|
1 | 1 | --- |
2 | | -title: Prepare your application - Sign in users to an ASP.NET web app |
3 | | -description: Create and prepare an ASP.NET web app for authentication |
| 2 | +title: Tutorial - Prepare an ASP.NET web app for authentication in a customer tenant |
| 3 | +description: Learn how to prepare an ASP.NET web app for authentication with your Azure Active Directory (Azure AD) for customers tenant. |
4 | 4 | services: active-directory |
5 | 5 | author: cilwerner |
6 | 6 | ms.author: cwerner |
7 | 7 | manager: celestedg |
8 | 8 | ms.service: active-directory |
9 | | -ms.workload: identity |
| 9 | + |
10 | 10 | ms.subservice: ciam |
11 | | -ms.topic: how-to |
| 11 | +ms.topic: tutorial |
12 | 12 | ms.date: 05/23/2023 |
13 | | -ms.custom: it-pro |
| 13 | + |
14 | 14 | #Customer intent: As a dev, devops, I want to learn about how to enable authentication in my own ASP.NET web app with Azure Active Directory (Azure AD) for customers tenant. |
15 | 15 | --- |
16 | 16 |
|
17 | | -# Prepare your application: Sign in users to an ASP.NET web app using an Azure Active Directory (AD) for customers tenant |
| 17 | +# Tutorial: Prepare an ASP.NET web app for authentication in a customer tenant |
| 18 | + |
| 19 | +In the [previous article](./how-to-web-app-dotnet-sign-in-prepare-tenant.md), you registered an application and configured user flows in your Azure Active Directory (Azure AD) for customers tenant. |
18 | 20 |
|
19 | | -After registering an application and creating a user flow in a Azure Active Directory (AD) for customers tenant, an ASP.NET web application can be created using an integrated development environment (IDE). In this article, you'll create an ASP.NET project in your IDE, and configure it for authentication. |
| 21 | +In this tutorial you'll; |
| 22 | + |
| 23 | +> [!div class="checklist"] |
| 24 | +> * Create an ASP.NET project in Visual Studio Code |
| 25 | +> * Add the required NuGet packages |
| 26 | +> * Configure the settings for the application |
| 27 | +> * Add code to implement authentication |
20 | 28 |
|
21 | 29 | ## Prerequisites |
22 | 30 |
|
23 | | -- Completion of the prerequisites and steps in [Sign in users in your own ASP.NET web application by using an Azure AD for customers tenant - Prepare your tenant](./how-to-web-app-dotnet-sign-in-prepare-tenant.md). |
24 | | -- Although any IDE that supports React applications can be used, Visual Studio Code is used for this guide. This can be downloaded from the [Downloads](https://visualstudio.microsoft.com/downloads/) page. |
25 | | -- [.NET 7.0 SDK](https://dotnet.microsoft.com/download/dotnet). |
| 31 | +* Completion of the prerequisites and steps in [Prepare your customer tenant for building an ASP.NET web app](./how-to-web-app-dotnet-sign-in-prepare-tenant.md). |
| 32 | +* Although any integrated development environment (IDE) that supports ASP.NET applications can be used, this tutorial uses **Visual Studio Code**. You can download it [here](https://visualstudio.microsoft.com/downloads/). |
| 33 | +* [.NET 7.0 SDK](https://dotnet.microsoft.com/download/dotnet). |
26 | 34 |
|
27 | 35 | ## Create an ASP.NET project |
28 | 36 |
|
29 | | -1. Open a terminal in your IDE and navigate to the location in which to create your project. |
30 | | -1. Enter the following command to make the project folder and create your project. |
| 37 | +1. Open Visual Studio Code, select **File** > **Open Folder...**. Navigate to and select the location in which to create your project. |
| 38 | +1. Open a new terminal by selecting **Terminal** > **New Terminal**. |
| 39 | +1. Enter the following command to make a Model View Controller (MVC) ASP.NET project. |
31 | 40 |
|
32 | 41 | ```powershell |
33 | 42 | dotnet new mvc -n aspnet_webapp |
34 | 43 | ``` |
35 | 44 |
|
| 45 | +## Install identity packages |
| 46 | +
|
| 47 | +Identity related NuGet packages must be installed in the project to authenticate users. |
| 48 | +
|
| 49 | +1. Enter the following commands to change into the *aspnet_webapp* folder and install the relevant NuGet package: |
| 50 | +
|
| 51 | + ```powershell |
| 52 | + cd aspnet_webapp |
| 53 | + dotnet add package Microsoft.Identity.Web.UI |
| 54 | + ``` |
| 55 | +
|
36 | 56 | ## Configure the application for authentication |
37 | 57 |
|
38 | 58 | 1. Open the *appsettings.json* file and replace the existing code with the following snippet. |
@@ -71,7 +91,94 @@ After registering an application and creating a user flow in a Azure Active Dire |
71 | 91 | 1. In the `https` section of `profiles`, change the `https` URL in `applicationUrl` so that it reads `https://localhost:7274`. You used this URL to define the **Redirect URI**. |
72 | 92 | 1. Save the changes to your file. |
73 | 93 |
|
| 94 | +## Add authorization to *HomeController.cs* |
| 95 | +
|
| 96 | +The *HomeController.cs* file contains the code for the home page of the application and needs to have the capability to authorize the user. The `Microsoft.AspNetCore.Authorization` namespace provides the classes and interfaces to implement authorization to the web app, and the `[Authorize]` attribute is used to specify that only authenticated users can use the web app. |
| 97 | +
|
| 98 | +1. In your code editor, open *Controllers\HomeController.cs* file. |
| 99 | +1. Authorization needs to be added to the controller, add `Microsoft.AspNetCore.Authorization` so that the top of the file is identical to the following snippet: |
| 100 | +
|
| 101 | + ```cshtml |
| 102 | + using System.Diagnostics; |
| 103 | + using Microsoft.AspNetCore.Authorization; |
| 104 | + using Microsoft.AspNetCore.Mvc; |
| 105 | + using aspnet_webapp.Models; |
| 106 | + ``` |
| 107 | +
|
| 108 | +1. Additionally, add the `[Authorize]` attribute directly above the `HomeController` class definition. |
| 109 | +
|
| 110 | + ```csharp |
| 111 | + [Authorize] |
| 112 | + ``` |
| 113 | +
|
| 114 | +## Add authentication and authorization to *Program.cs* |
| 115 | +
|
| 116 | +The *Program.cs* needs to be modified to add authentication and authorization to the web app. This includes adding namespaces for authentication and authorization, and being able to sign in users with the Microsoft identity platform. |
| 117 | +
|
| 118 | +1. To add the required namespaces, open *Program.cs* and add the following snippet to the top of the file: |
| 119 | +
|
| 120 | + ```csharp |
| 121 | + using Microsoft.AspNetCore.Authentication.OpenIdConnect; |
| 122 | + using Microsoft.AspNetCore.Authorization; |
| 123 | + using Microsoft.AspNetCore.Mvc.Authorization; |
| 124 | + using Microsoft.Identity.Web; |
| 125 | + using Microsoft.Identity.Web.UI; |
| 126 | + using System.IdentityModel.Tokens.Jwt; |
| 127 | + ``` |
| 128 | +
|
| 129 | +1. Next, add the authentication services to the application which will enable the web app to sign in users with the Microsoft identity platform. You can replace the rest of the code in *Program.cs* with the following snippet: |
| 130 | +
|
| 131 | + ```csharp |
| 132 | + var builder = WebApplication.CreateBuilder(args); |
| 133 | +
|
| 134 | + // Add services to the container. |
| 135 | + builder.Services.AddControllersWithViews(); |
| 136 | +
|
| 137 | + // This is required to be instantiated before the OpenIdConnectOptions starts getting configured. |
| 138 | + // By default, the claims mapping will map claim names in the old format to accommodate older SAML applications. |
| 139 | + // For instance, 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role' instead of 'roles' claim. |
| 140 | + // This flag ensures that the ClaimsIdentity claims collection will be built from the claims in the token |
| 141 | + JwtSecurityTokenHandler.DefaultMapInboundClaims = false; |
| 142 | +
|
| 143 | + // Sign-in users with the Microsoft identity platform |
| 144 | + builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme) |
| 145 | + .AddMicrosoftIdentityWebApp(builder.Configuration) |
| 146 | + .EnableTokenAcquisitionToCallDownstreamApi() |
| 147 | + .AddInMemoryTokenCaches(); |
| 148 | +
|
| 149 | + builder.Services.AddControllersWithViews(options => |
| 150 | + { |
| 151 | + var policy = new AuthorizationPolicyBuilder() |
| 152 | + .RequireAuthenticatedUser() |
| 153 | + .Build(); |
| 154 | + options.Filters.Add(new AuthorizeFilter(policy)); |
| 155 | + }).AddMicrosoftIdentityUI(); |
| 156 | +
|
| 157 | + var app = builder.Build(); |
| 158 | +
|
| 159 | + // Configure the HTTP request pipeline. |
| 160 | + if (!app.Environment.IsDevelopment()) |
| 161 | + { |
| 162 | + app.UseExceptionHandler("/Home/Error"); |
| 163 | + // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts. |
| 164 | + app.UseHsts(); |
| 165 | + } |
| 166 | +
|
| 167 | + app.UseHttpsRedirection(); |
| 168 | + app.UseStaticFiles(); |
| 169 | +
|
| 170 | + app.UseRouting(); |
| 171 | + app.UseAuthorization(); |
| 172 | +
|
| 173 | + app.MapControllerRoute( |
| 174 | + name: "default", |
| 175 | + pattern: "{controller=Home}/{action=Index}/{id?}"); |
| 176 | +
|
| 177 | + app.Run(); |
| 178 | +
|
| 179 | + ``` |
| 180 | +
|
74 | 181 | ## Next steps |
75 | 182 |
|
76 | 183 | > [!div class="nextstepaction"] |
77 | | -> [Sign in and sign out](how-to-web-app-dotnet-sign-in-sign-out.md) |
| 184 | +> [Sign in and sign out](how-to-web-app-dotnet-sign-in-sign-out.md) |
0 commit comments