You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-domain-services/policy-reference.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Built-in policy definitions for Azure Active Directory Domain Services
3
3
description: Lists Azure Policy built-in policy definitions for Azure Active Directory Domain Services. These built-in policy definitions provide common approaches to managing your Azure resources.
This article shows you how to call a protected ASP.NET Core web API using Client URL (cURL). cURL is a command line tool that developers use to transfer data to and from a server. In this article, you'll register a web app and a web API in a tenant on the Azure portal. The web app is used to get an access token generated by the Microsoft identity platform. Next, you'll use the token to make an authorized call to the web API using cURL.
22
+
This article shows you how to call a protected ASP.NET Core web API using Client URL (cURL). cURL is a command line tool that developers use to transfer data to and from a server. In this article, you'll register a web app and a web API in a tenant. The web app is used to get an access token generated by the Microsoft identity platform. Next, you'll use the token to make an authorized call to the web API using cURL.
23
23
24
24
::: zone-end
25
25
@@ -70,10 +70,10 @@ The Microsoft identity platform requires your application to be registered befor
70
70
71
71
Follow these steps to create the web API registration:
72
72
73
-
1. Sign in to the [Azure portal](https://portal.azure.com).
73
+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](../roles/permissions-reference.md#application-developer).
74
74
1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.
75
-
1.Search for and select**Azure Active Directory**.
76
-
1.Under**Manage**, select **App registrations > New registration**.
75
+
1.Browse to **Identity** >**Applications** > **Application registrations**.
76
+
1.Select**New registration**.
77
77
1. Enter a **Name** for the application, such as *NewWebAPI1*.
78
78
1. For **Supported account types**, select **Accounts in this organizational directory only**. For information on different account types, select **Help me choose** option.
79
79
1. Select **Register**.
@@ -118,8 +118,8 @@ Follow these steps to create the web app registration:
118
118
119
119
::: zone pivot="no-api"
120
120
121
-
1. Select **Home** to return to the home page. Search for and select**Azure Active Directory**.
1. Select **Home** to return to the home page. Browse to **Identity** >**Applications** > **Application registrations**.
122
+
1.Select**New registration**.
123
123
1. Enter a **Name** for the application, such as `web-app-calls-web-api`.
124
124
1. For **Supported account types**, select **Accounts in this organizational directory only**. For information on different account types, select the **Help me choose** option.
125
125
1. Under **Redirect URI (optional)**, select **Web**, and then enter `http://localhost` in the URL text box.
@@ -129,26 +129,26 @@ Follow these steps to create the web app registration:
129
129
130
130
::: zone pivot="api"
131
131
132
-
1. Sign in to the [Azure portal](https://portal.azure.com).
133
-
1. If access to multiple tenants is available, use the Directories + subscriptions filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.
134
-
1.Search for and select**Azure Active Directory**.
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](../roles/permissions-reference.md#application-developer).
133
+
1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.
134
+
1.Browse to **Identity** >**Applications** > **Application registrations**.
135
+
1.Select**New registration**.
136
136
1. Enter a Name for the application, such as `web-app-calls-web-api`.
137
137
1. For **Supported account types**, select **Accounts in this organizational directory only**. For information on different account types, select the **Help me choose** option.
138
138
1. Under **Redirect URI (optional)**, select **Web**, and then enter `http://localhost` in the URL text box.
139
139
1. Select **Register**.
140
140
141
141
::: zone-end
142
142
143
-
When registration is complete, the Azure portal displays the app registration's**Overview** pane. Record the **Directory (tenant) ID** and the **Application (client) ID** to be used in later steps.
143
+
When registration is complete, the app registration is displayed on the**Overview** pane. Record the **Directory (tenant) ID** and the **Application (client) ID** to be used in later steps.
144
144
145
145
#### Add a client secret
146
146
147
147
A client secret is a string value your app can use to identity itself, and is sometimes referred to as an *application password*. The web app uses the client secret to prove its identity when it requests tokens.
148
148
149
149
Follow these steps to configure a client secret:
150
150
151
-
1. From the **Overview** pane in the Azure portal, under **Manage**, select **Certificates & secrets** > **Client secrets** > **New client secret**.
151
+
1. From the **Overview** pane, under **Manage**, select **Certificates & secrets** > **Client secrets** > **New client secret**.
152
152
1. Add a description for your client secret, for example *My client secret*.
153
153
1. Select an expiration for the secret or specify a custom lifetime.
154
154
@@ -164,14 +164,14 @@ By specifying a web API's scopes in the web app registration, the web app can ob
164
164
165
165
Follow these steps to configure the web app permissions to the web API:
166
166
167
-
1. From the **Overview** pane of your web application in the Azure portal (*web-app-that-calls-web-api*), under **Manage**, select **API permissions** > **Add a permission** > **My APIs**.
167
+
1. From the **Overview** pane of your web application (*web-app-that-calls-web-api*), under **Manage**, select **API permissions** > **Add a permission** > **My APIs**.
168
168
1. Select **NewWebAPI1** or the API that you wish to add permissions to.
169
169
1. Under **Select permissions**, check the box next to **Forecast.Read**. You may need to expand the **Permission** list. This selects the permissions the client app should have on behalf of the signed-in user.
170
170
1. Select **Add permissions** to complete the process.
171
171
172
172
After adding these permissions to your API, you should see the selected permissions under **Configured permissions**.
173
173
174
-
You may also notice the **User.Read** permission for the Microsoft Graph API. This permission is added automatically when you register an app in the Azure portal.
174
+
You may also notice the **User.Read** permission for the Microsoft Graph API. This permission is added automatically when you register an app.
175
175
176
176
::: zone pivot="no-api"
177
177
@@ -185,8 +185,8 @@ You may also notice the **User.Read** permission for the Microsoft Graph API. Th
185
185
186
186
1. Navigate to `ms-identity-docs-code-dotnet/web-api` folder and open `./appsettings.json` file, replace the `{APPLICATION_CLIENT_ID}` and `{DIRECTORY_TENANT_ID}` with:
187
187
188
-
-`{APPLICATION_CLIENT_ID}` is the web API **Application (client) ID** on the app's **Overview** pane **App registrations** in the Azure portal.
189
-
-`{DIRECTORY_TENANT_ID}` is the web API **Directory (tenant) ID** on the app's **Overview** pane **App registrations** in the Azure portal.
188
+
-`{APPLICATION_CLIENT_ID}` is the web API **Application (client) ID** on the app's **Overview** pane **App registrations**.
189
+
-`{DIRECTORY_TENANT_ID}` is the web API **Directory (tenant) ID** on the app's **Overview** pane **App registrations**.
190
190
191
191
1. Execute the following command to start the app:
192
192
@@ -258,9 +258,9 @@ The authorization code flow begins with the client directing the user to the `/a
258
258
```
259
259
260
260
1. Copy the URL, replace the following parameters and paste it into your browser:
261
-
-`{tenant_id}` is the web app **Directory (tenant) ID**. This should be the same value across both of the applications's **Overview** pane **App registrations** in the Azure portal.
262
-
-`{web-app-calls-web-api_application_client_id}` is the **Application (client) ID** on the web app's (*web-app-calls-web-api*) **Overview** pane in the Azure portal.
263
-
-`{web_API_application_client_id}` is the **Application (client) ID** on the web API's (*NewWebAPI1*) **Overview** pane in the Azure portal.
261
+
-`{tenant_id}` is the web app **Directory (tenant) ID**. This should be the same value across both of the applications's **Overview** pane **App registrations**.
262
+
-`{web-app-calls-web-api_application_client_id}` is the **Application (client) ID** on the web app's (*web-app-calls-web-api*) **Overview** pane.
263
+
-`{web_API_application_client_id}` is the **Application (client) ID** on the web API's (*NewWebAPI1*) **Overview** pane.
264
264
1. Sign in as a user in the Azure AD tenant in which the apps are registered. Consent to any requests for access, if necessary.
265
265
1. Your browser will be redirected to `http://localhost/`. Refer to your browser's navigation bar and copy the `{authorization_code}` to use in the following steps. The URL takes the form of the following snippet:
266
266
@@ -283,9 +283,9 @@ cURL can now be used to request an access token from the Microsoft identity plat
283
283
-d 'grant_type=authorization_code' \
284
284
-d 'client_secret={client_secret}'
285
285
```
286
-
-`{tenant_id}` is the web app **Directory (tenant) ID**. This should be the same value across both of the applications's **Overview** pane **App registrations** in the Azure portal.
287
-
-`client_id={web-app-calls-web-api_application_client_id}`, and `session_state={web-app-calls-web-api_application_client_id}` is the **Application (client) ID** on the web application's (*web-app-calls-web-api*) **Overview** pane in the Azure portal.
288
-
-`api://{web_API_application_client_id}/Forecast.Read` is the **Application (client) ID** on the web API's (*NewWebAPI1*) **Overview** pane in the Azure portal.
286
+
-`{tenant_id}` is the web app **Directory (tenant) ID**. This should be the same value across both of the applications's **Overview** pane **App registrations**.
287
+
-`client_id={web-app-calls-web-api_application_client_id}`, and `session_state={web-app-calls-web-api_application_client_id}` is the **Application (client) ID** on the web application's (*web-app-calls-web-api*) **Overview** pane.
288
+
-`api://{web_API_application_client_id}/Forecast.Read` is the **Application (client) ID** on the web API's (*NewWebAPI1*) **Overview** pane.
289
289
-`code={authorization_code}` is the authorization code that was received in [Request an authorization code](#request-an-authorization-code). This enables the cURL tool to request an access token.
290
290
-`client_secret={client_secret}` is the client secret **Value** recorded in [Add a client secret](#add-a-client-secret).
0 commit comments