|
1 | | ---- |
2 | | -title: Azure Government Integrate Azure AD Authentication | Microsoft Docs |
3 | | -description: This article demonstrates how to integrating Azure AD Authentication on Azure Government. |
4 | | -services: azure-government |
5 | | -cloud: gov |
6 | | -documentationcenter: '' |
7 | | - |
8 | | -ms.service: azure-government |
9 | | -ms.devlang: na |
10 | | -ms.topic: article |
11 | | -ms.tgt_pltfrm: na |
12 | | -ms.workload: azure-government |
13 | | -ms.date: 11/2/2017 |
14 | | - |
15 | | ---- |
16 | | -# Integrate Azure AD Authentication with Web Apps on Azure Government |
17 | | -The following quickstart helps you get started integrating Azure AD Authentication with applications on Azure Government. Azure Active Directory (Azure AD) Authentication on Azure Government is similar to the Azure commercial platform, with a [few exceptions](./compare-azure-government-global-azure.md). |
18 | | - |
19 | | -Learn more about [Azure Active Directory Authentication Scenarios](../active-directory/develop/authentication-vs-authorization.md). |
20 | | - |
21 | | -## Integrate Azure AD login into a web application using OpenID Connect |
22 | | -This section shows how to integrate Azure AD using the OpenID Connect protocol for signing in users into a web app. |
23 | | - |
24 | | -### Prerequisites |
25 | | -- An Azure AD tenant in Azure Government. You must have an [Azure Government subscription](https://azure.microsoft.com/overview/clouds/government/request/) in order to have an Azure AD tenant in Azure Government. For more information on how to get an Azure AD tenant, see [How to get an Azure AD tenant](../active-directory/develop/quickstart-create-new-tenant.md) |
26 | | -- A user account in your Azure AD tenant. This sample does not work with a Microsoft account, so if you signed in to the Azure Government portal with a Microsoft account and have never created a user account in your directory before, you need to do that now. |
27 | | -- Have an [ASP.NET Core application deployed and running in Azure Government](documentation-government-howto-deploy-webandmobile.md) |
28 | | - |
29 | | -### Step 1: Register your web application with your Azure AD Tenant |
30 | | - |
31 | | -1. Sign in to the [Azure Government portal](https://portal.azure.us). |
32 | | -2. On the top bar, click on your account and under the **Directory** list, choose the Active Directory tenant where you wish to register your application. |
33 | | -3. Click on **All Services** in the left-hand nav, and choose **Azure Active Directory**. |
34 | | -4. Click on **App registrations** and choose **Add**. |
35 | | -5. Enter the name for your application, and select 'Web Application and/or Web API' as the Application Type. For the sign-on URL, enter the base URL for your application, which is your Azure App URL + "/signin-oidc." |
36 | | - |
37 | | - >[!Note] |
38 | | - > If you have not deployed your application and want to run it locally, your App URL would be your local host address. |
39 | | - > |
40 | | - > |
41 | | -
|
42 | | - Click on **Create** to create the application. |
43 | | -6. While still in the Azure portal, choose your application, click on **Settings**, and choose **Properties**. |
44 | | -7. Find the Application ID value and copy it to the clipboard. |
45 | | -8. For the App ID URI, enter https://\<your_tenant_name\>/\<name_of_your_app\>, replacing \<your_tenant_name\> with the name of your Azure AD tenant and \<name_of_your_app\> with the name of your application. |
46 | | - |
47 | | -### Step 2: Configure your app to use your Azure AD tenant |
48 | | -#### Azure Government Variations |
49 | | -The only variation when setting up Azure AD Authorization on the Azure Government cloud is in the Azure AD Instance: |
50 | | -- "https:\//login.microsoftonline.us" |
51 | | - |
52 | | -#### Configure the InventoryApp project |
53 | | -1. Open your application in Visual Studio 2019. |
54 | | -2. Open the `appsettings.json` file. |
55 | | -3. Add an `Authentication` section and fill out the properties with your Azure AD tenant information. |
56 | | - |
57 | | - ```cs |
58 | | - //ClientId: Azure AD-> App registrations -> Application ID |
59 | | - //Domain: <tenantname>.onmicrosoft.com |
60 | | - //TenantId: Azure AD -> Properties -> Directory ID |
61 | | -
|
62 | | - "Authentication": { |
63 | | - "AzureAd": { |
64 | | - |
65 | | - "Azure ADInstance": "https://login.microsoftonline.us/", |
66 | | - "CallbackPath": "/signin-oidc", |
67 | | - "ClientId": "<clientid>", |
68 | | - "Domain": "<domainname>", |
69 | | - "TenantId": "<tenantid>" |
70 | | - } |
71 | | - } |
72 | | - ``` |
73 | | -4. Fill out the `ClientId` property with the Client ID for your app from the Azure Government portal. You can find the Client ID by navigating to Azure AD -> App Registrations -> Your Application -> Application ID. |
74 | | -5. Fill out the `TenantId` property with the Tenant ID for your app from the Azure Government portal. You can find the Tenant ID by navigating to Azure AD -> Properties -> Directory ID. |
75 | | -6. Fill out the `Domain` property with `<tenantname>.onmicrosoft.com`. |
76 | | -7. Open the `startup.cs` file. |
77 | | -8. In your `ConfigureServices` method, add the following code: |
78 | | - |
79 | | - ```cs |
80 | | - public void ConfigureServices(IServiceCollection services) |
81 | | - { |
82 | | - //Add Azure AD authentication |
83 | | - services.AddAuthentication(options => { |
84 | | - options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme; |
85 | | - options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme; |
86 | | - }) |
87 | | - .AddCookie() |
88 | | - .AddOpenIdConnect(options => { |
89 | | - options.Authority = Configuration["Authentication:AzureAd:Azure ADInstance"] + Configuration["Authentication:AzureAd:TenantId"]; |
90 | | - options.ClientId = Configuration["Authentication:AzureAd:ClientId"]; |
91 | | - options.CallbackPath = Configuration["Authentication:AzureAd:CallbackPath"]; |
92 | | - }); |
93 | | - |
94 | | - } |
95 | | - ``` |
96 | | - |
97 | | - In the same file, add this one line of code to the `Configure` method: |
98 | | - |
99 | | - ```csharp |
100 | | - app.UseAuthentication(); |
101 | | - ``` |
102 | | - |
103 | | -9. Navigate to your **Home** controller or whichever controller file is your home page, **where you want your users to log in**. Add the `[Authorize]` tag before the class definition. |
104 | | - |
105 | | -## Next steps |
106 | | - |
107 | | -* Navigate to the [Azure Government PaaS Sample](https://github.com/Azure-Samples/gov-paas-sample) to see Azure AD Authentication as well as other services being integrated in an Application running on Azure Government. |
108 | | -* Subscribe to the [Azure Government blog](https://blogs.msdn.microsoft.com/azuregov/) |
109 | | -* Get help on Stack Overflow by using the "[azure-gov](https://stackoverflow.com/questions/tagged/azure-gov)" tag |
110 | | -* Give feedback or request new features via the [Azure Government feedback forum](https://feedback.azure.com/d365community/) |
| 1 | +--- |
| 2 | +title: Azure Government integrate Azure AD Authentication |
| 3 | +description: This article demonstrates how to integrating Azure AD authentication on Azure Government. |
| 4 | +ms.service: azure-government |
| 5 | +ms.topic: article |
| 6 | +ms.date: 11/02/2021 |
| 7 | +--- |
| 8 | + |
| 9 | +# Integrate Azure AD authentication with Web Apps on Azure Government |
| 10 | + |
| 11 | +The following quickstart helps you get started integrating Azure AD Authentication with applications on Azure Government. Azure Active Directory (Azure AD) Authentication on Azure Government is similar to the Azure commercial platform, with a [few exceptions](./compare-azure-government-global-azure.md). |
| 12 | + |
| 13 | +Learn more about [Azure Active Directory Authentication Scenarios](../active-directory/develop/authentication-vs-authorization.md). |
| 14 | + |
| 15 | +## Integrate Azure AD login into a web application using OpenID Connect |
| 16 | + |
| 17 | +This section shows how to integrate Azure AD using the OpenID Connect protocol for signing in users into a web app. |
| 18 | + |
| 19 | +### Prerequisites |
| 20 | + |
| 21 | +- An Azure AD tenant in Azure Government. You must have an [Azure Government subscription](https://azure.microsoft.com/overview/clouds/government/request/) in order to have an Azure AD tenant in Azure Government. For more information on how to get an Azure AD tenant, see [How to get an Azure AD tenant](../active-directory/develop/quickstart-create-new-tenant.md) |
| 22 | +- A user account in your Azure AD tenant. This sample does not work with a Microsoft account, so if you signed in to the Azure Government portal with a Microsoft account and have never created a user account in your directory before, you need to do that now. |
| 23 | +- Have an [ASP.NET Core application deployed and running in Azure Government](documentation-government-howto-deploy-webandmobile.md) |
| 24 | + |
| 25 | +### Step 1: Register your web application with your Azure AD Tenant |
| 26 | + |
| 27 | +1. Sign in to the [Azure Government portal](https://portal.azure.us). |
| 28 | +2. On the top bar, click on your account and under the **Directory** list, choose the Active Directory tenant where you wish to register your application. |
| 29 | +3. Click on **All Services** in the left-hand nav, and choose **Azure Active Directory**. |
| 30 | +4. Click on **App registrations** and choose **Add**. |
| 31 | +5. Enter the name for your application, and select 'Web Application and/or Web API' as the Application Type. For the sign-on URL, enter the base URL for your application, which is your Azure App URL + "/signin-oidc." |
| 32 | + |
| 33 | + >[!Note] |
| 34 | + > If you have not deployed your application and want to run it locally, your App URL would be your local host address. |
| 35 | + > |
| 36 | + > |
| 37 | +
|
| 38 | + Click on **Create** to create the application. |
| 39 | +6. While still in the Azure portal, choose your application, click on **Settings**, and choose **Properties**. |
| 40 | +7. Find the Application ID value and copy it to the clipboard. |
| 41 | +8. For the App ID URI, enter https://\<your_tenant_name\>/\<name_of_your_app\>, replacing \<your_tenant_name\> with the name of your Azure AD tenant and \<name_of_your_app\> with the name of your application. |
| 42 | + |
| 43 | +### Step 2: Configure your app to use your Azure AD tenant |
| 44 | + |
| 45 | +#### Azure Government Variations |
| 46 | + |
| 47 | +The only variation when setting up Azure AD Authorization on the Azure Government cloud is in the Azure AD Instance: |
| 48 | +- "https:\//login.microsoftonline.us" |
| 49 | + |
| 50 | +#### Configure the InventoryApp project |
| 51 | + |
| 52 | +1. Open your application in Visual Studio 2019. |
| 53 | +2. Open the `appsettings.json` file. |
| 54 | +3. Add an `Authentication` section and fill out the properties with your Azure AD tenant information. |
| 55 | + |
| 56 | + ```cs |
| 57 | + //ClientId: Azure AD-> App registrations -> Application ID |
| 58 | + //Domain: <tenantname>.onmicrosoft.com |
| 59 | + //TenantId: Azure AD -> Properties -> Directory ID |
| 60 | +
|
| 61 | + "Authentication": { |
| 62 | + "AzureAd": { |
| 63 | + |
| 64 | + "Azure ADInstance": "https://login.microsoftonline.us/", |
| 65 | + "CallbackPath": "/signin-oidc", |
| 66 | + "ClientId": "<clientid>", |
| 67 | + "Domain": "<domainname>", |
| 68 | + "TenantId": "<tenantid>" |
| 69 | + } |
| 70 | + } |
| 71 | + ``` |
| 72 | +4. Fill out the `ClientId` property with the Client ID for your app from the Azure Government portal. You can find the Client ID by navigating to Azure AD -> App Registrations -> Your Application -> Application ID. |
| 73 | +5. Fill out the `TenantId` property with the Tenant ID for your app from the Azure Government portal. You can find the Tenant ID by navigating to Azure AD -> Properties -> Directory ID. |
| 74 | +6. Fill out the `Domain` property with `<tenantname>.onmicrosoft.com`. |
| 75 | +7. Open the `startup.cs` file. |
| 76 | +8. In your `ConfigureServices` method, add the following code: |
| 77 | + |
| 78 | + ```cs |
| 79 | + public void ConfigureServices(IServiceCollection services) |
| 80 | + { |
| 81 | + //Add Azure AD authentication |
| 82 | + services.AddAuthentication(options => { |
| 83 | + options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme; |
| 84 | + options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme; |
| 85 | + }) |
| 86 | + .AddCookie() |
| 87 | + .AddOpenIdConnect(options => { |
| 88 | + options.Authority = Configuration["Authentication:AzureAd:Azure ADInstance"] + Configuration["Authentication:AzureAd:TenantId"]; |
| 89 | + options.ClientId = Configuration["Authentication:AzureAd:ClientId"]; |
| 90 | + options.CallbackPath = Configuration["Authentication:AzureAd:CallbackPath"]; |
| 91 | + }); |
| 92 | + |
| 93 | + } |
| 94 | + ``` |
| 95 | + |
| 96 | + In the same file, add this one line of code to the `Configure` method: |
| 97 | + |
| 98 | + ```csharp |
| 99 | + app.UseAuthentication(); |
| 100 | + ``` |
| 101 | + |
| 102 | +9. Navigate to your **Home** controller or whichever controller file is your home page, **where you want your users to log in**. Add the `[Authorize]` tag before the class definition. |
| 103 | + |
| 104 | +## Next steps |
| 105 | + |
| 106 | +* Navigate to the [Azure Government PaaS Sample](https://github.com/Azure-Samples/gov-paas-sample) to see Azure AD Authentication as well as other services being integrated in an Application running on Azure Government. |
| 107 | +* Subscribe to the [Azure Government blog](https://blogs.msdn.microsoft.com/azuregov/) |
| 108 | +* Get help on Stack Overflow by using the "[azure-gov](https://stackoverflow.com/questions/tagged/azure-gov)" tag |
0 commit comments