PowerShell](https://learn.microsoft.com/azure/key-vault/certificates/quick-create-powershell) + +Afterwards, proceed to [Step 2](#configure-an-azure-ad-app-registration-to-use-a-certificate). + +
+ +### Configure an Azure AD app registration to use a certificate + +Now you must associate your Azure AD app registration with the certificate you will use in your application. + +> :information_source: If you have the certificate locally available, you can follow the steps below. If your certificate(s) is on Azure Key Vault, you must first export and download them to your computer, and delete the local copy after following the steps below. See: [Export certificates from Azure Key Vault](https://learn.microsoft.com/azure/key-vault/certificates/how-to-export-certificate) + +1. Navigate to [Azure portal](https://portal.azure.com) and select your Azure AD app registration. +1. Select **Certificates & secrets** blade on the left. +1. Click on **Upload** certificate and select the certificate file to upload (e.g. *ciam-msal-node-webapp*). +1. Click **Add**. Once the certificate is uploaded, the *thumbprint*, *start date*, and *expiration* values are displayed. Record the *thumbprint* value as you will make use of it later in your app's configuration file. + +> For more information, see: [Register your certificate with the Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials#register-your-certificate-with-microsoft-identity-platform) + +Proceed to [Step 3](#configure-your-apps-to-use-a-certificate) + +### Configure your app(s) to use a certificate + +Finally, you need to modify the app's configuration files. + +#### Using an existing certificate from local machine + +> Perform the steps below for the client app (ciam-msal-node-webapp) + +1. Open the file where MSAL is initialized (e.g. `1-Authentication\5-sign-in-express\App\app.js`). +2. *Comment out* the line for `clientSecret`: + +```javaScript + const msal = require('@azure/msal-node'); + + const msalConfig = { + auth: { + clientId: "YOUR_CLIENT_ID", + authority: "https://login.microsoftonline.com/YOUR_TENANT_ID", + //clientSecret: "YOUR_CLIENT_SECRET" + } + }; + + const cca = new msal.ConfidentialClientApplication(msalConfig); +``` + +3. *Un-comment* the lines for `clientCertificate` and replace the default values: + +```javaScript + const msal = require('@azure/msal-node'); + const fs = require('fs'); // import the fs module for reading the key file + + const msalConfig = { + auth: { + clientId: "YOUR_CLIENT_ID", + authority: "https://login.microsoftonline.com/YOUR_TENANT_ID", + //clientSecret: "YOUR_CLIENT_SECRET" + clientCertificate: { + thumbprint: "YOUR_CERT_THUMBPRINT", // replace with thumbprint obtained during step 2 above + privateKey: fs.readFileSync('PATH_TO_YOUR_PRIVATE_KEY_FILE'), // e.g. c:/Users/diego/Desktop/example.key + } + } + }; + + const cca = new msal.ConfidentialClientApplication(msalConfig); +``` + +> :information_source: For more details, see: [initializing-msal-node-with-certificates](https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-node/docs/certificate-credentials.md#initializing-msal-node-with-certificates) + +You can now start the application as instructed in the [README](./README#setup-the-sample). + +#### Using an existing certificate from Key Vault + +> Perform the steps below for the client app (ciam-msal-node-webapp) + +1. Open the file where MSAL is initialized (e.g. `1-Authentication\5-sign-in-express\App\app.js`). +2. *Comment out* the line for `clientSecret`: + +```javaScript + const msal = require('@azure/msal-node'); + + const msalConfig = { + auth: { + clientId: "YOUR_CLIENT_ID", + authority: "https://login.microsoftonline.com/YOUR_TENANT_ID", + //clientSecret: "YOUR_CLIENT_SECRET" + } + }; + + const cca = new msal.ConfidentialClientApplication(msalConfig); +``` + +3. Install **[Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli)**. Then, type the following to sign-in: + +```console + az login --tenant YOUR_TENANT_ID +``` + +4. Install the required NPM packages: + +```console + npm install --save @azure/identity @azure/keyvault-certificates @azure/keyvault-secrets +``` + +5. Update the code as shown below: + +```javaScript + const msal = require('@azure/msal-node'); + const identity = require("@azure/identity"); + const keyvaultCert = require("@azure/keyvault-certificates"); + const keyvaultSecret = require('@azure/keyvault-secrets'); + + const KV_URL = process.env["KEY_VAULT_URL"] || "ENTER_YOUR_KEY_VAULT_URL" + const CERTIFICATE_NAME = process.env["CERTIFICATE_NAME"] || "ENTER_THE_NAME_OF_YOUR_CERTIFICATE_ON_KEY_VAULT"; + + // Initialize Azure SDKs + const credential = new identity.DefaultAzureCredential(); + const certClient = new keyvaultCert.CertificateClient(KV_URL, credential); + const secretClient = new keyvaultSecret.SecretClient(KV_URL, credential); + + async function main() { + + // Grab the certificate thumbprint + const certResponse = await certClient.getCertificate(CERTIFICATE_NAME).catch(err => console.log(err)); + const thumbprint = certResponse.properties.x509Thumbprint.toString('hex') + + // When you upload a certificate to Key Vault, a secret containing your private key is automatically created + const secretResponse = await secretClient.getSecret(CERTIFICATE_NAME).catch(err => console.log(err));; + + // secretResponse contains both public and private key, but we only need the private key + const privateKey = secretResponse.value.split('-----BEGIN CERTIFICATE-----\n')[0] + + const msalConfig = { + auth: { + clientId: "YOUR_CLIENT_ID", + authority: "https://login.microsoftonline.com/YOUR_TENANT_ID", + //clientSecret: "YOUR_CLIENT_SECRET", + clientCertificate: { + thumbprint: thumbprint + privateKey: privateKey + } + } + }; + + const cca = new msal.ConfidentialClientApplication(msalConfig); + } + + main(); +``` + +> :information_source: For more details, see: [Get certificate from your Key Vault in Node.js](https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-node/docs/key-vault-managed-identity.md#get-certificate-from-your-vault-in-nodejs) + +You can now start the application as instructed in the [README](./README#setup-the-sample). + +## Using Managed Identity + +Once you deploy your app(s) to Azure App Service, you can assign a managed identity to it for accessing Azure Key Vault using its own identity. This allows you to eliminate the all secrets, certificates, connection strings and etc. from your source code. + +### Create a system-assigned identity + +1. Navigate to [Azure portal](https://portal.azure.com) and select the **Azure App Service**. +1. Find and select the App Service instance you've created previously. +1. On App Service portal, select **Identity**. +1. Within the **System assigned** tab, switch **Status** to **On**. Click **Save**. + +For more information, see [Add a system-assigned identity](https://docs.microsoft.com/azure/app-service/overview-managed-identity?tabs=dotnet#add-a-system-assigned-identity) + +### Grant access to Key Vault + +Now that your app deployed to App Service has a managed identity, in this step you grant it access to your key vault. + +1. Go to the [Azure portal](https://portal.azure.com) and search for your Key Vault. +1. Select **Overview** > **Access policies** blade on the left. +1. Click on **Add Access Policy** > **Certificate permissions** > **Get** +1. Click on **Add Access Policy** > **Secret permissions** > **Get** +1. Click on **Select Principal**, add your account and pre-created **system-assigned** identity. +1. Click on **OK** to add the new Access Policy, then click **Save** to save the Access Policy. + +For more information, see [Use Key Vault from App Service with Azure Managed Identity](https://docs.microsoft.com/samples/azure-samples/app-service-msi-keyvault-dotnet/keyvault-msi-appservice-sample/) + +### Add environment variables + +Finally, you need to add environment variables to the App Service where you deployed your app. + +> :warning: Make sure your application is able to read environment variables. Alternatively, you can hardcode the key vault URL and certificate name in your applications configuration file. + +1. In the [Azure portal](https://portal.azure.com), search for and select **App Service**, and then select your app. +1. Select **Configuration** blade on the left, then select **New Application Settings**. +1. Add the following variables (key-value pairs): + 1. **KEY_VAULT_URL**: the URL of the key vault you've created, e.g. `https://example.vault.azure.net` + 1. **CERTIFICATE_NAME**: the name of the certificate you specified when importing it to key vault, e.g. `ExampleCert` + +Wait for a few minutes for your changes on **App Service** to take effect. You should then be able to visit your published website and sign-in accordingly. + +## More information + +- [Microsoft identity platform application authentication certificate credentials](https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials) +- [Create a self-signed public certificate to authenticate your application](https://docs.microsoft.com/azure/active-directory/develop/howto-create-self-signed-certificate) +- [Various SSL/TLS certificate file types/extensions](https://docs.microsoft.com/archive/blogs/kaushal/various-ssltls-certificate-file-typesextensions) +- [Azure Key Vault Developer's Guide](https://docs.microsoft.com/azure/key-vault/general/developers-guide) +- [Managed identities for Azure resources](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview) diff --git a/1-Authentication/7-sign-in-express-mfa/README.md b/1-Authentication/7-sign-in-express-mfa/README.md new file mode 100644 index 000000000..106d13948 --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/README.md @@ -0,0 +1,371 @@ +--- +page_type: sample +name: Sign in users in a sample Node.js & have a mfa on editing profile information & Express web app by using Microsoft Entra External ID for customers +description: This sample demonstrates a Node.js with editing profile gated behind a mfa & Express web app authenticating users by using Microsoft Entra External ID for customers with Microsoft Authentication Library for Node (MSAL Node) +languages: + - javascript +products: + - entra-external-id + - msal-node +urlFragment: ms-identity-ciam-javascript-tutorial-5-sign-in-express-mfa +extensions: + services: + - active-directory + sub-service: + - ciam + platform: + - JavaScript + endpoint: + - AAD v2.0 + level: + - 100 + client: + - Node.js & Express web app +--- + +# Sign in users in a sample Node.js (Express.js) web app by using Microsoft Entra External ID for customers + +* [Overview](#overview) +* [Usage](#usage) +* [Scenario](#scenario) +* [Contents](#contents) +* [Prerequisites](#prerequisites) +* [Setup the sample](#setup-the-sample) +* [Explore the sample](#explore-the-sample) +* [Troubleshooting](#troubleshooting) +* [About the code](#about-the-code) +* [Contributing](#contributing) +* [Learn More](#learn-more) + +## Overview + +This sample demonstrates how to sign users and edit profile which requires mfa into a sample Node.js & Express web app by using Microsoft Entra External ID for customers. The samples utilizes the [Microsoft Authentication Library for Node](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-node) (MSAL Node) to simplify adding authentication to the Node.js web app. + +## Usage + +| Instruction | Description | +|-----------------------|--------------------------------------------| +| **Use case** | This code sample applies to **customer configuration uses case**![Yes button](./ReadmeFiles/yes.png "Title"). If you're looking for a workforce configuration use case, use [Tutorial: Enable a Node.js (Express) application to sign in users by using Microsoft Entra ID](https://github.com/Azure-Samples/ms-identity-node) | +| **Scenario** | Sign in users. You acquire an ID token by using authorization code flow with PKCE. Edit user profile which requires mfa | +| **Add sign in to your app** | Use the instructions in [Sign in users in a Node.js web app](https://learn.microsoft.com/entra/external-id/customers/tutorial-web-app-node-sign-in-prepare-tenant) to learn how to add sign in to your Node web app. | +|**Product documentation** | Explore [Microsoft Entra ID for customers documentation](https://learn.microsoft.com/entra/external-id/customers/) | + +## Contents + +| File/folder | Description | +|-----------------------|--------------------------------------------| +| `App/app.js` | Application entry point. | +| `App/authConfig.js` | Contains authentication parameters such as your tenant sub-domain, Application (Client) ID, app client secret and redirect URI. | +| `App/auth/AuthProvider.js` | The main authentication logic resides here. | +| `/App/views/` | This folder contains app views. This Node/Express sample app's views uses Handlebars. | +| `/App/routes/` | This folder contains app's routes. | + +## Prerequisites + +* You must install [Node.js](https://nodejs.org/en/download/) in your computer to run this sample. +* We recommend [Visual Studio Code](https://code.visualstudio.com/download) for running and editing this sample. +* Microsoft Entra ID for customers tenant. If you don't already have one, [sign up for a free trial](https://aka.ms/ciam-free-trial). +* If you'd like to use Azure services, such as hosting your app in Azure App Service, [VS Code Azure Tools](https://marketplace.visualstudio.com/items?itemName=ms-vscode.vscode-node-azure-pack) extension is recommended for interacting with Azure through VS Code Interface. + +## Register the web application in your tenant + +You can register an app in your tenant automatically by using Microsoft Graph PowerShell or via the Microsoft Entra Admin center. + +When you use Microsoft Graph PowerShell, you automatically register the applications and related objects app secrets, then modify your project config files, so you can run the app without any further action: + + +* To register your app in the Microsoft Entra admin center use the steps in [Register the web app](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#register-the-web-app). + +* To register and configure your app automatically, + +
+ Expand this section + + > :warning: If you have never used **Microsoft Graph PowerShell** before, we recommend you go through the [App Creation Scripts Guide](./AppCreationScripts/AppCreationScripts.md) once to ensure that you've prepared your environment correctly for this step. + + 1. Ensure that you have PowerShell 7 or later installed. + 1. Run the script to create your Microsoft Entra ID application and configure the code of the sample application accordingly. + 1. For interactive process in PowerShell, run: + + ```PowerShell + cd .\AppCreationScripts\ + .\Configure.ps1 -TenantId "[Optional] - your tenant id" -AzureEnvironmentName "[Optional] - Azure environment, defaults to 'Global'" + ``` + + > Other ways of running the scripts are described in [App Creation Scripts guide](./AppCreationScripts/AppCreationScripts.md). The scripts also provides a guide to automated application registration, configuration and removal which can help in your CI/CD scenarios. + + > :exclamation: NOTE: This sample can make use of client certificates. You can use **AppCreationScripts** to register an Microsoft Entra ID application with certificates. For more information see, [Use client certificate for authentication in your Node.js web app instead of client secrets](https://learn.microsoft.com/entra/external-id/customers/how-to-web-app-node-use-certificate). + +
+ +## Add app client secret + +To create a client secret for the registered application, use the steps in [Add app client secret](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#add-app-client-secret) + +## Grant API permissions + +To grant delegated permissions, use the steps in [Grant API permissions](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#grant-api-permissions). + +## Create user flow + +To create a user flow a customer can use to sign in or sign up for an application, use the steps in [Create a user flow](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#create-a-user-flow) + +## Associate the web application with the user flow + +To associate the web application with the user flow, use the steps in [Associate the web application with the user flow](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#associate-the-web-application-with-the-user-flow). + +## Clone or download sample web application + +To get the web app sample code, use the steps in [Clone or download sample web application](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#clone-or-download-sample-web-application). + +## Install project dependencies + +To install app dependencies, use the steps in [Install project dependencies](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#install-project-dependencies). + +## Configure the sample web app to use your app registration + +Once you download the sample app, you need to update it so that it uses the settings of the web app that you registered. To do so, use the steps in [Configure the sample web app](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#configure-the-sample-web-app). + +## Run and test sample web app + +You can now test the sample Node.js web app. You need to start the Node.js server and access it through your browser at `http://localhost:3000`. To do so, use the steps in [Run and test sample web app](https://learn.microsoft.com/entra/external-id/customers/sample-web-app-node-sign-in#run-and-test-sample-web-app). + +> :information_source: If the sample didn't work for you as expected, reach out to us using the [GitHub Issues](../../../../issues) page. + +## We'd love your feedback + +Were we successful in addressing your learning objective? Consider taking a moment to [share your experience with us](https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR_ivMYEeUKlEq8CxnMPgdNZUNDlUTTk2NVNYQkZSSjdaTk5KT1o4V1VVNS4u). + +## Troubleshooting + +
+ Expand for troubleshooting info + +> * Use [Stack Overflow](http://stackoverflow.com/questions/tagged/msal) to get support from the community. Ask your questions on Stack Overflow first and browse existing issues to see if someone has asked your question before. Make sure that your questions or comments are tagged with [`azure-active-directory-b2c` `node` `ms-identity` `adal` `msal-js` `msal`]. + +To provide feedback on or suggest features for Microsoft Entra ID or Microsoft Entra External ID, visit [User Voice page](https://feedback.azure.com/d365community/forum/79b1327d-d925-ec11-b6e6-000d3a4f06a4). +
+ +## About the code + +### Initialization + +In order to use MSAL Node, we instantiate the [ConfidentialClientApplication](https://learn.microsoft.com/javascript/api/@azure/msal-node/confidentialclientapplication?view=azure-node-latest): + +1. Create the configuration object, `msalConfig`, as shown in the *App/authConfig.js* file: + + ```javascript + const msalConfig = { + auth: { + clientId: process.env.CLIENT_ID || 'Enter_the_Application_Id_Here', // 'Application (client) ID' of app registration in Microsoft Entra - this value is a GUID + authority: process.env.AUTHORITY || `https://${TENANT_SUBDOMAIN}.ciamlogin.com/`, // Replace the placeholder with your tenant name + clientSecret: process.env.CLIENT_SECRET || 'Enter_the_Client_Secret_Here', // Client secret generated from the app registration in Azure portal + }, + ... + ... + }; + ``` + +1. Use the `msalConfig` object to instantiate the confidential client application shown in the *App/auth/AuthProvider.js file (`AuthProvider` class): + + ```javascript + ... + ... + getMsalInstance(msalConfig) { + return new msal.ConfidentialClientApplication(msalConfig); + } + .... + ... + ``` + +### Sign in + +The first leg of auth code flow generates an authorization code request URL, then redirects to that URL to obtain the authorization code. This first leg is implemented in the `redirectToAuthCodeUrl` method. Notice how we use MSALs [getAuthCodeUrl](https://learn.microsoft.com/javascript/api/%40azure/msal-node/confidentialclientapplication?view=azure-node-latest#@azure-msal-node-confidentialclientapplication-getauthcodeurl) method to generate authorization code URL, then redirect to the authorization code URL itself: + +```javascript + async redirectToAuthCodeUrl(req, res, next, authCodeUrlRequestParams, authCodeRequestParams, msalInstance) { + ... + ... + + try { + const authCodeUrlResponse = await msalInstance.getAuthCodeUrl(req.session.authCodeUrlRequest); + res.redirect(authCodeUrlResponse); + } catch (error) { + next(error); + } + } +``` + +In the second leg of auth code flow uses, use the authorization code to request an ID token by using MSAL's [acquireTokenByCode]() method. You can store the ID token and user account information in an express session. + +```javascript + async handleRedirect(req, res, next) { + const authCodeRequest = { + ...req.session.authCodeRequest, + code: req.body.code, // authZ code + ... + }; + + try { + const msalInstance = this.getMsalInstance(this.config.msalConfig); + msalInstance.getTokenCache().deserialize(req.session.tokenCache); + + const tokenResponse = await msalInstance.acquireTokenByCode(authCodeRequest, req.body); + + req.session.tokenCache = msalInstance.getTokenCache().serialize(); + req.session.idToken = tokenResponse.idToken; + req.session.account = tokenResponse.account; + req.session.isAuthenticated = true; + ... + ... + } catch (error) { + next(error); + } + } +``` + +### Update User information +When you the user to update the information like `display_name` or `email`, which can be done through the graphApi `patch` method [GraphApi - Update user](https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http). +```javascript + fetch(graphEndpoint, req.session.accessToken, "PATCH", { + displayName: body.displayName, + mail: body.mail, + }) +``` +This update call is gated behind MFA and mfa is preformed through [conditional access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview), where we gate a specific scope in conditional access and when we need to perform MFA we call that scope. + + +#### Register the service app (mfa-app) + +1. Navigate to the [Azure portal](https://portal.azure.com) and select the **Azure AD for Customers** service. +1. Select the **App Registrations** blade on the left, then select **New registration**. +1. In the **Register an application page** that appears, enter your application's registration information: + 1. In the **Name** section, enter a meaningful application name that will be displayed to users of the app, for example `mfa-app`. + 1. Under **Supported account types**, select **Accounts in this organizational directory only** + 1. Select **Register** to create the application. +1. In the **Overview** blade, find and note the **Application (client) ID**. You use this value in your app's configuration file(s) later in your code. +1. In the app's registration screen, select the **Expose an API** blade to the left to open the page where you can publish the permission as an API for which client applications can obtain [access tokens](https://aka.ms/access-tokens) for. The first thing that we need to do is to declare the unique [resource](https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) URI that the clients will be using to obtain access tokens for this API. To declare an resource URI(Application ID URI), follow the following steps: + 1. Select **Set** next to the **Application ID URI** to generate a URI that is unique for this app. + 1. For this sample, accept the proposed Application ID URI (`api://{clientId}`) by selecting **Save**. + > :information_source: Read more about Application ID URI at [Validation differences by supported account types (signInAudience)](https://docs.microsoft.com/azure/active-directory/develop/supported-accounts-validation). + +##### Publish Delegated Permissions + +1. All APIs must publish a minimum of one [scope](https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow#request-an-authorization-code), also called [Delegated Permission](https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent#permission-types), for the client apps to obtain an access token for a *user* successfully. To publish a scope, follow these steps: +1. Select **Add a scope** button open the **Add a scope** screen and Enter the values as indicated below: + 1. For **Scope name**, use `User.MFA`. + 1. For **Admin consent display name** type in *User MFA action the 'mfa-app'*. + 1. For **Admin consent description** type in *e.g. Create a MFA action when User requests scope.*. + 1. Keep **State** as **Enabled**. + 1. Select the **Add scope** button on the bottom to save this scope. + 1. Repeat the steps above for another scope named **User.MFA** +1. Select the **Manifest** blade on the left. + 1. Set `accessTokenAcceptedVersion` property to **2**. + 1. Select on **Save**. + +> :information_source: Follow [the principle of least privilege when publishing permissions](https://learn.microsoft.com/security/zero-trust/develop/protected-api-example) for a web API. + +##### Publish Application Permissions + +1. All APIs should publish a minimum of one [App role for applications](https://docs.microsoft.com/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps#assign-app-roles-to-applications), also called [Application Permission](https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent#permission-types), for the client apps to obtain an access token as *themselves*, i.e. when they are not signing-in a user. **Application permissions** are the type of permissions that APIs should publish when they want to enable client applications to successfully authenticate as themselves and not need to sign-in users. To publish an application permission, follow these steps: +1. Still on the same app registration, select the **App roles** blade to the left. +1. Select **Create app role**: + 1. For **Display name**, enter a suitable name for your application permission, for instance **User.MFA**. + 1. For **Allowed member types**, choose **Application** to ensure other applications can be granted this permission. + 1. For **Value**, enter **User.MFA**. + 1. For **Description**, enter *Create a MFA action when User requests scope*. + 1. Select **Apply** to save your changes. + 1. Repeat the steps above for another app permission named **User.MFA**. +1. Go to Conditional access the the azure portal [App portal for conditioal access](https://entra.microsoft.com/?feature.msaljs=true#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/fromNav/) + 1. Select **New Policy** + 1. Enter the name of the policy (e.g. "MFA Policy") + 1. Select **Users** and select thye group of users should have the mfa or selected users. + 1. Select **Target resources**, then **Select apps** selecte the **mfa-app**. + 1. Select **Grant** and select the `Grant access` and select the **Require multifactor authentication**. + 1. Select the Enable policy as **On** + 1. Select create. + +We can use this scope when requesting the update profile page so that if the User tries to open this page its asked to complete a MFA. + + +```javascript +router.get( + '/updateProfile', + isAuthenticated, // check if user is authenticated + authProvider.getToken(["User.ReadWrite", "api://{{clientId}}/user.mfa"]), // check for mfa + async function (req, res, next) { + const graphResponse = await fetch( + GRAPH_ME_ENDPOINT, + req.session.accessToken + ); + res.render("updateProfile", { + profile: graphResponse, + }); + } +); +``` + + +### Sign out + +When you want to sign the user out of the application, it isn't enough to end the user's session. You must redirect the user to the `logoutUri`. Otherwise, the user might be able to reauthenticate to your applications without reentering their credentials. If the name of your tenant is contoso, then the logoutUri looks similar to `https://contoso.ciamlogin.com/contoso.onmicrosoft.com/oauth2/v2.0/logout?post_logout_redirect_uri=http://localhost:3000`. + +```javascript + async logout(req, res, next) { + /** + * Construct a logout URI and redirect the user to end the session with Microsoft Entra ID. + */ + const logoutUri = `${this.config.msalConfig.auth.authority}${TENANT_SUBDOMAIN}.onmicrosoft.com/oauth2/v2.0/logout?post_logout_redirect_uri=${this.config.postLogoutRedirectUri}`; + + req.session.destroy(() => { + res.redirect(logoutUri); + }); + } +``` + +### Deploying Web app to Azure App Service + +There is one web app in this sample. To deploy it to **Azure App Services**, you'll need to: + +*Create an **Azure App Service** +*Publish the projects to the **App Services**, and +*Update its client(s) to call the website instead of the local environment. + +#### Deploy your files of your web app + +1. In the **VS Code** activity bar, select the **Azure** logo to show the **Azure App Service** explorer. +1. Select **Sign in to Azure...**, then follow the instructions. Once signed in, the explorer should show the name of your **Azure** subscription(s). +1. On the **App Service** explorer section you see an upward-facing arrow icon. Select it publish your local files in the project folder to **Azure App Services** (use "Browse" option if needed, and locate the right folder). +1. Choose a creation option based on the operating system to which you want to deploy. In this sample, we illustrate by using the **Linux** option. +1. Select a **Node.js** version when prompted. We recommend a **LTS** version. +1. Type a globally unique name for your web app and select **Enter**. The name must be unique across all of **Azure** services. After you respond to all the prompts, **VS Code** shows the **Azure** resources that are being created for your app in its notification popup. +1. Select **Yes** when prompted to update your configuration. This action runs `npm install` on the target **Linux** server. + +#### Update app registration to use deployed app + +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#application-developer). +1. Browse to **Identity** >**Applications** > **App registrations**. +1. From the app registration list, select the app that you want to update. +1. Under **Manage**, select **Authentication**. +1. Update your **Redirect URIs** to to match the site URL of your Azure deployment such as `https://ciam-msal-node-webapp.azurewebsites.net/auth/redirect`. +1. Select **Configure** to save your changes. + +> :warning: If your app use *in-memory* storage, **Azure App Services** will spin down your web site if it is inactive. This action empties any records in the memory. In addition, if you increase the instance count of your website, Azure Service distributes the requests among the instances. Therefore, your app's records won't be the same on each instance. + + +## Contributing + +If you'd like to contribute to this sample, see [CONTRIBUTING.MD](/CONTRIBUTING.md). + +This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. + +## Learn More + +* [Customize the default branding](https://learn.microsoft.com/entra/external-id/customers/how-to-customize-branding-customers) +* [Language customize](https://learn.microsoft.com/entra/external-id/customers/how-to-customize-languages-customers) +* [Building Zero Trust ready apps](https://aka.ms/ztdevsession) +* [Initialize client applications using MSAL.js](https://learn.microsoft.com/entra/identity-platform/msal-js-initializing-client-applications) +* [Single sign-on with MSAL.js](https://learn.microsoft.com/entra/identity-platform/msal-js-sso) +* [Handle MSAL.js exceptions and errors](https://learn.microsoft.com/entra/msal/dotnet/advanced/exceptions/msal-error-handling?tabs=javascript) +* [Logging in MSAL.js applications](https://learn.microsoft.com/entra/msal/dotnet/advanced/exceptions/msal-logging?tabs=javascript) +* [Pass custom state in authentication requests using MSAL.js](https://learn.microsoft.com/entra/identity-platform/msal-js-pass-custom-state-authentication-request). diff --git a/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/admin-center-settings-icon.png b/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/admin-center-settings-icon.png new file mode 100644 index 000000000..a3611e7b4 Binary files /dev/null and b/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/admin-center-settings-icon.png differ diff --git a/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/screenshot.png b/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/screenshot.png new file mode 100644 index 000000000..029431725 Binary files /dev/null and b/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/screenshot.png differ diff --git a/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/topology.png b/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/topology.png new file mode 100644 index 000000000..f5b02c046 Binary files /dev/null and b/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/topology.png differ diff --git a/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/yes.png b/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/yes.png new file mode 100644 index 000000000..d2285c5c4 Binary files /dev/null and b/1-Authentication/7-sign-in-express-mfa/ReadmeFiles/yes.png differ diff --git a/1-Authentication/7-sign-in-express-mfa/package-lock.json b/1-Authentication/7-sign-in-express-mfa/package-lock.json new file mode 100644 index 000000000..7398fa4fa --- /dev/null +++ b/1-Authentication/7-sign-in-express-mfa/package-lock.json @@ -0,0 +1,6 @@ +{ + "name": "7-sign-in-express-mfa", + "lockfileVersion": 3, + "requires": true, + "packages": {} +}
ApplicationAppIdUrl in the Azure portal