You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/configure-authentication-sample-web-app.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,6 +75,7 @@ To create the web app registration, use the following steps:
75
75
1. Under **Name**, enter a name for the application (for example, *webapp1*).
76
76
1. Under **Supported account types**, select **Accounts in any identity provider or organizational directory (for authenticating users with user flows)**.
77
77
1. Under **Redirect URI**, select **Web** and then, in the URL box, enter `https://localhost:44316/signin-oidc`.
78
+
1. Under **Implicit grant and hybrid flows**, select the **ID tokens (used for implicit and hybrid flows)** checkbox.
78
79
1. Under **Permissions**, select the **Grant admin consent to openid and offline access permissions** checkbox.
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security.
17
17
18
18
>[!NOTE]
19
-
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator that will begin to be enabled by default for all users starting February 27, 2023.<br>
19
+
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator. We will remove the admin controls and enforce the number match experience tenant-wide for all users starting February 27, 2023.<br>
20
20
>We highly recommend enabling number matching in the near term for improved sign-in security.
#Customer intent: As an application developer, I want to learn how my .NET Core app can get an access token and call an API that's protected by the Microsoft identity platform by using the client credentials flow.
16
16
---
17
17
18
-
In this quickstart, you download and run a code sample that demonstrates how a .NET Core console application can get an access token to call the Microsoft Graph API and display a [list of users](/graph/api/user-list) in the directory. The code sample also demonstrates how a job or a Windows service can run with an application identity, instead of a user's identity. The sample console application in this quickstart is also a daemon application, so it's a confidential client application.
18
+
The following quickstart uses a code sample to demonstrates how a .NET Core console application can get an access token to call the Microsoft Graph API and display a [list of users](/graph/api/user-list) in the directory. It also demonstrates how a job or a Windows service can run with an application identity, instead of a user's identity. The sample console application in this quickstart is also a daemon application, therefore it's a confidential client application.
19
19
20
20
The following diagram shows how the sample app works:
21
21
22
22
23
23
24
24
## Prerequisites
25
25
26
-
This quickstart requires [.NET Core 3.1 SDK](https://dotnet.microsoft.com/download) but will also work with .NET 5.0 SDK.
27
-
26
+
This quickstart requires [.NET Core 6.0 SDK](https://dotnet.microsoft.com/download).
28
27
29
28
## Register and download the app
30
29
31
30
32
-
You have two options to start building your application: automatic or manual configuration.
31
+
The application can be built using either an automatic or manual configuration.
33
32
34
33
### Automatic configuration
35
34
36
-
If you want to register and automatically configure your app and then download the code sample, follow these steps:
35
+
To register and automatically configure the app and then download the code sample, follow these steps:
37
36
38
37
1. Go to the [Azure portal page for app registration](https://portal.azure.com/?Microsoft_AAD_RegisteredApps=true#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade/quickStartType/DotNetCoreDaemonQuickstartPage/sourceType/docs).
39
38
1. Enter a name for your application and select **Register**.
40
39
1. Follow the instructions to download and automatically configure your new application in one click.
41
40
42
41
### Manual configuration
43
42
44
-
If you want to manually configure your application and code sample, use the following procedures.
43
+
To manually configure your application and code sample, use the following procedures.
45
44
46
45
#### Step 1: Register your application
47
-
To register your application and add the app's registration information to your solution manually, follow these steps:
46
+
47
+
To register the application and add the registration information to the solution manually, follow these steps:
48
48
49
49
1. Sign in to the [Azure portal](https://portal.azure.com/).
50
-
1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.
50
+
1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which to register the application.
51
51
1. Search for and select **Azure Active Directory**.
52
52
1. Under **Manage**, select **App registrations** > **New registration**.
53
-
1. For **Name**, enter a name for your application. For example, enter **Daemon-console**. Users of your app will see this name, and you can change it later.
53
+
1. For **Name**, enter a name for the application. For example, enter **Daemon-console**. Users of the app will see this name, and can be changed later.
54
54
1. Select **Register** to create the application.
55
55
1. Under **Manage**, select **Certificates & secrets**.
56
56
1. Under **Client secrets**, select **New client secret**, enter a name, and then select **Add**. Record the secret value in a safe location for use in a later step.
@@ -63,61 +63,59 @@ To register your application and add the app's registration information to your
63
63
64
64
[Download the Visual Studio project](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2/archive/master.zip)
65
65
66
-
You can run the provided project in either Visual Studio or Visual Studio for Mac.
66
+
This project can be run in either Visual Studio or Visual Studio for Mac and can be downloaded from the [code sample](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2/archive/master.zip).
1. Extract the .zip file to a local folder that's close to the root of the disk. For example, extract to *C:\Azure-Samples*.
74
+
1. Extract the *.zip* file to a local folder that's close to the root of the disk to avoid errors caused by path length limitations on Windows. For example, extract to *C:\Azure-Samples*.
75
75
76
-
We recommend extracting the archive into a directory near the root of your drive to avoid errors caused by path length limitations on Windows.
77
76
78
77
1. Open the solution in Visual Studio: *1-Call-MSGraph\daemon-console.sln* (optional).
79
-
1. In *appsettings.json*, replace the values of `Tenant`, `ClientId`, and `ClientSecret`:
78
+
1. In *appsettings.json*, replace the values of `Tenant`, `ClientId`, and `ClientSecret`. The value for the application (client) ID and the directory (tenant) ID, can be found in the app's **Overview** page on the Azure portal.
80
79
81
80
```json
82
81
"Tenant": "Enter_the_Tenant_Id_Here",
83
82
"ClientId": "Enter_the_Application_Id_Here",
84
83
"ClientSecret": "Enter_the_Client_Secret_Here"
85
84
```
86
-
In that code:
87
-
-`Enter_the_Application_Id_Here` is the application (client) ID for the application that you registered.
88
-
To find the values for the application (client) ID and the directory (tenant) ID, go to the app's **Overview** page in the Azure portal.
85
+
86
+
In the code:
87
+
-`Enter_the_Application_Id_Here` is the application (client) ID for the registered application.
89
88
- Replace `Enter_the_Tenant_Id_Here` with the tenant ID or tenant name (for example, `contoso.microsoft.com`).
90
89
- Replace `Enter_the_Client_Secret_Here` with the client secret that you created in step 1.
91
90
To generate a new key, go to the **Certificates & secrets** page.
92
91
93
92
94
93
#### Step 4: Admin consent
95
94
96
-
If you try to run the application at this point, you'll receive an *HTTP 403 - Forbidden* error: "Insufficient privileges to complete the operation." This error happens because any app-only permission requires a global administrator of your directory to give consent to your application. Select one of the following options, depending on your role.
95
+
Running the application now results in the output `HTTP 403 - Forbidden* error: "Insufficient privileges to complete the operation`. This error occurs because any app-only permission requires a global administrator of the directory to give consent to the application. Select one of the following options, depending on the role.
97
96
98
97
##### Global tenant administrator
99
98
100
-
If you're a global tenant administrator, go to **Enterprise applications** in the Azure portal. Select your app registration, and select **Permissions** from the **Security** section of the left pane. Then select the large button labeled **Grant admin consent for {Tenant Name}** (where **{Tenant Name}** is the name of your directory).
99
+
For a global tenant administrator, go to **Enterprise applications** in the Azure portal. Select the app registration, and select **Permissions** from the **Security** section of the left pane. Then select the large button labeled **Grant admin consent for {Tenant Name}** (where **{Tenant Name}** is the name of the directory).
101
100
102
101
103
102
##### Standard user
104
103
105
-
If you're a standard user of your tenant, ask a global administrator to grant admin consent for your application. To do this, give the following URL to your administrator:
104
+
For a standard user of your tenant, ask a global administrator to grant admin consent to the application. To do this, provide the following URL to the administrator:
* Replace `Enter_the_Tenant_Id_Here` with the tenant ID or tenant name (for example, `contoso.microsoft.com`).
114
-
*`Enter_the_Application_Id_Here` is the application (client) ID for the application that you registered.
112
+
*`Enter_the_Application_Id_Here` is the application (client) ID for the registered application.
115
113
116
-
You might see the error "AADSTS50011: No reply address is registered for the application" after you grant consent to the app by using the preceding URL. This error happens because this application and the URL don't have a redirect URI. You can ignore it.
114
+
The error `AADSTS50011: No reply address is registered for the application` may be displayed after you grant consent to the app by using the preceding URL. This error occurs because the application and the URL don't have a redirect URI. This can be ignored.
117
115
118
116
#### Step 5: Run the application
119
117
120
-
If you're using Visual Studio or Visual Studio for Mac, press **F5** to run the application. Otherwise, run the application via command prompt, console, or terminal:
118
+
In Visual Studio, press **F5** to run the application. Otherwise, run the application via command prompt, console, or terminal:
121
119
122
120
```dotnetcli
123
121
cd {ProjectFolder}\1-Call-MSGraph\daemon-console
@@ -126,32 +124,33 @@ dotnet run
126
124
In that code:
127
125
*`{ProjectFolder}` is the folder where you extracted the .zip file. An example is `C:\Azure-Samples\active-directory-dotnetcore-daemon-v2`.
128
126
129
-
You should see a list of users in Azure Active Directory as result.
127
+
A list of users in Azure Active Directory should be displayed as a result.
130
128
131
-
This quickstart application uses a client secret to identify itself as a confidential client. The client secret is added as a plain-text file to your project files. For security reasons, we recommend that you use a certificate instead of a client secret before considering the application as a production application. For more information on how to use a certificate, see [these instructions](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2/#variation-daemon-application-using-client-credentials-with-certificates) in the GitHub repository for this sample.
129
+
This quickstart application uses a client secret to identify itself as a confidential client. The client secret is added as a plain-text file to the project files. For security reasons, we recommend to use a certificate instead of a client secret before considering the application as a production application. For more information on how to use a certificate, see [these instructions](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2/#variation-daemon-application-using-client-credentials-with-certificates).
132
130
133
131
## More information
134
-
This section gives an overview of the code required to sign in users. This overview can be useful to understand how the code works, what the main arguments are, and how to add sign-in to an existing .NET Core console application.
132
+
133
+
This section provides an overview of the code required to sign in users. The overview can be useful to understand how the code works, what the main arguments are, and how to add sign-in to an existing .NET Core console application.
135
134
136
135
### MSAL.NET
137
136
138
137
Microsoft Authentication Library (MSAL, in the [Microsoft.Identity.Client](https://www.nuget.org/packages/Microsoft.Identity.Client) package) is the library that's used to sign in users and request tokens for accessing an API protected by the Microsoft identity platform. This quickstart requests tokens by using the application's own identity instead of delegated permissions. The authentication flow in this case is known as a [client credentials OAuth flow](../../v2-oauth2-client-creds-grant-flow.md). For more information on how to use MSAL.NET with a client credentials flow, see [this article](https://aka.ms/msal-net-client-credentials).
139
138
140
-
You can install MSAL.NET by running the following command in the Visual Studio Package Manager Console:
139
+
MSAL.NET can be installed by running the following command in the Visual Studio Package Manager Console:
141
140
142
141
```dotnetcli
143
142
dotnet add package Microsoft.Identity.Client
144
143
```
145
144
146
145
### MSAL initialization
147
146
148
-
You can add the reference for MSAL by adding the following code:
147
+
Add the reference for MSAL by adding the following code:
149
148
150
149
```csharp
151
150
usingMicrosoft.Identity.Client;
152
151
```
153
152
154
-
Then, initialize MSAL by using the following code:
0 commit comments