Skip to content

Commit 3315d1e

Browse files
author
Kalyan Krishna
committed
Updated the roles samples as well
1 parent 7664665 commit 3315d1e

File tree

8 files changed

+220
-194
lines changed

8 files changed

+220
-194
lines changed

‎5-WebApp-AuthZ/5-1-Roles/AppCreationScripts/AppCreationScripts.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Registering the sample apps with Microsoft Identity Platform and updating the configuration files using PowerShell scripts
1+
# Registering the sample apps with Microsoft identity platform and updating the configuration files using PowerShell scripts
22

33
## Overview
44

‎5-WebApp-AuthZ/5-1-Roles/AppCreationScripts/Configure.ps1

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,42 @@ Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable]
133133

134134
Set-Content -Path $configFilePath -Value $lines -Force
135135
}
136+
<#.Description
137+
This function creates a new Azure AD scope (OAuth2Permission) with default and provided values
138+
#>
139+
Function CreateScope( [string] $value, [string] $userConsentDisplayName, [string] $userConsentDescription, [string] $adminConsentDisplayName, [string] $adminConsentDescription)
140+
{
141+
$scope = New-Object Microsoft.Open.AzureAD.Model.OAuth2Permission
142+
$scope.Id = New-Guid
143+
$scope.Value = $value
144+
$scope.UserConsentDisplayName = $userConsentDisplayName
145+
$scope.UserConsentDescription = $userConsentDescription
146+
$scope.AdminConsentDisplayName = $adminConsentDisplayName
147+
$scope.AdminConsentDescription = $adminConsentDescription
148+
$scope.IsEnabled = $true
149+
$scope.Type = "User"
150+
return $scope
151+
}
152+
153+
<#.Description
154+
This function creates a new Azure AD AppRole with default and provided values
155+
#>
156+
Function CreateAppRole([string] $types, [string] $name, [string] $description)
157+
{
158+
$appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
159+
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
160+
$typesArr = $types.Split(',')
161+
foreach($type in $typesArr)
162+
{
163+
$appRole.AllowedMemberTypes.Add($type);
164+
}
165+
$appRole.DisplayName = $name
166+
$appRole.Id = New-Guid
167+
$appRole.IsEnabled = $true
168+
$appRole.Description = $description
169+
$appRole.Value = $name;
170+
return $appRole
171+
}
136172

137173
Set-Content -Value "<html><body><table>" -Path createdApps.html
138174
Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the Azure portal</th></tr></thead><tbody>" -Path createdApps.html
@@ -207,11 +243,15 @@ Function ConfigureApplications
207243
{
208244
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
209245
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
210-
211-
# assign the current user to the app as well
212-
New-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId -PrincipalId $user.ObjectId -ResourceId $webAppServicePrincipal.ObjectId -Id ([Guid]::Empty)
213246
}
214247

248+
# Add application Roles
249+
$appRoles = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.AppRole]
250+
$newRole = CreateAppRole -types "User" -name "UserReaders" -description "User readers can read basic profiles of all users in the directory."
251+
$appRoles.Add($newRole)
252+
$newRole = CreateAppRole -types "User" -name "DirectoryViewers" -description "Directory viewers can view objects in the whole directory."
253+
$appRoles.Add($newRole)
254+
Set-AzureADApplication -ObjectId $webAppAadApplication.ObjectId -AppRoles $appRoles
215255

216256
Write-Host "Done creating the webApp application (WebApp-RolesClaims)"
217257

@@ -243,7 +283,7 @@ Function ConfigureApplications
243283
Write-Host "IMPORTANT: Please follow the instructions below to complete a few manual step(s) in the Azure portal":
244284
Write-Host "- For 'webApp'"
245285
Write-Host " - Navigate to '$webAppPortalUrl'"
246-
Write-Host " - Run the ..\CreateUsersAndRoles.ps1 command to automatically create a number of users, app roles and assign users to these roles or refer to the 'Define your application roles' section in README on how to configure your newly created app further for this sample." -ForegroundColor Red
286+
Write-Host " - You can run the ..\CreateUsersAndAssignRoles.ps1 command to automatically create a number of users, and assign users to these roles or assign users to this application app roles using the portal.To receive the `roles` claim with the name of the app roles this user is assigned to, make sure that the user accounts you plan to sign-in to this app is assigned to the app roles of this app. The guide, https://docs.microsoft.com/azure/active-directory/manage-apps/assign-user-or-group-access-portal#assign-a-user-to-an-app---portal provides step by step instructions." -ForegroundColor Red
247287

248288
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
249289

‎5-WebApp-AuthZ/5-1-Roles/AppCreationScripts/CreateUsersAndRoles.ps1 renamed to ‎5-WebApp-AuthZ/5-1-Roles/AppCreationScripts/CreateUsersAndAssignRoles.ps1

Lines changed: 8 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ param(
1818
There are four ways to run this script. For more information, read the AppCreationScripts.md file in the same folder as this script.
1919
#>
2020

21+
$ErrorActionPreference = "Stop"
22+
2123
# Create an application role of given name and description
2224
Function CreateAppRole([string] $Name, [string] $Description)
2325
{
@@ -88,30 +90,21 @@ Function CreateRolesUsersAndRoleAssignments
8890

8991
# Get the user running the script
9092
$user = Get-AzureADUser -ObjectId $creds.Account.Id
91-
92-
# Add application Roles
93-
$directoryViewerRole = CreateAppRole -Name "DirectoryViewers" -Description "Directory viewers can view objects in the whole directory."
94-
$userreaderRole = CreateAppRole -Name "UserReaders" -Description "User readers can read basic profiles of all users in the directory"
95-
96-
$appRoles = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.AppRole]
97-
$appRoles.Add($directoryViewerRole)
98-
$appRoles.Add($userreaderRole)
99-
93+
10094
# Add the roles
10195
Write-Host "Adding app roles to to the app 'WebApp-RolesClaims' in tenant '$tenantName'"
10296

10397
$app=Get-AzureADApplication -Filter "DisplayName eq 'WebApp-RolesClaims'"
10498

10599
if ($app)
106100
{
107-
$servicePrincipal = Get-AzureADServicePrincipal -Filter "AppId eq '$($app.AppId)'"
101+
$servicePrincipal = Get-AzureADServicePrincipal -Filter "AppId eq '$($app.AppId)'"
102+
103+
$directoryViewerRole = $servicePrincipal.AppRoles | Where-Object { $_.DisplayName -eq "DirectoryViewers" }
104+
$userreaderRole = $servicePrincipal.AppRoles | Where-Object { $_.DisplayName -eq "UserReaders" }
108105

109-
Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles
110-
111106
$appName = $app.DisplayName
112-
113-
Write-Host "Successfully added app roles to the app '$appName'."
114-
107+
115108
Write-Host "Creating users and assigning them to roles."
116109

117110
# Create users

‎5-WebApp-AuthZ/5-1-Roles/AppCreationScripts/sample.json

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"Sample": {
3-
"Title": "Add authorization using app roles & roles claims to an ASP.NET Core Web app thats signs-in users with the Microsoft identity platform",
3+
"Title": "Add authorization using app roles & roles claims to an ASP.NET Core Web app that signs-in users with the Microsoft identity platform",
44
"Level": 300,
5-
"Client": "ASP.NET Core 2.x Web App",
5+
"Client": "ASP.NET Core Web App",
66
"Service": "Microsoft Graph",
77
"RepositoryUrl": "microsoft-identity-platform-aspnetcore-webapp-tutorial",
88
"Endpoint": "AAD v2.0"
@@ -21,14 +21,26 @@
2121
"ReplyUrls": "https://localhost:44321/, https://localhost:44321/signin-oidc",
2222
"LogoutUrl": "https://localhost:44321/signout-oidc",
2323
"PasswordCredentials": "Auto",
24-
"GroupMembershipClaims": "SecurityGroup",
24+
"AppRoles": [
25+
{
26+
"Types" : ["User"],
27+
"Name" : "UserReaders",
28+
"Description" : "User readers can read basic profiles of all users in the directory."
29+
},
30+
{
31+
"Types" : ["User"],
32+
"Name" : "DirectoryViewers",
33+
"Description" : "Directory viewers can view objects in the whole directory."
34+
}
35+
],
2536
"RequiredResourcesAccess": [
2637
{
2738
"Resource": "Microsoft Graph",
2839
"DelegatedPermissions": [ "User.Read", "User.ReadBasic.All","Directory.Read.All" ]
2940
}
3041
],"ManualSteps": [
31-
{ "Comment": "Run the ..\\CreateUsersAndRoles.ps1 command to automatically create a number of users, app roles and assign users to these roles or refer to the 'Define your application roles' section in README on how to configure your newly created app further for this sample." }
42+
{ "Comment": "You can run the ..\\CreateUsersAndAssignRoles.ps1 command to automatically create a number of users, and assign users to these roles or assign users to this application app roles using the portal.To receive the `roles` claim with the name of the app roles this user is assigned to, make sure that the user accounts you plan to sign-in to this app is assigned to the app roles of this app. The guide, https://docs.microsoft.com/azure/active-directory/manage-apps/assign-user-or-group-access-portal#assign-a-user-to-an-app---portal provides step by step instructions." }
43+
3244
]
3345
}
3446
],

0 commit comments

Comments
 (0)