You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/develop/msal-client-application-configuration.md
+25-24Lines changed: 25 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.subservice: develop
10
10
ms.topic: conceptual
11
11
ms.workload: identity
12
-
ms.date: 11/20/2020
12
+
ms.date: 07/15/2022
13
13
ms.author: marsma
14
14
ms.reviewer: saeeda
15
15
ms.custom: aaddev, has-adal-ref
@@ -33,12 +33,12 @@ The authority is a URL that indicates a directory that MSAL can request tokens f
33
33
34
34
Common authorities are:
35
35
36
-
| Common authority URLs | When to use |
37
-
|--|--|
38
-
|`https://login.microsoftonline.com/<tenant>/`| Sign in users of a specific organization only. The `<tenant>` in the URL is the tenant ID of the Azure Active Directory (Azure AD) tenant (a GUID), or its tenant domain. |
39
-
|`https://login.microsoftonline.com/common/`| Sign in users with work and school accounts or personal Microsoft accounts. |
40
-
|`https://login.microsoftonline.com/organizations/`| Sign in users with work and school accounts. |
41
-
|`https://login.microsoftonline.com/consumers/`| Sign in users with personal Microsoft accounts (MSA) only. |
|`https://login.microsoftonline.com/<tenant>/`| Sign in users of a specific organization only. The `<tenant>` in the URL is the tenant ID of the Azure Active Directory (Azure AD) tenant (a GUID), or its tenant domain. |
39
+
|`https://login.microsoftonline.com/common/`| Sign in users with work and school accounts or personal Microsoft accounts.|
40
+
|`https://login.microsoftonline.com/organizations/`| Sign in users with work and school accounts. |
41
+
|`https://login.microsoftonline.com/consumers/`| Sign in users with personal Microsoft accounts (MSA) only.|
42
42
43
43
The authority you specify in your code needs to be consistent with the **Supported account types** you specified for the app in **App registrations** in the Azure portal.
44
44
@@ -50,16 +50,16 @@ The authority can be:
50
50
51
51
Azure AD cloud authorities have two parts:
52
52
53
-
- The identity provider *instance*
54
-
- The sign-in *audience* for the app
53
+
- The identity provider _instance_
54
+
- The sign-in _audience_ for the app
55
55
56
56
The instance and audience can be concatenated and provided as the authority URL. This diagram shows how the authority URL is composed:
57
57
58
58
59
59
60
60
## Cloud instance
61
61
62
-
The *instance* is used to specify if your app is signing users from the Azure public cloud or from national clouds. Using MSAL in your code, you can set the Azure cloud instance by using an enumeration or by passing the URL to the [national cloud instance](authentication-national-cloud.md#azure-ad-authentication-endpoints) as the `Instance` member (if you know it).
62
+
The _instance_ is used to specify if your app is signing users from the Azure public cloud or from national clouds. Using MSAL in your code, you can set the Azure cloud instance by using an enumeration or by passing the URL to the [national cloud instance](authentication-national-cloud.md#azure-ad-authentication-endpoints) as the `Instance` member.
63
63
64
64
MSAL.NET will throw an explicit exception if both `Instance` and `AzureCloudInstance` are specified.
65
65
@@ -100,7 +100,7 @@ Currently, the only way to get an app to sign in users with only personal Micros
100
100
101
101
## Client ID
102
102
103
-
The client ID is the unique application (client) ID assigned to your app by Azure AD when the app was registered.
103
+
The client ID is the unique **Application (client) ID** assigned to your app by Azure AD when the app was registered.
104
104
105
105
## Redirect URI
106
106
@@ -110,40 +110,41 @@ The redirect URI is the URI the identity provider will send the security tokens
110
110
111
111
If you're a public client app developer who's using MSAL:
112
112
113
-
- You'd want to use `.WithDefaultRedirectUri()` in desktop or UWP applications (MSAL.NET 4.1+). This method will set the public client application's redirect URI property to the default recommended redirect URI for public client applications.
113
+
- You'd want to use `.WithDefaultRedirectUri()` in desktop or Universal Windows Platform (UWP) applications (MSAL.NET 4.1+). The `.WithDefaultRedirectUri()` method will set the public client application's redirect URI property to the default recommended redirect URI for public client applications.
| UWP | value of `WebAuthenticationBroker.GetCurrentApplicationCallbackUri()`. This enables SSO with the browser by setting the value to the result of WebAuthenticationBroker.GetCurrentApplicationCallbackUri() which you need to register |
119
-
| .NET Core |`https://localhost`. This enables the user to use the system browser for interactive authentication since .NET Core doesn't have a UI for the embedded web view at the moment. |
| UWP | value of `WebAuthenticationBroker.GetCurrentApplicationCallbackUri()`. This enables single sign-on (SSO) with the browser by setting the value to the result of WebAuthenticationBroker.GetCurrentApplicationCallbackUri(), which you need to register |
119
+
| .NET Core |`https://localhost`enables the user to use the system browser for interactive authentication since .NET Core doesn't have a UI for the embedded web view at the moment.|
120
120
121
-
- You don't need to add a redirect URI if you're building a Xamarin Android and iOS application that doesn't support the broker redirect URI. It is automatically set to `msal{ClientId}://auth` for Xamarin Android and iOS.
121
+
- You don't need to add a redirect URI if you're building a Xamarin Android and iOS application that doesn't support the broker redirect URI. It's automatically set to `msal{ClientId}://auth` for Xamarin Android and iOS.
122
122
123
123
- Configure the redirect URI in [App registrations](https://aka.ms/appregistrations):
124
124
125
-
125
+
126
126
127
127
You can override the redirect URI by using the `RedirectUri` property (for example, if you use brokers). Here are some examples of redirect URIs for that scenario:
For additional iOS details, see [Migrate iOS applications that use Microsoft Authenticator from ADAL.NET to MSAL.NET](msal-net-migration-ios-broker.md) and [Leveraging the broker on iOS](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Leveraging-the-broker-on-iOS).
133
-
For additional Android details, see [Brokered auth in Android](msal-android-single-sign-on.md).
132
+
For more iOS details, see [Migrate iOS applications that use Microsoft Authenticator from ADAL.NET to MSAL.NET](msal-net-migration-ios-broker.md) and [Leveraging the broker on iOS](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Leveraging-the-broker-on-iOS).
133
+
For more Android details, see [Brokered auth in Android](msal-android-single-sign-on.md).
134
134
135
135
### Redirect URI for confidential client apps
136
136
137
-
For web apps, the redirect URI (or reply URL) is the URI that Azure AD will use to send the token back to the application. This URI can be the URL of the web app/web API if the confidential app is one of these. The redirect URI needs to be registered in app registration. This registration is especially important when you deploy an app that you've initially tested locally. You then need to add the reply URL of the deployed app in the application registration portal.
137
+
For web apps, the redirect URI (or reply URL) is the URI that Azure AD will use to send the token back to the application. The URI can be the URL of the web app/web API if the confidential app is one of them. The redirect URI needs to be registered in app registration. The registration is especially important when you deploy an app that you've initially tested locally. You then need to add the reply URL of the deployed app in the application registration portal.
138
138
139
139
For daemon apps, you don't need to specify a redirect URI.
140
140
141
141
## Client secret
142
142
143
-
This option specifies the client secret for the confidential client app. This secret (app password) is provided by the application registration portal or provided to Azure AD during app registration with PowerShell AzureAD, PowerShell AzureRM, or Azure CLI.
143
+
This option specifies the client secret for the confidential client app. The client secret (app password) is provided by the application registration portal or provided to Azure AD during app registration with PowerShell AzureAD, PowerShell AzureRM, or Azure CLI.
144
144
145
145
## Logging
146
-
To help in debugging and authentication failure troubleshooting scenarios, the Microsoft Authentication Library provides built-in logging support. Logging is each library is covered in the following articles:
146
+
147
+
To help in debugging and authentication failure troubleshooting scenarios, the MSAL provides built-in logging support. Logging in each library is covered in the following articles:
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/docusign-tutorial.md
+47-36Lines changed: 47 additions & 36 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.subservice: saas-app-tutorial
10
10
ms.workload: identity
11
11
ms.topic: tutorial
12
-
ms.date: 03/16/2022
12
+
ms.date: 07/14/2022
13
13
ms.author: jeedes
14
14
---
15
15
@@ -27,6 +27,7 @@ To get started, you need the following items:
27
27
28
28
* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
29
29
* A DocuSign subscription that's single sign-on (SSO) enabled.
30
+
* Control over your domain DNS. This is needed to claim domain on DocuSign.
30
31
31
32
> [!NOTE]
32
33
> This integration is also available to use from Azure AD US Government Cloud environment. You can find this application in the Azure AD US Government Cloud Application Gallery and configure it in the same way as you do from public cloud.
@@ -142,68 +143,94 @@ In this section, you'll grant B.Simon access to DocuSign so that this user can u
142
143
143
144
3. If you want to set up DocuSign manually, open a new web browser window and sign in to your DocuSign company site as an administrator.
144
145
145
-
4. In the upper-right corner of the page, select the profile logo, and then select **Go to Admin**.
146
+
4. In the upper-left corner of the page, select the app launcher (9 dots), and then select **Admin**.
146
147
147
-
![Go to Admin under Profile][51]
148
+
148
149
149
150
5. On your domain solutions page, select **Domains**.
150
151
151
-
![Domain Solutions/Domains][50]
152
+
153
+
152
154
153
155
6. In the **Domains** section, select **CLAIM DOMAIN**.
154
156
155
-
![Claim Domain option][52]
157
+
158
+
156
159
157
160
7. In the **Claim a Domain** dialog box, in the **Domain Name** box, type your company domain, and then select **CLAIM**. Make sure you verify the domain and that its status is active.
158
161
159
-
![Claim a Domain/Domain Name dialog][53]
162
+
163
+
164
+
8. In the **Domains** section, select **Get Validation Token** of new domain added in the claim list.
165
+
166
+
167
+
168
+
9. Copy the **TXT Token**
169
+
170
+
171
+
172
+
10. Configure your DNS provider with the **TXT Token** by following these steps:
160
173
161
-
8. On the domain solutions page, select **Identity Providers**.
174
+
a. Navigate to your domain's DNS record management page.
175
+
b. Add a new TXT record.
176
+
c. Name: @ or *
177
+
d. Text: paste the **TXT Token** value, which you copied from the earlier step.
178
+
e. TTL: Default or 1 hour / 3600 seconds
179
+
180
+
181
+
11. On the domain solutions page, select **Identity Providers**.
162
182
163
-
![Identity Providers option][54]
183
+
164
184
165
-
9. In the **Identity Providers** section, select **ADD IDENTITY PROVIDER**.
185
+
12. In the **Identity Providers** section, select **ADD IDENTITY PROVIDER**.
166
186
167
-
![Add Identity Provider option][55]
187
+
168
188
169
-
10. On the **Identity Provider Settings** page, follow these steps:
170
189
171
-
![Identity Provider Settings fields][56]
190
+
13. On the **Identity Provider Settings** page, follow these steps:
172
191
173
-
a. In the **Name** box, type a unique name for your configuration. Don't use spaces.
192
+
a. In the **Custom Name** box, type a unique name for your configuration. Don't use spaces.
193
+
194
+
174
195
175
196
b. In the **Identity Provider Issuer box**, paste the **Azure AD Identifier** value, which you copied from the Azure portal.
176
197
198
+
199
+
200
+
177
201
c. In the **Identity Provider Login URL** box, paste the **Login URL** value, which you copied from Azure portal.
178
202
179
203
d. In the **Identity Provider Logout URL** box, paste the value of **Logout URL**, which you copied from Azure portal.
204
+
205
+
206
+
180
207
181
208
e. For **Send AuthN request by**, select **POST**.
182
209
183
210
f. For **Send logout request by**, select **GET**.
184
211
185
212
g. In the **Custom Attribute Mapping** section, select **ADD NEW MAPPING**.
186
213
187
-
![Custom Attribute Mapping UI][62]
214
+
188
215
189
216
h. Choose the field you want to map to the Azure AD claim. In this example, the **emailaddress** claim is mapped with the value of `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`. That's the default claim name from Azure AD for the email claim. Select **SAVE**.
190
217
191
-
![Custom Attribute Mapping fields][57]
218
+
192
219
193
220
> [!NOTE]
194
-
> Use the appropriate **User identifier** to map the user from Azure AD to DocuSign user mapping. Select the proper field, and enter the appropriate value based on your organization settings.
221
+
> Use the appropriate **User identifier** to map the user from Azure AD to DocuSign user mapping. Select the proper field, and enter the appropriate value based on your organization settings. Custom Attribute Mapping setting is not mandatory.
195
222
196
223
i. In the **Identity Provider Certificates** section, select **ADD CERTIFICATE**, upload the certificate you downloaded from Azure AD portal, and select **SAVE**.
199
226
200
227
j. In the **Identity Providers** section, select **ACTIONS**, and then select **Endpoints**.
201
228
202
-
![Identity Providers/Endpoints][59]
229
+
203
230
204
231
k. In the **View SAML 2.0 Endpoints** section of the DocuSign admin portal, follow these steps:
205
232
206
-
![View SAML 2.0 Endpoints][60]
233
+
207
234
208
235
1. Copy the **Service Provider Issuer URL**, and then paste it into the **Identifier** box in **Basic SAML Configuration** section in the Azure portal.
209
236
@@ -230,22 +257,6 @@ In this section, you test your Azure AD single sign-on configuration with follow
230
257
231
258
* You can use Microsoft My Apps. When you click the DocuSign tile in the My Apps, you should be automatically signed in to the DocuSign for which you set up the SSO. For more information about the My Apps, see [Introduction to the My Apps](https://support.microsoft.com/account-billing/sign-in-and-start-apps-from-the-my-apps-portal-2f3b1bae-0e5a-4a86-a33e-876fbd2a4510).
232
259
233
-
## Next Steps
260
+
## Next steps
234
261
235
262
Once you configure DocuSign you can enforce Session control, which protects exfiltration and infiltration of your organization’s sensitive data in real time. Session control extends from Conditional Access. [Learn how to enforce session control with Microsoft Defender for Cloud Apps](/cloud-app-security/proxy-deployment-aad).
0 commit comments