You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> - Create a new Blazor Server app configured to use Azure AD for authentication
25
+
> - Create a new Blazor Server app configured to use Azure AD for authentication for users in a single organization (in the Azure Active Directory tenant the app is registered)
26
26
> - Handle both authentication and authorization using `Microsoft.Identity.Web`
27
27
> - Retrieve data from a protected web API, Microsoft Graph
Every app that uses Azure AD for authentication must be registered with Azure AD. Follow the instructions in [Register an application](quickstart-register-app.md) with these additions:
41
-
42
-
- For **Supported account types**, select **Accounts in this organizational directory only**.
43
-
- Leave the **Redirect URI** drop down set to **Web** and enter `https://localhost:5001/signin-oidc`. The default port for an app running on Kestrel is `5001`. If the app is available on a different port, specify that port number instead of `5001`.
44
-
45
-
Under **Manage**, select **Authentication** > **Implicit grant and hybrid flows**. Select **ID tokens**, and then select **Save**.
46
-
47
-
Finally, because the app calls a protected API (in this case Microsoft Graph), it needs a client secret in order to verify its identity when it requests an access token to call that API.
48
-
49
-
1. Within the same app registration, under **Manage**, select **Certificates & secrets** and then **Client secrets**.
50
-
2. Create a **New client secret** that never expires.
51
-
3. Make note of the secret's **Value** as you'll use it in the next step. You can’t access it again once you navigate away from this pane. However, you can recreate it as needed.
37
+
- The tenant-id or domain of the Azure Active Directory associated with your Azure Account
52
38
53
39
## Create the app using the .NET CLI
54
40
55
-
To create the application, run the following command. Replace the placeholders in the command with the proper information from your app's overview page and execute the command in a command shell. The output location specified with the `-o|--output` option creates a project folder if it doesn't exist and becomes part of the app's name.
Now, navigate to your new Blazor app in your editor and add the client secret to the _appsettings.json_ file, replacing the text "secret-from-app-registration".
47
+
## Install the Microsoft Identity App Sync .NET Tool
69
48
70
-
```json
71
-
"ClientSecret": "secret-from-app-registration",
49
+
```dotnetcli
50
+
dotnet tool install --global msidentity-app-sync
72
51
```
73
52
74
-
## Test the app
53
+
This tool will automate the following tasks for you:
75
54
76
-
In your terminal, run the following command:
55
+
- Register your application in Azure Active Directory
56
+
- Create a secret for your registered application
57
+
- Register redirect URIs based on your launchsettings.json
58
+
- Initialize the use of user secrets in your project
59
+
- Store your application secret in user secrets storage
60
+
- Update your appsettings.json with the client-id, tenant-id, and others.
77
61
78
-
```dotnetcli
79
-
dotnet run
80
-
```
62
+
.NET Tools extend the capabilities of the dotnet CLI command. To learn more about .NET Tools, see [.NET Tools](/dotnet/core/tools/global-tools).
81
63
82
-
In your browser, navigate to `https://localhost:<port number> `, and log in using an Azure AD user account to see the app running.
64
+
For more information on user secrets storage, see [safe storage of app secrets during development](/aspnet/core/security/app-secrets).
83
65
84
-
## Retrieving data from Microsoft Graph
66
+
## Use the Microsoft Identity App Sync Tool
85
67
86
-
[Microsoft Graph](/graph/overview) offers a range of APIs that provide access to your users' Microsoft 365 data. By using the Microsoft identity platform as the identity provider for your app, you have easier access to this information since Microsoft Graph directly supports the tokens issued by the Microsoft identity platform. In this section, you add code to display the signed in user's emails on the application's "fetch data" page.
68
+
Run the following command to register your app in your tenant and update the .NET configuration of your application. Provide the username/upn belonging to your Azure Account (for instance, `[email protected]`) and the tenant ID or domain name of the Azure Active Directory associated with your Azure Account. If you use an account that is signed in in either Visual Studio, Azure CLI, or Azure PowerShell, you'll benefit from single sign-on (SSO).
87
69
88
-
Before you start, log out of your app since you'll be making changes to the required permissions, and your current token won't work. If you haven't already, run your app again and select **Log out** before updating the code below.
Now you'll update your app's registration and code to pull a user's email and display the messages within the app. To achieve this, first extend the app registration permissions in Azure AD to enable access to the email data. Then, add code to the Blazor app to retrieve and display this data in one of the pages.
74
+
> [!Note]
75
+
> - You don't need to provide the username if you are signed in with only one account in the developer tools.
76
+
> - You don't need to provide the tenant-id if the tenant in which you want to create the application is your home tenant.
91
77
92
-
1. In the Azure portal, select your app in **App registrations**.
93
-
1. Under **Manage**, select **API permissions**.
94
-
1. Select **Add a permission** > **Microsoft Graph**.
95
-
1. Select **Delegated Permissions**, then search for and select the **Mail.Read** permission.
96
-
1. Select **Add permissions**.
78
+
## Optional - Create a development SSL certificate
97
79
98
-
In the _appsettings.json_ file, update your code so it fetches the appropriate token with the right permissions. Add `mail.read` after the `user.read` scope under `DownstreamAPI`. This is specifying which scopes (or permissions) the app will request access to.
80
+
In order to avoid SSL errors/warnings when browsing the running application, you can use the following on macOS and Windows to generate a self-signed SSL certificate for use by .NET Core.
99
81
100
-
```json
101
-
"Scopes": "user.read mail.read"
82
+
```dotnetcli
83
+
dotnet dev-certs https --trust
102
84
```
103
85
104
-
Next, in the _Pages_ folder, update the code in the _FetchData.razor_ file to retrieve email data instead of the default (random) weather details. Replace the code in that file with the following code snippet:
Launch the app. You’ll notice that you're prompted for the newly added permissions, indicating that everything is working as expected. Now, beyond basic user profile data, the app is requesting access to email data.
88
+
In your terminal, run the following command:
196
89
197
-
After granting consent, navigate to the "Fetch data" page to read some email.
90
+
```dotnetcli
91
+
dotnet run
92
+
```
198
93
199
-
:::image type="content" source="./media/tutorial-blazor-server/final-app-2.png" alt-text="Screenshot of the final app. It has a heading that says Hello Nicholas and it shows a list of emails belonging to Nicholas.":::
94
+
Browse to the running web application using the URL outputted by the command line.
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/connect/plan-connect-performance-factors.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -166,6 +166,7 @@ The size of your source Active Directory topology will influence your SQL databa
166
166
167
167
168
168
- Organizations with more than 100,000 users can reduce network latencies by colocating SQL database and the provisioning engine on the same server.
169
+
- SQL Named Pipes protocol is not supported as it introduces significant delays in the sync cycle and should be disabled in the SQL Server Configuration Manager under SQL Native Clients and SQL Server Network. Please note that changing Named Pipes configuration only takes effect after restarting database and ADSync services.
169
170
- Due to the high disk input and output (I/O) requirements of the sync process, use Solid State Drives (SSD) for the SQL database of the provisioning engine for optimal results, if not possible, consider RAID 0 or RAID 1 configurations.
170
171
- Don’t do a full sync preemptively; it causes unnecessary churn and slower response times.
Copy file name to clipboardExpand all lines: articles/azure-large-instances/what-is-azure-large-instances.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -181,7 +181,7 @@ Shows Azure IaaS, and in this case, use of VMs to host your applications, which
181
181
Shows using your ExpressRoute Gateway enabled with ExpressRoute FastPath for Azure Large Instances connectivity offering low latency.
182
182
183
183
> [!Note]
184
-
>To support this configuration, your ExpressRoute Gateway should be UltraPerformance. For more information, [About ExpressRoute virtual network gateways](../expressroute/expressroute-about-virtual-network-gateways.md).
184
+
>To support this configuration, your ExpressRoute Gateway should be UltraPerformance. For more information, see [About ExpressRoute virtual network gateways](../expressroute/expressroute-about-virtual-network-gateways.md).
Copy file name to clipboardExpand all lines: articles/azure-large-instances/work-with-azure-large-instances-in-azure-portal.md
+5-21Lines changed: 5 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,24 +16,25 @@ ms.date: 06/01/2023
16
16
In this article, you learn what to do in the Azure portal with your implementation of Azure Large Instances.
17
17
18
18
> [!Note]
19
-
> For now, BareMetal Infrastructure or BareMetal Instances are being used as synonyms with Azure Large Instances.
19
+
> For now, BareMetal Infrastructure and BareMetal Instances are being used as synonyms for Azure Large Instances.
20
20
21
21
## Register the resource provider
22
22
23
-
An Azure resource provider for Azure Large Instances enables you to see the instances in the Azure portal. By default, the Azure subscription you use for Azure Large Instances deployments registers the Azure Large Instances resource provider. If you don't see your deployed Azure Large Instances, register the resource provider with your subscription.
23
+
An Azure resource provider for Azure Large Instances enables you to see the instances in the Azure portal.
24
+
By default, the Azure subscription you use for Azure Large Instances deployments registers the Azure Large Instances resource provider.
25
+
If you don't see your deployed Azure Large Instances, register the resource provider with your subscription.
24
26
25
27
You can register the Azure Large Instance resource provider using the Azure portal or the Azure CLI.
26
28
27
29
### [Portal](#tab/azure-portal)
28
30
29
-
30
31
You need to list your subscription in the Azure portal and then double-click the subscription used to deploy your Azure Large Instances tenant.
31
32
32
33
1. Sign in to the Azure portal.
33
34
2. On the Azure portal menu, select **All services**.
34
35
3. In the **All services** box, enter **subscription**, and then select **Subscriptions**.
35
36
4. Select the subscription from the subscription list.
36
-
5. Select **Resource providers** and type **BareMetalInfrastructure** in the search box. The resource provider should be Registered, as the image shows.
37
+
5. Select **Resource providers** and type **BareMetalInfrastructure** in the search box. The resource provider should be registered, as the image shows.
37
38
38
39
:::image type="content" source="../baremetal-infrastructure/media/connect-baremetal-infrastructure/register-resource-provider-azure-portal.png" alt-text="Networking diagram of Azure Large Instances." lightbox="../baremetal-infrastructure/media/connect-baremetal-infrastructure/register-resource-provider-azure-portal.png" border="false":::
Use the Bash environment in [Azure Cloud Shell](../cloud-shell/overview.md).
52
-
For more information, see [Quickstart for Bash in Azure Cloud Shell](../cloud-shell/quickstart.md).
53
-
54
-
If you prefer to run CLI reference commands locally, [install](https://learn.microsoft.com/cli/azure/install-azure-cli) the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see [How to run the Azure CLI in a Docker container](https://learn.microsoft.com/cli/azure/run-azure-cli-docker).
55
-
56
-
If you're using a local installation, sign in to the Azure CLI by using the [az login command](https://learn.microsoft.com/cli/azure/reference-index?view=azure-cli-latest#az-login). To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see [Sign in with the Azure CLI](https://learn.microsoft.com/cli/azure/authenticate-azure-cli).
57
-
58
-
When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see [Use extensions with the Azure CLI](https://learn.microsoft.com/cli/azure/azure-cli-extensions-overview).
59
-
60
-
Run [az version](https://learn.microsoft.com/cli/azure/reference-index?view=azure-cli-latest#az-version) to find the version and dependent libraries that are installed. To upgrade to the latest version, run [az upgrade](https://learn.microsoft.com/cli/azure/reference-index?view=azure-cli-latest#az-upgrade).
61
-
62
50
For more information about resource providers, see [Azure resource providers and types](./../azure-resource-manager/management/resource-providers-and-types.md).
63
51
64
-
[comment]: <EndofIncludecontent>
65
-
66
52
Sign in to the Azure subscription you use for the Azure Large Instances deployment through the Azure CLI.
67
53
Register the BareMetalInfrastructure Azure Large Instance resource provider with the az provider register command:
68
54
@@ -74,8 +60,6 @@ You can use the az provider list command to see all available providers.
74
60
75
61
---
76
62
77
-
For more information about resource providers, see [Azure resource providers and types](../azure-resource-manager/management/resource-providers-and-types.md).
78
-
79
63
## Azure Large Instances in the Azure portal
80
64
81
65
When you submit an Azure Large Instances deployment request, specify the Azure subscription you're connecting to the Azure Large Instances. Use the same subscription you use to deploy the application layer that works against the Azure Large Instances.
0 commit comments