You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/develop/scenario-web-api-call-api-app-configuration.md
+23-26Lines changed: 23 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,22 +4,19 @@ description: Learn how to build a web API that calls web APIs (app's code config
4
4
services: active-directory
5
5
author: jmprieur
6
6
manager: CelesteDG
7
-
8
7
ms.service: active-directory
9
8
ms.subservice: develop
10
9
ms.topic: conceptual
11
10
ms.workload: identity
12
-
ms.date: 09/26/2020
11
+
ms.date: 08/12/2022
13
12
ms.author: jmprieur
14
13
ms.custom: aaddev
15
14
#Customer intent: As an application developer, I want to know how to write a web API that calls web APIs by using the Microsoft identity platform.
16
15
---
17
16
18
17
# A web API that calls web APIs: Code configuration
19
18
20
-
After you've registered your web API, you can configure the code for the application.
21
-
22
-
The code that you use to configure your web API so that it calls downstream web APIs builds on top of the code that's used to protect a web API. For more information, see [Protected web API: App configuration](scenario-protected-web-api-app-configuration.md).
19
+
Once registration for a Web API is complete, the application code can be configured. Configuring a web API to call a downstream web API builds on the code that's used in protecting a web API. For more information, see [Protected web API: App configuration](scenario-protected-web-api-app-configuration.md).
23
20
24
21
# [ASP.NET Core](#tab/aspnetcore)
25
22
@@ -29,22 +26,21 @@ Microsoft recommends that you use the [Microsoft.Identity.Web](https://www.nuget
29
26
30
27
## Client secrets or client certificates
31
28
32
-
Given that your web API now calls a downstream web API, provide a client secret or client certificate in the *appsettings.json*file. You can also add a section that specifies:
29
+
Given that the web API now calls a downstream web API, a client secret or client certificate in *appsettings.json*can be used for authentication. A section can be added to specify:
33
30
34
31
- The URL of the downstream web API
35
32
- The scopes required for calling the API
36
33
37
34
In the following example, the `GraphBeta` section specifies these settings.
@@ -79,11 +74,13 @@ Instead of a client secret, you can provide a client certificate. The following
79
74
}
80
75
```
81
76
82
-
Microsoft.Identity.Web provides several ways to describe certificates, both by configuration or by code. For details, see [Microsoft.Identity.Web wiki - Using certificates](https://github.com/AzureAD/microsoft-identity-web/wiki/Using-certificates) on GitHub.
77
+
*Microsoft.Identity.Web* provides several ways to describe certificates, both by configuration or by code. For details, see [Microsoft.Identity.Web wiki - Using certificates](https://github.com/AzureAD/microsoft-identity-web/wiki/Using-certificates).
83
78
84
79
## Program.cs
85
80
86
-
Your web API will need to acquire a token for the downstream API. You specify it by adding the `.EnableTokenAcquisitionToCallDownstreamApi()` line after `.AddMicrosoftIdentityWebApi(Configuration)`. This line exposes the `ITokenAcquisition` service, that you can use in your controller/pages actions. However, as you'll see in the next two bullet points, you can do even simpler. You'll also need to choose a token cache implementation, for example `.AddInMemoryTokenCaches()`, in *Program.cs*. If you use ASP.NET Core 3.1 or 5.0 the code will be similar but in the *Startup.cs* file.
81
+
A web API will need to acquire a token for the downstream API. Specify it by adding the `.EnableTokenAcquisitionToCallDownstreamApi()` line after `.AddMicrosoftIdentityWebApi(Configuration)`. This line exposes the `ITokenAcquisition` service that can be used in the controller/pages actions.
82
+
83
+
However, an alternative method is to implement a token cache. For example, adding `.AddInMemoryTokenCaches()`, to *Program.cs* will allow the token to be cached in memory.
If you don't want to acquire the token yourself, *Microsoft.Identity.Web* provides two mechanisms for calling a downstream web API from another API. The option you choose depends on whether you want to call Microsoft Graph or another API.
96
+
*Microsoft.Identity.Web* provides two mechanisms for calling a downstream web API from another API. The option you choose depends on whether you want to call Microsoft Graph or another API.
100
97
101
98
### Option 1: Call Microsoft Graph
102
99
103
-
If you want to call Microsoft Graph, Microsoft.Identity.Web enables you to directly use the `GraphServiceClient` (exposed by the Microsoft Graph SDK) in your API actions. To expose Microsoft Graph:
100
+
To call Microsoft Graph, *Microsoft.Identity.Web* enables you to directly use the `GraphServiceClient` (exposed by the Microsoft Graph SDK) in the API actions. To expose Microsoft Graph:
104
101
105
-
1. Add the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) NuGet package to your project.
106
-
1. Add `.AddMicrosoftGraph()` after `.EnableTokenAcquisitionToCallDownstreamApi()` in the *Program.cs* file. `.AddMicrosoftGraph()` has several overrides. Using the override that takes a configuration section as a parameter, the code becomes:
102
+
1. Add the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) NuGet package to the project.
103
+
1. Add `.AddMicrosoftGraph()` after `.EnableTokenAcquisitionToCallDownstreamApi()` in *Program.cs*. `.AddMicrosoftGraph()` has several overrides. Using the override that takes a configuration section as a parameter, the code becomes:
### Option 2: Call a downstream web API other than Microsoft Graph
121
118
122
-
To call a downstream API other than Microsoft Graph, *Microsoft.Identity.Web* provides `.AddDownstreamWebApi()`, which requests tokens and calls the downstream web API.
119
+
To call a downstream API other than Microsoft Graph, *Microsoft.Identity.Web* provides `.AddDownstreamWebApi()`, which requests tokens for the downstream API on behalf of the user.
As with web apps, you can choose various token cache implementations. For details, see [Microsoft identity web - Token cache serialization](https://aka.ms/ms-id-web/token-cache-serialization) on GitHub.
137
-
138
-
The following image shows the various possibilities of *Microsoft.Identity.Web* and their impact on the *Program.cs* file:
133
+
Similar to web apps, various token cache implementations can be chosen. For details, see [Microsoft identity web - Token cache serialization](https://aka.ms/ms-id-web/token-cache-serialization) on GitHub.
134
+
135
+
The following image shows the possibilities of *Microsoft.Identity.Web* and the impact on *Program.cs*:
139
136
140
137
:::image type="content" source="media/scenarios/microsoft-identity-web-startup-cs.svg" alt-text="Block diagram showing service configuration options in startup dot C S for calling a web API and specifying a token cache implementation":::
141
138
@@ -230,4 +227,4 @@ For more information about the OBO protocol, see the [Microsoft identity platfor
230
227
## Next steps
231
228
232
229
Move on to the next article in this scenario,
233
-
[Acquire a token for the app](scenario-web-api-call-api-acquire-token.md).
230
+
[Acquire a token for the app](scenario-web-api-call-api-acquire-token.md).
# Migrate from Dapr OSS to the Dapr extension for Azure Kubernetes Service (AKS)
14
14
15
-
You've installed and configured Dapr OSS on your Kubernetes cluster and want to migrate to the Dapr extension on AKS. In this guide, you'll learn how Dapr moves your managed clusters from using Dapr OSS to the Dapr extension by either:
15
+
You've installed and configured Dapr OSS (using Dapr CLI or Helm) on your Kubernetes cluster, and want to start using the Dapr extension on AKS. In this guide, you'll learn how the Dapr extension for AKS can use the Kubernetes resources created by Dapr OSS and start managing them, by either:
16
16
17
-
- Checking for an existing Dapr installation via CLI prompts (default method), or
18
-
- Using the Helm release name and namespace configuration settings to manually check for an existing Dapr installation.
19
-
20
-
This check allows the Dapr extension to reuse the already existing Kubernetes resources from your previous installation and start managing them.
17
+
- Checking for an existing Dapr installation via Azure CLI prompts (default method), or
18
+
- Using the release name and namespace from `--configuration-settings` to explicitly point to an existing Dapr installation.
21
19
22
20
## Check for an existing Dapr installation
23
21
@@ -40,11 +38,11 @@ Enter the Helm release name for Dapr, or press Enter to use the default name [da
40
38
Enter the namespace where Dapr is installed, or press Enter to use the default namespace [dapr-system]:
41
39
```
42
40
43
-
## Configure the Dapr check using `--configuration-settings`
41
+
## Configuring the existing Dapr installation using `--configuration-settings`
44
42
45
43
Alternatively, when creating the Dapr extension, you can configure the above settings via `--configuration-settings`. This method is useful when you are automating the installation via bash scripts, CI pipelines, etc.
46
44
47
-
If you don't have Dapr already installed on your cluster, set `skipExistingDaprCheck` to `true`:
45
+
If you don't have an existing Dapr installation on your cluster, set `skipExistingDaprCheck` to `true`:
48
46
49
47
```azurecli-interactive
50
48
az k8s-extension create --cluster-type managedClusters \
@@ -98,7 +96,7 @@ For more information, see [Dapr Production Guidelines][dapr-prod-guidelines].
98
96
99
97
## Next steps
100
98
101
-
Learn more about [the cluster extension][dapr-overview] and [how to use it][dapr-howto].
99
+
Learn more about [Dapr][dapr-overview] and [how to use it][dapr-howto].
Copy file name to clipboardExpand all lines: articles/automation/troubleshoot/update-management.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -280,7 +280,7 @@ Use the following procedure if your subscription is configured for the Automatio
280
280
281
281
2. Check [Update Management history](../update-management/deploy-updates.md#view-results-of-a-completed-update-deployment) to determine the exact time when the update deployment was run.
282
282
283
-
3. For machines that you suspect to have been missed by Update Management, use Azure Resource Graph (ARG) to [locate machine changes](../../governance/resource-graph/how-to/get-resource-changes.md#find-detected-change-events-and-view-change-details).
283
+
3. For machines that you suspect to have been missed by Update Management, use Azure Resource Graph (ARG) to [locate machine changes](../../governance/resource-graph/how-to/get-resource-changes.md).
284
284
285
285
4. Search for changes over a considerable period, such as one day, before the update deployment was run.
Copy file name to clipboardExpand all lines: articles/azure-arc/kubernetes/azure-rbac.md
+37-37Lines changed: 37 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
34
34
- [Upgrade your agents](agent-upgrade.md#manually-upgrade-agents) to the latest version.
35
35
36
36
> [!NOTE]
37
-
> You can't set up this feature for managed Kubernetes offerings of cloud providers like Elastic Kubernetes Service or Google Kubernetes Engine where the user doesn't have access to the API server of the cluster. For Azure Kubernetes Service (AKS) clusters, this [feature is available natively](../../aks/manage-azure-rbac.md) and doesn't require the AKS cluster to be connected to Azure Arc. This feature isn't supported on AKS on Azure Stack HCI.
37
+
> You can't set up this feature for managed Kubernetes offerings of cloud providers like Elastic Kubernetes Service or Google Kubernetes Engine where the user doesn't have access to the API server of the cluster. For Azure Kubernetes Service (AKS) clusters, this [feature is available natively](../../aks/manage-azure-rbac.md) and doesn't require the AKS cluster to be connected to Azure Arc. For AKS on Azure Stack HCI, see [Use Azure RBAC for AKS hybrid clusters (preview)](/azure/aks/hybrid/azure-rbac-aks-hybrid).
38
38
39
39
## Set up Azure AD applications
40
40
@@ -44,32 +44,32 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
44
44
45
45
1. Create a new Azure AD application and get its `appId` value. This value is used in later steps as `serverApplicationId`.
1. To grant "Sign in and read user profile" API permissions to the server application. Copy this JSON and save it in a file called oauth2-permissions.json:
56
56
57
-
```json
58
-
{
59
-
"oauth2PermissionScopes": [
60
-
{
61
-
"adminConsentDescription": "Sign in and read user profile",
62
-
"adminConsentDisplayName": "Sign in and read user profile",
63
-
"id": "<unique_guid>",
64
-
"isEnabled": true,
65
-
"type": "User",
66
-
"userConsentDescription": "Sign in and read user profile",
67
-
"userConsentDisplayName": "Sign in and read user profile",
68
-
"value": "User.Read"
69
-
}
70
-
]
71
-
}
72
-
```
57
+
```json
58
+
{
59
+
"oauth2PermissionScopes": [
60
+
{
61
+
"adminConsentDescription": "Sign in and read user profile",
62
+
"adminConsentDisplayName": "Sign in and read user profile",
63
+
"id": "<paste_the_SERVER_APP_ID>",
64
+
"isEnabled": true,
65
+
"type": "User",
66
+
"userConsentDescription": "Sign in and read user profile",
67
+
"userConsentDisplayName": "Sign in and read user profile",
68
+
"value": "User.Read"
69
+
}
70
+
]
71
+
}
72
+
```
73
73
74
74
1. Update the application's group membership claims. Run the commands in the same directory as `oauth2-permissions.json` file. RBAC for Azure Arc-enabled Kubernetes requires [`signInAudience` to be set to **AzureADMyOrg**](../../active-directory/develop/supported-accounts-validation.md):
75
75
@@ -95,10 +95,10 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
95
95
az ad app permission grant --id "${SERVER_APP_ID}" --api 00000003-0000-0000-c000-000000000000 --scope User.Read
96
96
```
97
97
98
-
> [!NOTE]
99
-
> An Azure tenant administrator has to run this step.
100
-
>
101
-
> For usage of this feature in production, we recommend that you create a different server application for every cluster.
98
+
> [!NOTE]
99
+
> An Azure [application administrator](../../active-directory/roles/permissions-reference.md#application-administrator) has to run this step.
100
+
>
101
+
> For usage of this feature in production, we recommend that you create a different server application for every cluster.
102
102
103
103
#### Create a client application
104
104
@@ -139,13 +139,13 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
139
139
140
140
1. Create a new Azure AD application and get its `appId` value. This value is used in later steps as `serverApplicationId`.
Copy file name to clipboardExpand all lines: articles/azure-arc/kubernetes/quickstart-connect-cluster.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -146,6 +146,7 @@ For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enable
146
146
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
147
147
|`guestnotificationservice.azure.com`, `*.guestnotificationservice.azure.com`, `sts.windows.net`, `https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
148
148
|`*.servicebus.windows.net` | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
149
+
|`https://graph.microsoft.com/` | Required when [Azure RBAC](azure-rbac.md) is configured |
149
150
150
151
> [!NOTE]
151
152
> To translate the `*.servicebus.windows.net` wildcard into specific endpoints, use the command `\GET https://guestnotificationservice.azure.com/urls/allowlist?api-version=2020-01-01&location=<location>`. Within this command, the region must be specified for the `<location>` placeholder.
0 commit comments