Skip to content

Commit 9c1fbc6

Browse files
author
Kalyan Krishna
committed
Minor edits and a bug fix
1 parent 6b150dc commit 9c1fbc6

File tree

11 files changed

+163
-62
lines changed

11 files changed

+163
-62
lines changed

‎1-WebApp-OIDC/1-1-MyOrg/AppCreationScripts/AppCreationScripts.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Registering the Azure Active Directory applications and updating the configuration files for this sample using PowerShell scripts
1+
# Registering the sample apps with Microsoft identity platform and updating the configuration files using PowerShell scripts
22

33
## Overview
44

@@ -9,7 +9,7 @@
99
```PowerShell
1010
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force
1111
```
12-
1. Run the script to create your Azure AD application and configure the code of the sample application accordinly. (Other ways of running the scripts are described below)
12+
1. Run the script to create your Azure AD application and configure the code of the sample application accordingly. (Other ways of running the scripts are described below)
1313
```PowerShell
1414
.\AppCreationScripts\Configure.ps1
1515
```

‎1-WebApp-OIDC/1-1-MyOrg/AppCreationScripts/Cleanup.ps1

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ param(
55
[string] $tenantId
66
)
77

8-
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
8+
if ($null -eq (Get-Module -ListAvailable -Name "AzureAD")) {
99
Install-Module "AzureAD" -Scope CurrentUser
1010
}
1111
Import-Module AzureAD
12-
$ErrorActionPreference = 'Stop'
12+
$ErrorActionPreference = "Stop"
1313

1414
Function Cleanup
1515
{
@@ -44,20 +44,27 @@ This function removes the Azure AD applications for the sample. These applicatio
4444
$tenantId = $creds.Tenant.Id
4545
}
4646
$tenant = Get-AzureADTenantDetail
47-
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
47+
$tenantName = ($tenant.VerifiedDomains | Where-Object { $_._Default -eq $True }).Name
4848

4949
# Removes the applications
5050
Write-Host "Cleaning-up applications from tenant '$tenantName'"
5151

5252
Write-Host "Removing 'webApp' (WebApp) if needed"
53-
$app=Get-AzureADApplication -Filter "DisplayName eq 'WebApp'"
53+
Get-AzureADApplication -Filter "DisplayName eq 'WebApp'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
54+
$apps = Get-AzureADApplication -Filter "DisplayName eq 'WebApp'"
55+
if ($apps)
56+
{
57+
Remove-AzureADApplication -ObjectId $apps.ObjectId
58+
}
5459

55-
if ($app)
60+
foreach ($app in $apps)
5661
{
5762
Remove-AzureADApplication -ObjectId $app.ObjectId
58-
Write-Host "Removed."
63+
Write-Host "Removed WebApp.."
5964
}
60-
65+
# also remove service principals of this app
66+
Get-AzureADServicePrincipal -filter "DisplayName eq 'WebApp'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
67+
6168
}
6269

63-
Cleanup -Credential $Credential -tenantId $TenantId
70+
Cleanup -Credential $Credential -tenantId $TenantId

‎1-WebApp-OIDC/1-1-MyOrg/AppCreationScripts/Configure.ps1

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,16 @@ Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable]
5656
Set-Content -Value "<html><body><table>" -Path createdApps.html
5757
Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the Azure portal</th></tr></thead><tbody>" -Path createdApps.html
5858

59+
$ErrorActionPreference = "Stop"
60+
5961
Function ConfigureApplications
6062
{
6163
<#.Description
6264
This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the
6365
configuration files in the client and service project of the visual studio solution (App.Config and Web.Config)
6466
so that they are consistent with the Applications parameters
6567
#>
68+
$commonendpoint = "common"
6669

6770
# $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
6871
# into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
@@ -93,11 +96,12 @@ Function ConfigureApplications
9396
$tenant = Get-AzureADTenantDetail
9497
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
9598

96-
# Get the user running the script
99+
# Get the user running the script to add the user as the app owner
97100
$user = Get-AzureADUser -ObjectId $creds.Account.Id
98101

99102
# Create the webApp AAD application
100103
Write-Host "Creating the AAD application (WebApp)"
104+
# create the application
101105
$webAppAadApplication = New-AzureADApplication -DisplayName "WebApp" `
102106
-HomePage "https://localhost:44321/" `
103107
-LogoutUrl "https://localhost:44321/signout-oidc" `
@@ -106,17 +110,19 @@ Function ConfigureApplications
106110
-Oauth2AllowImplicitFlow $true `
107111
-PublicClient $False
108112

113+
# create the service principal of the newly created application
109114
$currentAppId = $webAppAadApplication.AppId
110115
$webAppServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
111116

112117
# add the user running the script as an app owner if needed
113118
$owner = Get-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId
114119
if ($owner -eq $null)
115120
{
116-
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
117-
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
121+
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
122+
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
118123
}
119124

125+
120126
Write-Host "Done creating the webApp application (WebApp)"
121127

122128
# URL of the AAD application in the Azure portal
@@ -130,14 +136,15 @@ Function ConfigureApplications
130136
Write-Host "Updating the sample code ($configFile)"
131137
$dictionary = @{ "ClientId" = $webAppAadApplication.AppId;"TenantId" = $tenantId;"Domain" = $tenantName };
132138
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
133-
139+
134140
Add-Content -Value "</tbody></table></body></html>" -Path createdApps.html
135141
}
136142

137143
# Pre-requisites
138144
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
139145
Install-Module "AzureAD" -Scope CurrentUser
140-
}
146+
}
147+
141148
Import-Module AzureAD
142149

143150
# Run interactively (will ask you for the tenant ID)

‎1-WebApp-OIDC/1-2-AnyOrg/AppCreationScripts/AppCreationScripts.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Registering the Azure Active Directory applications and updating the configuration files for this sample using PowerShell scripts
1+
# Registering the sample apps with Microsoft identity platform and updating the configuration files using PowerShell scripts
22

33
## Overview
44

@@ -9,7 +9,7 @@
99
```PowerShell
1010
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force
1111
```
12-
1. Run the script to create your Azure AD application and configure the code of the sample application accordinly. (Other ways of running the scripts are described below)
12+
1. Run the script to create your Azure AD application and configure the code of the sample application accordingly. (Other ways of running the scripts are described below)
1313
```PowerShell
1414
.\AppCreationScripts\Configure.ps1
1515
```

‎1-WebApp-OIDC/1-2-AnyOrg/AppCreationScripts/Cleanup.ps1

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ param(
55
[string] $tenantId
66
)
77

8-
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
8+
if ($null -eq (Get-Module -ListAvailable -Name "AzureAD")) {
99
Install-Module "AzureAD" -Scope CurrentUser
1010
}
1111
Import-Module AzureAD
12-
$ErrorActionPreference = 'Stop'
12+
$ErrorActionPreference = "Stop"
1313

1414
Function Cleanup
1515
{
@@ -44,20 +44,27 @@ This function removes the Azure AD applications for the sample. These applicatio
4444
$tenantId = $creds.Tenant.Id
4545
}
4646
$tenant = Get-AzureADTenantDetail
47-
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
47+
$tenantName = ($tenant.VerifiedDomains | Where-Object { $_._Default -eq $True }).Name
4848

4949
# Removes the applications
5050
Write-Host "Cleaning-up applications from tenant '$tenantName'"
5151

5252
Write-Host "Removing 'webApp' (WebApp) if needed"
53-
$app=Get-AzureADApplication -Filter "DisplayName eq 'WebApp'"
53+
Get-AzureADApplication -Filter "DisplayName eq 'WebApp'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
54+
$apps = Get-AzureADApplication -Filter "DisplayName eq 'WebApp'"
55+
if ($apps)
56+
{
57+
Remove-AzureADApplication -ObjectId $apps.ObjectId
58+
}
5459

55-
if ($app)
60+
foreach ($app in $apps)
5661
{
5762
Remove-AzureADApplication -ObjectId $app.ObjectId
58-
Write-Host "Removed."
63+
Write-Host "Removed WebApp.."
5964
}
60-
65+
# also remove service principals of this app
66+
Get-AzureADServicePrincipal -filter "DisplayName eq 'WebApp'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
67+
6168
}
6269

63-
Cleanup -Credential $Credential -tenantId $TenantId
70+
Cleanup -Credential $Credential -tenantId $TenantId

‎1-WebApp-OIDC/1-2-AnyOrg/AppCreationScripts/Configure.ps1

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,16 @@ Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable]
5656
Set-Content -Value "<html><body><table>" -Path createdApps.html
5757
Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the Azure portal</th></tr></thead><tbody>" -Path createdApps.html
5858

59+
$ErrorActionPreference = "Stop"
60+
5961
Function ConfigureApplications
6062
{
6163
<#.Description
6264
This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the
6365
configuration files in the client and service project of the visual studio solution (App.Config and Web.Config)
6466
so that they are consistent with the Applications parameters
6567
#>
68+
$commonendpoint = "common"
6669

6770
# $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
6871
# into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
@@ -93,11 +96,12 @@ Function ConfigureApplications
9396
$tenant = Get-AzureADTenantDetail
9497
$tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
9598

96-
# Get the user running the script
99+
# Get the user running the script to add the user as the app owner
97100
$user = Get-AzureADUser -ObjectId $creds.Account.Id
98101

99102
# Create the webApp AAD application
100103
Write-Host "Creating the AAD application (WebApp)"
104+
# create the application
101105
$webAppAadApplication = New-AzureADApplication -DisplayName "WebApp" `
102106
-HomePage "https://localhost:44321/" `
103107
-LogoutUrl "https://localhost:44321/signout-oidc" `
@@ -107,17 +111,19 @@ Function ConfigureApplications
107111
-Oauth2AllowImplicitFlow $true `
108112
-PublicClient $False
109113

114+
# create the service principal of the newly created application
110115
$currentAppId = $webAppAadApplication.AppId
111116
$webAppServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
112117

113118
# add the user running the script as an app owner if needed
114119
$owner = Get-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId
115120
if ($owner -eq $null)
116121
{
117-
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
118-
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
122+
Add-AzureADApplicationOwner -ObjectId $webAppAadApplication.ObjectId -RefObjectId $user.ObjectId
123+
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($webAppServicePrincipal.DisplayName)'"
119124
}
120125

126+
121127
Write-Host "Done creating the webApp application (WebApp)"
122128

123129
# URL of the AAD application in the Azure portal
@@ -129,16 +135,17 @@ Function ConfigureApplications
129135
# Update config file for 'webApp'
130136
$configFile = $pwd.Path + "\..\appsettings.json"
131137
Write-Host "Updating the sample code ($configFile)"
132-
$dictionary = @{ "ClientId" = $webAppAadApplication.AppId;"TenantId" = "organizations";"Domain" = $tenantName };
138+
$dictionary = @{ "ClientId" = $webAppAadApplication.AppId;"TenantId" = organizations;"Domain" = $tenantName };
133139
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
134-
140+
135141
Add-Content -Value "</tbody></table></body></html>" -Path createdApps.html
136142
}
137143

138144
# Pre-requisites
139145
if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
140146
Install-Module "AzureAD" -Scope CurrentUser
141-
}
147+
}
148+
142149
Import-Module AzureAD
143150

144151
# Run interactively (will ask you for the tenant ID)

‎1-WebApp-OIDC/1-2-AnyOrg/README-1-1-to-1-2.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,11 @@ The actual sign-in audience (accounts to sign-in) is the lowest set of what is s
4444
- setting in the portal the **Supported account types** to **Accounts in any organizational directory and personal Microsoft accounts (e.g. Skype, Xbox, Outlook.com)** and set the `TenantId` value to `"organizations"` in the **appsettings.json** file
4545
- setting in the portal the **Supported account types** to **Accounts in any organizational directory** and set the `TenantId` value to `"common"` in the **appsettings.json** file
4646

47-
## How to restrict users from specific organizations to sign-in to your web app
47+
## How to restrict users from specific organizations from signing-in your web app
4848

49-
In order to restrict users from specific organizations to sign-in to your web app, you'll need to follow the steps above, and customize a bit more the code to restrict the valid token issuers. The token issuers are really the tenanted Azure AD authority which are allowed to issue a token to access your web application.
49+
In order to restrict users from specific organizations from signing-in to your web app, you'll need to customize your code a bit more to restrict issuers. In Azure AD, the token issuers are the Azure AD tenants which issue tokens to applications.
5050

51-
In the `Startup.cs` file, in the `ConfigureServices` method, after `services.AddMicrosoftIdentityPlatformAuthentication(Configuration)` add some code to validate specific issuers by overriding the `TokenValidationParameters.IssuerValidator` delegate.
51+
In the `Startup.cs` file, in the `ConfigureServices` method, after `services.AddMicrosoftIdentityPlatformAuthentication(Configuration)` add some code to filter issuers by overriding the `TokenValidationParameters.IssuerValidator` delegate.
5252

5353
```CSharp
5454
public void ConfigureServices(IServiceCollection services)
@@ -79,7 +79,7 @@ An example of code for `ValidateSpecificIssuers` is the following:
7979
}
8080
else
8181
{
82-
throw new SecurityTokenInvalidIssuerException("The accounts does not belong to one of the tenants that this Web App accepts to sign-in.");
82+
throw new SecurityTokenInvalidIssuerException("The sign-in user's account does not belong to one of the tenants that this Web App accepts users from.");
8383
}
8484
}
8585

@@ -97,6 +97,8 @@ An example of code for `ValidateSpecificIssuers` is the following:
9797
}
9898
```
9999

100+
> If you are building a SaaS application that will be used in multiple Azure AD tenants, the please note that there are a number of steps that a SaaS developer should be aware of and is beyond the scope of this article. You are advised to go through the the multi-tenant app developer's guide [Build a multi-tenant SaaS web application that calls Microsoft Graph using Azure AD & OpenID Connect](../2-WebApp-graph-user/2-3-Multi-Tenant/Readme.md) as well.
101+
100102
## Next steps
101103

102104
- Learn how to enable [any Microsoft accounts](../1-3-AnyOrgOrPersonal) to sign-in to your application

0 commit comments

Comments
 (0)