Changed user-flow so the home page allows anonymous access.

Author: Tiago Brenck

2-WebApp-graph-user/2-3-Multi-Tenant/Controllers/HomeController.cs

@@ -23,16 +23,18 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  */
 
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Identity.Web;
 using System.Diagnostics;
 using System.Linq;
+using System.Threading.Tasks;
 using WebApp_OpenIDConnect_DotNet.DAL;
 using WebApp_OpenIDConnect_DotNet.Models;
 
 namespace WebApp_OpenIDConnect_DotNet.Controllers
 {
-    [Authorize]
+    [AllowAnonymous]
     public class HomeController : Controller
     {
         private readonly SampleDbContext dbContext;
@@ -62,14 +64,12 @@ public IActionResult DeleteTenant(string id)
                 return RedirectToAction("Index");
         }
 
-        [AllowAnonymous]
         [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
         public IActionResult UnauthorizedTenant()
         {
             return View();
         }
 
-        [AllowAnonymous]
         [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
         public IActionResult Error()
         {

2-WebApp-graph-user/2-3-Multi-Tenant/Controllers/OnboardingController.cs

@@ -22,15 +22,15 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
  */
 
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.AzureAD.UI;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http.Extensions;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
+using System;
+using System.Linq;
+using System.Threading.Tasks;
 using WebApp_OpenIDConnect_DotNet.DAL;
 using WebApp_OpenIDConnect_DotNet.Models;
 
@@ -97,10 +97,14 @@ public async Task<IActionResult> ProcessCode(string tenant, string error, string
                 return RedirectToAction("Error", "Home");
             }
 
+            var authenticationProperties = new AuthenticationProperties { RedirectUri = "Home/Index" };
+
             // Check if tenant is already authorized
-            if(dbContext.AuthorizedTenants.FirstOrDefault(x => x.TenantId == tenant) != null)
+            if (dbContext.AuthorizedTenants.FirstOrDefault(x => x.TenantId == tenant) != null)
             {
-                return RedirectToAction("Index", "Home");
+                // Challenge an authentication so dotnet can set the user identity claims. 
+                // Since the user will have a session on AAD already, they wont need to select an account again.
+                return Challenge(authenticationProperties, AzureADDefaults.OpenIdScheme);
             }
 
             // Find a tenant carrying a TempAuthorizationCode that we previously saved
@@ -120,7 +124,9 @@ public async Task<IActionResult> ProcessCode(string tenant, string error, string
 
                 await dbContext.SaveChangesAsync();
 
-                return RedirectToAction("Index", "Home");
+                // Challenge an authentication so dotnet can set the user identity claims. 
+                // Since the user will have a session on AAD already, they wont need to select an account again.
+                return Challenge(authenticationProperties, AzureADDefaults.OpenIdScheme);
             }
         }
     }

2-WebApp-graph-user/2-3-Multi-Tenant/Controllers/TodoListController.cs

@@ -30,7 +30,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Rendering;
 using Microsoft.Identity.Web;
-using WebApp_OpenIDConnect_DotNet.BLL;
+using WebApp_OpenIDConnect_DotNet.Services;
 using WebApp_OpenIDConnect_DotNet.Models;
 using WebApp_OpenIDConnect_DotNet.Utils;
 

2-WebApp-graph-user/2-3-Multi-Tenant/README.md

@@ -43,14 +43,15 @@ For more information about apps and tenancy, see [Tenancy in Azure Active Direct
 
 This sample shows how to build a .NET Core MVC web application that uses the [OpenID Connect](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc) protocol to sign in users from multiple Azure AD tenants and acquire token for [Microsoft Graph](https://graph.microsoft.com) using the [Microsoft Authentication Library (MSAL)](https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-overview). It leverages the ASP.NET Core OpenID Connect middleware.
 
-The application puts forward a scenario where a SaaS application invites the administrators of Azure AD tenants to `enrol` their tenants into this app. This process is analogous to a customer `buying` a SaaS product.  
+The application puts forward a scenario where a SaaS application invites the administrators of Azure AD tenants to `enroll` their tenants into this app. This process is analogous to a customer `buying` a SaaS product.  
 
- 1. Once you start the application, it will ask you to sign-in as an administrator. If its your first time signing-in, you'd land on a page with a heading **Unauthorized Tenant**. Click on the **Take me to the onboarding process** button to onboard your tenant to this application.
- 1. Once you have **Registered your tenant** 
+ 1. Once you start the application, you will land in the homepage where you can sign-in or onboard your tenant.
+ 1. If you sign-in before onboarding your tenant, you'd land on a page with a heading **Unauthorized Tenant**. Click on the **Take me to the onboarding process** button to onboard your tenant to this application.
+ 1. On the onboarding page, you will be asked to sign-in as an **administrator** and accept an **admin consent** for the application.
+ 1. Once you have **registered your tenant**, all users from that tenant will be able to sign-in and explore the todo list.
 
 > Looking for previous versions of this code sample? Check out the tags on the [releases](../../releases) GitHub page.
 
-
 ## How to run this sample
 
 To run this sample:

2-WebApp-graph-user/2-3-Multi-Tenant/ReadmeFiles/topology.png

@@ -26,7 +26,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 using System.Collections.Generic;
 using System.Threading.Tasks;
 
-namespace WebApp_OpenIDConnect_DotNet.BLL
+namespace WebApp_OpenIDConnect_DotNet.Services
 {
     public interface IMSGraphService
     {

2-WebApp-graph-user/2-3-Multi-Tenant/BLL/IMSGraphService.cs renamed to 2-WebApp-graph-user/2-3-Multi-Tenant/Services/IMSGraphService.cs

@@ -27,7 +27,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 using System.Threading.Tasks;
 using WebApp_OpenIDConnect_DotNet.Models;
 
-namespace WebApp_OpenIDConnect_DotNet.BLL
+namespace WebApp_OpenIDConnect_DotNet.Services
 {
     public interface ITodoItemService
     {

2-WebApp-graph-user/2-3-Multi-Tenant/BLL/ITodoItemService.cs renamed to 2-WebApp-graph-user/2-3-Multi-Tenant/Services/ITodoItemService.cs

@@ -31,7 +31,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 using System.Net.Http.Headers;
 using System.Threading.Tasks;
 
-namespace WebApp_OpenIDConnect_DotNet.BLL
+namespace WebApp_OpenIDConnect_DotNet.Services
 {
     public class MSGraphService : IMSGraphService
     {

2-WebApp-graph-user/2-3-Multi-Tenant/BLL/MSGraphService.cs renamed to 2-WebApp-graph-user/2-3-Multi-Tenant/Services/MSGraphService.cs

@@ -32,7 +32,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 using WebApp_OpenIDConnect_DotNet.DAL;
 using WebApp_OpenIDConnect_DotNet.Models;
 
-namespace WebApp_OpenIDConnect_DotNet.BLL
+namespace WebApp_OpenIDConnect_DotNet.Services
 {
     public class TodoItemService : ITodoItemService
     {

2-WebApp-graph-user/2-3-Multi-Tenant/BLL/TodoItemService.cs renamed to 2-WebApp-graph-user/2-3-Multi-Tenant/Services/TodoItemService.cs

@@ -38,7 +38,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 using System;
 using System.Linq;
 using System.Threading.Tasks;
-using WebApp_OpenIDConnect_DotNet.BLL;
+using WebApp_OpenIDConnect_DotNet.Services;
 using WebApp_OpenIDConnect_DotNet.DAL;
 using WebApp_OpenIDConnect_DotNet.Utils;
 
@@ -79,7 +79,7 @@ public void ConfigureServices(IServiceCollection services)
 
             services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
             {
-                options.Events.OnTokenValidated = async context => 
+                options.Events.OnTokenValidated = async context =>
                 {
                     string tenantId = context.SecurityToken.Claims.FirstOrDefault(x => x.Type == "tid" || x.Type == "http://schemas.microsoft.com/identity/claims/tenantid")?.Value;