Skip to content

Commit bce3cd0

Browse files
derisenderisen
committed
review changes
1 parent 4491b3e commit bce3cd0

File tree

8 files changed

+42
-26
lines changed

8 files changed

+42
-26
lines changed

‎2-WebApp-graph-user/2-6-BFF-Proxy/AppCreationScripts/AppCreationScripts.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,14 @@
1515

1616
- [Goal of the provided scripts](#goal-of-the-provided-scripts)
1717
- [Presentation of the scripts](#presentation-of-the-scripts)
18-
- [Usage pattern for tests and DevOps scenarios](#usage-pattern-for-tests-and-DevOps-scenarios)
18+
- [Usage pattern for tests and DevOps scenarios](#usage-pattern-for-tests-and-devops-scenarios)
1919
- [How to use the app creation scripts?](#how-to-use-the-app-creation-scripts)
2020
- [Pre-requisites](#pre-requisites)
2121
- [Run the script and start running](#run-the-script-and-start-running)
22-
- [Four ways to run the script](#four-ways-to-run-the-script)
22+
- [Two ways to run the script](#two-ways-to-run-the-script)
2323
- [Option 1 (interactive)](#option-1-interactive)
24-
- [Option 2 (Interactive, but create apps in a specified tenant)](#option-3-Interactive-but-create-apps-in-a-specified-tenant)
25-
- [Running the script on Azure Sovereign clouds](#running-the-script-on-Azure-Sovereign-clouds)
24+
- [Option 2 (Interactive, but create apps in a specified tenant)](#option-2-Interactive-but-create-apps-in-a-specified-tenant)
25+
- [Running the script on Azure Sovereign clouds](#running-the-script-on-azure-sovereign-clouds)
2626

2727
## Goal of the provided scripts
2828

@@ -52,7 +52,7 @@ The `Configure.ps1` will stop if it tries to create an Azure AD application whic
5252

5353
### Pre-requisites
5454

55-
1. PowerShell 7 or later (see: [installing PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell))
55+
1. PowerShell 7 or later (see: [installing PowerShell](https://learn.microsoft.com/powershell/scripting/install/installing-powershell))
5656
1. Open PowerShell (On Windows, press `Windows-R` and type `PowerShell` in the search window)
5757

5858
### (Optionally) install Microsoft.Graph.Applications PowerShell modules
@@ -82,7 +82,7 @@ The scripts install the required PowerShell module (Microsoft.Graph.Applications
8282
cd AppCreationScripts
8383
```
8484
85-
1. Run the scripts. See below for the [four options](#four-ways-to-run-the-script) to do that.
85+
1. Run the scripts. See below for the [two options](#two-ways-to-run-the-script) to do that.
8686
1. Open the Visual Studio solution, and in the solution's context menu, choose **Set Startup Projects**.
8787
1. select **Start** for the projects
8888

‎2-WebApp-graph-user/2-6-BFF-Proxy/AppCreationScripts/Configure-WithCertificates.ps1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ Function ConfigureApplications
236236
$owner = Get-MgApplicationOwner -ApplicationId $currentAppObjectId
237237
if ($owner -eq $null)
238238
{
239-
New-MgApplicationOwnerByRef -ApplicationId $currentAppObjectId -BodyParameter = @{"@odata.id" = "htps://graph.microsoft.com/v1.0/directoryObjects/$user.ObjectId"}
239+
New-MgApplicationOwnerByRef -ApplicationId $currentAppObjectId -BodyParameter @{"@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$user.ObjectId"}
240240
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($clientServicePrincipal.DisplayName)'"
241241
}
242242

@@ -284,7 +284,7 @@ Function ConfigureApplications
284284
# $configFile = $pwd.Path + "\..\CallGraphBFF\appsettings.json"
285285
$configFile = $(Resolve-Path ($pwd.Path + "\..\CallGraphBFF\appsettings.json"))
286286

287-
$dictionary = @{ "TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"ClientSecret" = $pwdCredential.SecretText };
287+
$dictionary = @{ "TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"ClientSecret" = $clientAppKey };
288288

289289
Write-Host "Updating the sample config '$configFile' with the following config values:" -ForegroundColor Yellow
290290
$dictionary

‎2-WebApp-graph-user/2-6-BFF-Proxy/AppCreationScripts/Configure.ps1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@ Function ConfigureApplications
218218
$owner = Get-MgApplicationOwner -ApplicationId $currentAppObjectId
219219
if ($owner -eq $null)
220220
{
221-
New-MgApplicationOwnerByRef -ApplicationId $currentAppObjectId -BodyParameter = @{"@odata.id" = "htps://graph.microsoft.com/v1.0/directoryObjects/$user.ObjectId"}
221+
New-MgApplicationOwnerByRef -ApplicationId $currentAppObjectId -BodyParameter @{"@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$user.ObjectId"}
222222
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($clientServicePrincipal.DisplayName)'"
223223
}
224224

@@ -266,7 +266,7 @@ Function ConfigureApplications
266266
# $configFile = $pwd.Path + "\..\CallGraphBFF\appsettings.json"
267267
$configFile = $(Resolve-Path ($pwd.Path + "\..\CallGraphBFF\appsettings.json"))
268268

269-
$dictionary = @{ "TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"ClientSecret" = $pwdCredential.SecretText };
269+
$dictionary = @{ "TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"ClientSecret" = $clientAppKey };
270270

271271
Write-Host "Updating the sample config '$configFile' with the following config values:" -ForegroundColor Yellow
272272
$dictionary

‎2-WebApp-graph-user/2-6-BFF-Proxy/AppCreationScripts/sample.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
},
6262
{
6363
"key": "ClientSecret",
64-
"value": "$pwdCredential.SecretText"
64+
"value": ".AppKey"
6565
}
6666
]
6767
}

‎2-WebApp-graph-user/2-6-BFF-Proxy/CallGraphBFF/Program.cs

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,6 @@
3838
options.Events = new CustomCookieAuthenticationEvents(); // modifies the behavior of certain cookie authentication events.
3939
});
4040

41-
builder.Services.AddControllersWithViews()
42-
.AddMicrosoftIdentityUI();
43-
4441
var app = builder.Build();
4542

4643
// Configure the HTTP request pipeline.

‎2-WebApp-graph-user/2-6-BFF-Proxy/CallGraphBFF/appsettings.json

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,20 @@
33
"Instance": "https://login.microsoftonline.com/",
44
"TenantId": "[Enter 'common', or 'organizations' or the Tenant Id (obtained from the Azure portal. Select 'Endpoints' from the 'App registrations' blade and use the GUID in any of the URLs), e.g. da41245a5-11b3-996c-00a8-4d99re19f292]",
55
"ClientId": "[Enter the Client Id (Application ID obtained from the Azure portal), e.g. ba74781c2-53c2-442a-97c2-3d60re42f403]",
6-
"ClientSecret": "[Copy the client secret added to the app from the Azure portal]",
7-
//"ClientCertificates": [
8-
// {
9-
// "SourceType": "StoreWithDistinguishedName",
10-
// "CertificateStorePath": "CurrentUser/My",
11-
// "CertificateDistinguishedName": "CN=CallGraphBFF"
12-
// }
13-
//],
14-
"ClientCapabilities": [ "CP1" ],
6+
"ClientCredentials": [
7+
{
8+
"SourceType": "ClientSecret",
9+
"ClientSecret": "[Copy the client secret added to the app from the Azure portal]"
10+
},
11+
// {
12+
// "SourceType": "StoreWithDistinguishedName",
13+
// "CertificateStorePath": "CurrentUser/My",
14+
// "CertificateDistinguishedName": "CN=CallGraphBFF"
15+
// }
16+
],
17+
"ClientCapabilities": [
18+
"CP1"
19+
],
1520
"CallbackPath": "/api/auth/signin-oidc",
1621
"SignedOutCallbackPath": "/api/auth/signout-oidc"
1722
},

‎2-WebApp-graph-user/2-6-BFF-Proxy/README-use-certificate.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ In production, you should purchase a certificate signed by a well-known certific
99

1010
<details>
1111
<summary>:information_source: Expand this to use automation</summary>
12-
12+
1313
1. While inside *AppCreationScripts* folder, open a terminal.
1414

1515
2. Run the [Cleanup-withCertCertificates.ps1](./Cleanup-withCertCertificates.ps1) script to delete any existing app registrations and certificates for the sample.

‎2-WebApp-graph-user/2-6-BFF-Proxy/README.md

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ extensions:
3535

3636
## Overview
3737

38-
This sample demonstrates a React single-page application (SPA) with an ASP.NET Core backend that authenticates users and calls the Microsoft Graph API using the backend for frontend (BFF) proxy architecture. In this architecture, access tokens are retrieved and stored within the secure backend context, and the client side JavaScript application, which is served by the ASP.NET web app, is only indirectly involved in the authN/authZ process by routing the token and API requests to the backend. The trust between the frontend and backend is established via a secure cookie upon successful sign-in.
38+
This sample demonstrates a React single-page application (SPA) with an ASP.NET Core backend that authenticates users and calls the Microsoft Graph API using the [backend for frontend (BFF) proxy architecture](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps-13). In this architecture, access tokens are retrieved and stored within the secure backend context, and the client side JavaScript application, which is served by the ASP.NET web app, is only indirectly involved in the authN/authZ process by routing the token and API requests to the backend. The trust between the frontend and backend is established via a secure cookie upon successful sign-in.
3939

4040
> :information_source: To learn how applications integrate with [Microsoft Graph](https://aka.ms/graph), consider going through the recorded session: [An introduction to Microsoft Graph for developers](https://www.youtube.com/watch?v=EBbnpFdB92A)
4141
@@ -46,7 +46,21 @@ This sample demonstrates a React single-page application (SPA) with an ASP.NET C
4646
1. ASP.NET Core web app uses the **access token** as a *bearer* token to authorize the user to call the Microsoft Graph API protected by **Azure AD**.
4747
1. ASP.NET Core web app returns the Microsoft Graph `/me` endpoint response back to the React SPA.
4848

49-
![Scenario Image](./ReadmeFiles/sequence.png)
49+
```mermaid
50+
sequenceDiagram
51+
participant Frontend
52+
participant Backend
53+
participant Azure AD
54+
participant Graph
55+
Frontend-)+Backend: /login
56+
Backend-)+Azure AD: login.microsoftonline.com
57+
Azure AD--)-Backend: token response
58+
Backend--)-Frontend: /login response (auth state)
59+
Frontend-)+Backend: /profile
60+
Backend-)+Graph: graph.microsoft.com/v1.0/me
61+
Graph--)-Backend: /me endpoint response
62+
Backend--)-Frontend: /profile response (/me data)
63+
```
5064

5165
## Prerequisites
5266

0 commit comments

Comments
 (0)