Skip to content

Commit 478f66d

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #234479 from jmprieur/jmprieur/daemonQuickstartUpdate
Update the Daemon quickstart
2 parents 2aa5f26 + bfd22fd commit 478f66d

File tree

2 files changed

+115
-57
lines changed

2 files changed

+115
-57
lines changed

‎articles/active-directory/develop/includes/console-app/quickstart-netcore.md

Lines changed: 59 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: active-directory
88
ms.subservice: develop
99
ms.topic: include
1010
ms.workload: identity
11-
ms.date: 12/08/2022
11+
ms.date: 03/13/2023
1212
ms.author: owenrichards
1313
ms.reviewer: jmprieur
1414
ms.custom: devx-track-csharp, aaddev, identityplatformtop40, "scenarios:getting-started", "languages:aspnet-core", mode-other
@@ -73,7 +73,7 @@ This project can be run in either Visual Studio or Visual Studio for Mac and can
7373
1. In *appsettings.json*, replace the values of `Tenant`, `ClientId`, and `ClientSecret`. The value for the application (client) ID and the directory (tenant) ID, can be found in the app's **Overview** page on the Azure portal.
7474

7575
```json
76-
"Tenant": "Enter_the_Tenant_Id_Here",
76+
"TenantId": "Enter_the_Tenant_Id_Here",
7777
"ClientId": "Enter_the_Application_Id_Here",
7878
"ClientSecret": "Enter_the_Client_Secret_Here"
7979
```
@@ -120,65 +120,94 @@ In that code:
120120

121121
- `{ProjectFolder}` is the folder where you extracted the .zip file. An example is `C:\Azure-Samples\active-directory-dotnetcore-daemon-v2`.
122122

123-
A list of users in Azure Active Directory should be displayed as a result.
123+
The number of users in Azure Active Directory should be displayed as a result.
124124

125-
This quickstart application uses a client secret to identify itself as a confidential client. The client secret is added as a plain-text file to the project files. For security reasons, it is recommended to use a certificate instead of a client secret before considering the application as a production application. For more information on how to use a certificate, see [these instructions](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2/#variation-daemon-application-using-client-credentials-with-certificates).
125+
This quickstart application uses a client secret to identify itself as a confidential client. The client secret is added as a plain-text file to the project files. For security reasons, it's recommended to use a certificate instead of a client secret before considering the application as a production application. For more information on how to use a certificate, see [these instructions](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2/#variation-daemon-application-using-client-credentials-with-certificates).
126126

127127
## More information
128128

129129
This section provides an overview of the code required to sign in users. The overview can be useful to understand how the code works, what the main arguments are, and how to add sign-in to an existing .NET Core console application.
130130

131-
### MSAL.NET
131+
### Microsoft.Identity.Web.MicrosoftGraph
132132

133-
Microsoft Authentication Library (MSAL, in the [Microsoft.Identity.Client](https://www.nuget.org/packages/Microsoft.Identity.Client) package) is the library that's used to sign in users and request tokens for accessing an API protected by the Microsoft identity platform. This quickstart requests tokens by using the application's own identity instead of delegated permissions. The authentication flow in this case is known as a [client credentials OAuth flow](../../v2-oauth2-client-creds-grant-flow.md). For more information on how to use MSAL.NET with a client credentials flow, see [this article](https://aka.ms/msal-net-client-credentials).
133+
Microsoft Identity Web (in the [Microsoft.Identity.Web.TokenAcquisition](https://www.nuget.org/packages/Microsoft.Identity.Web.TokenAcquisition) package) is the library that's used to request tokens for accessing an API protected by the Microsoft identity platform. This quickstart requests tokens by using the application's own identity instead of delegated permissions. The authentication flow in this case is known as a [client credentials OAuth flow](../../v2-oauth2-client-creds-grant-flow.md). For more information on how to use MSAL.NET with a client credentials flow, see [this article](https://aka.ms/msal-net-client-credentials). Given the daemon app in this quickstart calls Microsoft Graph, you install the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) package, which handles automatically authenticated requests to Microsoft Graph (and references itself Microsoft.Identity.Web.TokenAcquisition)
134134

135-
MSAL.NET can be installed by running the following command in the Visual Studio Package Manager Console:
135+
Microsoft.Identity.Web.MicrosoftGraph can be installed by running the following command in the Visual Studio Package Manager Console:
136136

137137
```dotnetcli
138-
dotnet add package Microsoft.Identity.Client
138+
dotnet add package Microsoft.Identity.Web.MicrosoftGraph
139139
```
140140

141-
### MSAL initialization
141+
### Application initialization
142142

143-
Add the reference for MSAL by adding the following code:
143+
Add the reference for Microsoft.Identity.Web by adding the following code:
144144

145145
```csharp
146-
using Microsoft.Identity.Client;
146+
using Microsoft.Extensions.Configuration;
147+
using Microsoft.Extensions.DependencyInjection;
148+
using Microsoft.Graph;
149+
using Microsoft.Identity.Abstractions;
150+
using Microsoft.Identity.Web;
147151
```
148152

149-
Then, initialize MSAL with the following:
153+
Then, initialize the app with the following code:
150154

151155
```csharp
152-
IConfidentialClientApplication app;
153-
app = ConfidentialClientApplicationBuilder.Create(config.ClientId)
154-
.WithClientSecret(config.ClientSecret)
155-
.WithAuthority(new Uri(config.Authority))
156-
.Build();
156+
// Get the Token acquirer factory instance. By default it reads an appsettings.json
157+
// file if it exists in the same folder as the app (make sure that the
158+
// "Copy to Output Directory" property of the appsettings.json file is "Copy if newer").
159+
TokenAcquirerFactory tokenAcquirerFactory = TokenAcquirerFactory.GetDefaultInstance();
160+
161+
// Configure the application options to be read from the configuration
162+
// and add the services you need (Graph, token cache)
163+
IServiceCollection services = tokenAcquirerFactory.Services;
164+
services.AddMicrosoftGraph();
165+
// By default, you get an in-memory token cache.
166+
// For more token cache serialization options, see https://aka.ms/msal-net-token-cache-serialization
167+
168+
// Resolve the dependency injection.
169+
var serviceProvider = tokenAcquirerFactory.Build();
170+
```
171+
172+
This code uses the configuration defined in the appsettings.json file:
173+
174+
```json
175+
{
176+
"AzureAd": {
177+
"Instance": "https://login.microsoftonline.com/",
178+
"TenantId": "[Enter here the tenantID or domain name for your Azure AD tenant]",
179+
"ClientId": "[Enter here the ClientId for your application]",
180+
"ClientCredentials": [
181+
{
182+
"SourceType": "ClientSecret",
183+
"ClientSecret": "[Enter here a client secret for your application]"
184+
}
185+
]
186+
}
187+
}
157188
```
158189

159190
| Element | Description |
160191
|---------|---------|
161-
| `config.ClientSecret` | The client secret created for the application in the Azure portal. |
162-
| `config.ClientId` | The application (client) ID for the application registered in the Azure portal. You can find this value on the app's **Overview** page in the Azure portal. |
163-
| `config.Authority` | (Optional) The security token service (STS) endpoint for the user to authenticate. It's usually `https://login.microsoftonline.com/{tenant}` for the public cloud, where `{tenant}` is the name of your tenant or your tenant ID.|
192+
| `ClientSecret` | The client secret created for the application in the Azure portal. |
193+
| `ClientId` | The application (client) ID for the application registered in the Azure portal. This value can be found on the app's **Overview** page in the Azure portal. |
194+
| `Instance` | (Optional) The security token service (STS) could instance endpoint for the app to authenticate. It's usually `https://login.microsoftonline.com/` for the public cloud.|
195+
| `TenantId` | Name of the tenant or the tenant ID.|
164196

165-
For more information, see the [reference documentation for `ConfidentialClientApplication`](/dotnet/api/microsoft.identity.client.iconfidentialclientapplication).
197+
For more information, see the [reference documentation for `ConfidentialClientApplication`](/dotnet/api/microsoft.identity.web.tokenacquirerfactory).
166198

167-
### Requesting tokens
199+
### Calling Microsoft Graph
168200

169201
To request a token by using the app's identity, use the `AcquireTokenForClient` method:
170202

171203
```csharp
172-
result = await app.AcquireTokenForClient(scopes)
173-
.ExecuteAsync();
204+
GraphServiceClient graphServiceClient = serviceProvider.GetRequiredService<GraphServiceClient>();
205+
var users = await graphServiceClient.Users
206+
.Request()
207+
.WithAppOnly()
208+
.GetAsync();
174209
```
175210

176-
|Element| Description |
177-
|---------|---------|
178-
| `scopes` | Contains the requested scopes. For confidential clients, this value should use a format similar to `{Application ID URI}/.default`. This format indicates that the requested scopes are the ones that are statically defined in the app object set in the Azure portal. For Microsoft Graph, `{Application ID URI}` points to `https://graph.microsoft.com`. For custom web APIs, `{Application ID URI}` is defined in the Azure portal, under **Application Registration (Preview)** > **Expose an API**. |
179-
180-
For more information, see the [reference documentation for `AcquireTokenForClient`](/dotnet/api/microsoft.identity.client.confidentialclientapplication.acquiretokenforclient).
181-
182211
[!INCLUDE [Help and support](../../../../../includes/active-directory-develop-help-support-include.md)]
183212

184213
## Next steps

‎articles/active-directory/develop/quickstart-v2-netcore-daemon.md

Lines changed: 56 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: active-directory
88
ms.subservice: develop
99
ms.topic: conceptual
1010
ms.workload: identity
11-
ms.date: 01/10/2022
11+
ms.date: 04/13/2023
1212
ROBOTS: NOINDEX
1313
ms.author: owenrichards
1414
ms.reviewer: jmprieur
@@ -102,57 +102,86 @@ ms.custom: devx-track-csharp, aaddev, identityplatformtop40, "scenarios:getting-
102102
>
103103
> ![Diagram that shows how the sample app generated by this quickstart works.](media/quickstart-v2-netcore-daemon/> netcore-daemon-intro.svg)
104104
>
105-
> ### MSAL.NET
105+
> ### Microsoft.Identity.Web.MicrosoftGraph
106106
>
107-
> Microsoft Authentication Library (MSAL, in the [Microsoft.Identity.Client](https://www.nuget.org/packages/Microsoft.Identity.Client) package) is the library that's used to sign in users and request tokens for accessing an API protected by the Microsoft identity platform. This quickstart requests tokens by using the application's own identity instead of delegated permissions. The authentication flow in this case is known as a [client credentials OAuth flow](v2-oauth2-client-creds-grant-flow.md). For more information on how to use MSAL.NET with a client credentials flow, see [this article](https://aka.ms/msal-net-client-credentials).
107+
> Microsoft Identity Web (in the [Microsoft.Identity.Web.TokenAcquisition](https://www.nuget.org/packages/Microsoft.Identity.Web.TokenAcquisition) package) is the library that's used to request tokens for accessing an API protected by the Microsoft identity platform. This quickstart requests tokens by using the application's own identity instead of delegated permissions. The authentication flow in this case is known as a [client credentials OAuth flow](v2-oauth2-client-creds-grant-flow.md). For more information on how to use MSAL.NET with a client credentials flow, see [this article](https://aka.ms/msal-net-client-credentials). Given the daemon app in this quickstart calls Microsoft Graph, you install tje [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) package, which handles automatically authenticated requests to Microsoft Graph (and references itself Microsoft.Identity.Web.TokenAcquisition)
108108
>
109-
> MSAL.NET can be installed by running the following command in the Visual Studio Package Manager Console:
109+
> Microsoft.Identity.Web.MicrosoftGraph can be installed by running the following command in the Visual Studio Package Manager Console:
110110
>
111111
> ```dotnetcli
112-
> dotnet add package Microsoft.Identity.Client
112+
> dotnet add package Microsoft.Identity.Web.MicrosoftGraph
113113
> ```
114114
>
115-
> ### MSAL initialization
115+
> ### Application initialization
116116
>
117-
> Add the reference for MSAL by adding the following code:
117+
> Add the reference for Microsoft.Identity.Web by adding the following code:
118118
>
119119
> ```csharp
120-
> using Microsoft.Identity.Client;
120+
> using Microsoft.Extensions.Configuration;
121+
> using Microsoft.Extensions.DependencyInjection;
122+
> using Microsoft.Graph;
123+
> using Microsoft.Identity.Abstractions;
124+
> using Microsoft.Identity.Web;
121125
> ```
122126
>
123-
> Then, initialize MSAL with the following:
127+
> Then, initialize the app with the following:
124128
>
125129
> ```csharp
126-
> IConfidentialClientApplication app;
127-
> app = ConfidentialClientApplicationBuilder.Create(config.ClientId)
128-
> .WithClientSecret(config.ClientSecret)
129-
> .WithAuthority(new Uri(config.Authority))
130-
> .Build();
130+
> // Get the Token acquirer factory instance. By default it reads an appsettings.json
131+
> // file if it exists in the same folder as the app (make sure that the
132+
> // "Copy to Output Directory" property of the appsettings.json file is "Copy if newer").
133+
> TokenAcquirerFactory tokenAcquirerFactory = TokenAcquirerFactory.GetDefaultInstance();
134+
>
135+
> // Configure the application options to be read from the configuration
136+
> // and add the services you need (Graph, token cache)
137+
> IServiceCollection services = tokenAcquirerFactory.Services;
138+
> services.AddMicrosoftGraph();
139+
> // By default, you get an in-memory token cache.
140+
> // For more token cache serialization options, see https://aka.ms/msal-net-token-cache-serialization
141+
>
142+
> // Resolve the dependency injection.
143+
> var serviceProvider = tokenAcquirerFactory.Build();
144+
> ```
145+
>
146+
> This code uses the configuration defined in the appsettings.json file:
147+
>
148+
> ```json
149+
> {
150+
> "AzureAd": {
151+
> "Instance": "https://login.microsoftonline.com/",
152+
> "TenantId": "[Enter here the tenantID or domain name for your Azure AD tenant]",
153+
> "ClientId": "[Enter here the ClientId for your application]",
154+
> "ClientCredentials": [
155+
> {
156+
> "SourceType": "ClientSecret",
157+
> "ClientSecret": "[Enter here a client secret for your application]"
158+
> }
159+
> ]
160+
> }
161+
> }
131162
> ```
132163
>
133164
> | Element | Description |
134165
> |---------|---------|
135-
> | `config.ClientSecret` | The client secret created for the application in the Azure portal. |
136-
> | `config.ClientId` | The application (client) ID for the application registered in the Azure portal. This value can be found on the app's **Overview** page in the Azure portal. |
137-
> | `config.Authority` | (Optional) The security token service (STS) endpoint for the user to authenticate. It's usually `https://login.microsoftonline.com/{tenant}` for the public cloud, where `{tenant}` is the name of the tenant or the tenant ID.|
166+
> | `ClientSecret` | The client secret created for the application in the Azure portal. |
167+
> | `ClientId` | The application (client) ID for the application registered in the Azure portal. This value can be found on the app's **Overview** page in the Azure portal. |
168+
> | `Instance` | (Optional) The security token service (STS) could instance endpoint for the app to authenticate. It's usually `https://login.microsoftonline.com/` for the public cloud.|
169+
> | `TenantId` | Name of the tenant or the tenant ID.|
138170
>
139-
> For more information, see the [reference documentation for `ConfidentialClientApplication`](/dotnet/api/microsoft.identity.client.iconfidentialclientapplication).
171+
> For more information, see the [reference documentation for `ConfidentialClientApplication`](/dotnet/api/microsoft.identity.web.tokenacquirerfactory).
140172
>
141-
> ### Requesting tokens
173+
> ### Calling Microsoft Graph
142174
>
143175
> To request a token by using the app's identity, use the `AcquireTokenForClient` method:
144176
>
145177
> ```csharp
146-
> result = await app.AcquireTokenForClient(scopes)
147-
> .ExecuteAsync();
178+
> GraphServiceClient graphServiceClient = serviceProvider.GetRequiredService<GraphServiceClient>();
179+
> var users = await graphServiceClient.Users
180+
> .Request()
181+
> .WithAppOnly()
182+
> .GetAsync();
148183
> ```
149184
>
150-
> |Element| Description |
151-
> |---------|---------|
152-
> | `scopes` | Contains the requested scopes. For confidential clients, this value should use a format similar to `{Application ID URI}/.default`. This format indicates that the requested scopes are the ones that are statically defined in the app object set in the Azure portal. For Microsoft Graph, `{Application ID URI}` points to `https://graph.microsoft.com`. For custom web APIs, `{Application ID URI}` is defined in the Azure portal, under **Application Registration (Preview)** > **Expose an API**. |
153-
>
154-
> For more information, see the [reference documentation for `AcquireTokenForClient`](/dotnet/api/microsoft.identity.client.confidentialclientapplication.acquiretokenforclient).
155-
>
156185
> [!INCLUDE [Help and support](../../../includes/active-directory-develop-help-support-include.md)]
157186
>
158187
> ## Next steps

0 commit comments

Comments
 (0)