You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Applications that are only accessing resources (i.e Microsoft Graph, KeyVault, Outlook API, and other Microsoft APIs) generally only obtain a token and pass it along to the resource owner. Given that they are not protecting any resources, they do not inspect the token and therefore do not need to ensure it is properly signed.
51
+
Applications that are only accessing resources (for example, Microsoft Graph, KeyVault, Outlook API, and other Microsoft APIs) generally only obtain a token and pass it along to the resource owner. Given that they are not protecting any resources, they do not inspect the token and therefore do not need to ensure it is properly signed.
52
52
53
53
Native client applications, whether desktop or mobile, fall into this category and are thus not impacted by the rollover.
Applications that are only accessing resources (i.e Microsoft Graph, KeyVault, Outlook API, and other Microsoft APIs) generally only obtain a token and pass it along to the resource owner. Given that they are not protecting any resources, they do not inspect the token and therefore do not need to ensure it is properly signed.
56
+
Applications that are only accessing resources (such as Microsoft Graph, KeyVault, Outlook API, and other Microsoft APIs) generally only obtain a token and pass it along to the resource owner. Given that they are not protecting any resources, they do not inspect the token and therefore do not need to ensure it is properly signed.
57
57
58
58
Web applications and web APIs that are using the app-only flow (client credentials / client certificate) to request tokens fall into this category and are thus not impacted by the rollover.
# Quickstart: ASP.NET Core web app that signs in users and calls Microsoft Graph on their behalf
20
20
21
-
In this quickstart, you download and run a code sample that demonstrates how an ASP.NET Core web app can sign in users from any Azure Active Directory (Azure AD) organization and calls Microsoft Graph.
22
-
23
-
See [How the sample works](#how-the-sample-works) for an illustration.
24
-
25
-
## Step 1: Configure your application in the Azure portal
26
-
27
-
For the code sample in this quickstart to work, add a **Redirect URI** of `https://localhost:44321/signin-oidc` and **Front-channel logout URL** of `https://localhost:44321/signout-oidc` in the app registration.
28
-
> [!div class="nextstepaction"]
29
-
> [Make this change for me]()
30
-
31
-
> [!div class="alert alert-info"]
32
-
>  Your application is configured with these attributes.
33
-
34
-
## Step 2: Download the ASP.NET Core project
35
-
36
-
Run the project.
37
-
38
-
> [!div class="nextstepaction"]
39
-
> [Download the code sample](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/archive/aspnetcore3-1-callsgraph.zip)
## Step 3: Your app is configured and ready to run
45
-
46
-
We have configured your project with values of your app's properties and it's ready to run.
47
-
48
-
> [!NOTE]
49
-
> `Enter_the_Supported_Account_Info_Here`
50
-
51
-
## About the code
52
-
53
-
This section gives an overview of the code required to sign in users and call the Microsoft Graph API on their behalf. This overview can be useful to understand how the code works, main arguments, and also if you want to add sign-in to an existing ASP.NET Core application and call Microsoft Graph. It uses [Microsoft.Identity.Web](microsoft-identity-web.md), which is a wrapper around [MSAL.NET](msal-overview.md).
54
-
55
-
### How the sample works
56
-
57
-
58
-
59
-
### Startup class
60
-
61
-
The *Microsoft.AspNetCore.Authentication* middleware uses a `Startup` class that's executed when the hosting process initializes:
// Enables a UI and controller for sign in and sign out.
91
-
services.AddRazorPages()
92
-
.AddMicrosoftIdentityUI();
93
-
}
94
-
```
95
-
96
-
The `AddAuthentication()` method configures the service to add cookie-based authentication, which is used in browser scenarios and to set the challenge to OpenID Connect.
97
-
98
-
The line containing `.AddMicrosoftIdentityWebApp` adds the Microsoft identity platform authentication to your application. This is provided by [Microsoft.Identity.Web](microsoft-identity-web.md). It's then configured to sign in using the Microsoft identity platform based on the information in the `AzureAD` section of the *appsettings.json* configuration file:
|`ClientId`|**Application (client) ID** of the application registered in the Azure portal. |
103
-
|`Instance`| Security token service (STS) endpoint for the user to authenticate. This value is typically `https://login.microsoftonline.com/`, indicating the Azure public cloud. |
104
-
|`TenantId`| Name of your tenant or its tenant ID (a GUID), or *common* to sign in users with work or school accounts or Microsoft personal accounts. |
105
-
106
-
The `EnableTokenAcquisitionToCallDownstreamApi` method enables your application to acquire a token to call protected web APIs. `AddMicrosoftGraph` enables your controllers or Razor pages to benefit directly the `GraphServiceClient` (by dependency injection) and the `AddInMemoryTokenCaches` methods enables your app to benefit from a token cache.
107
-
108
-
The `Configure()` method contains two important methods, `app.UseAuthentication()` and `app.UseAuthorization()`, that enable their named functionality. Also in the `Configure()` method, you must register Microsoft Identity Web's routes with at least one call to `endpoints.MapControllerRoute()` or a call to `endpoints.MapControllers()`.
// endpoints.MapControllers(); // REQUIRED if MapControllerRoute() isn't called.
124
-
```
125
-
126
-
### Protect a controller or a controller's method
127
-
128
-
You can protect a controller or its methods by applying the `[Authorize]` attribute to the controller's class or one or more of its methods. This `[Authorize]` attribute restricts access by allowing only authenticated users. If the user isn't already authenticated, an authentication challenge can be started to access the controller. In this quickstart, the scopes are read from the configuration file:
[!INCLUDE [Help and support](../../../includes/active-directory-develop-help-support-include.md)]
142
-
143
-
## Next steps
144
-
145
-
The GitHub repo that contains the ASP.NET Core code sample referenced in this quickstart includes instructions and more code samples that show you how to:
146
-
147
-
- Add authentication to a new ASP.NET Core Web application
148
-
- Call Microsoft Graph, other Microsoft APIs, or your own web APIs
149
-
- Add authorization
150
-
- Sign in users in national clouds or with social identities
151
-
152
-
> [!div class="nextstepaction"]
153
-
> [ASP.NET Core web app tutorials on GitHub](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/)
21
+
> [!div renderon="docs"]
22
+
> Welcome! This probably isn't the page you were expecting. While we work on a fix, this link should take you to the right article:
23
+
>
24
+
> > [Quickstart: ASP.NET Core web app that signs in users and calls a web API](web-app-quickstart.md?pivots=devlang-aspnet-core)
25
+
>
26
+
> We apologize for the inconvenience and appreciate your patience while we work to get this resolved.
27
+
28
+
> [!div renderon="portal" class="sxs-lookup"]
29
+
> In this quickstart, you download and run a code sample that demonstrates how an ASP.NET Core web app can sign in users from any Azure Active Directory (Azure AD) organization and calls Microsoft Graph.
30
+
>
31
+
> See [How the sample works](#how-the-sample-works) for an illustration.
32
+
>
33
+
> ## Step 1: Configure your application in the Azure portal
34
+
>
35
+
> For the code sample in this quickstart to work, add a **Redirect URI** of `https://localhost:44321/signin-oidc` and > **Front-channel logout URL** of `https://localhost:44321/signout-oidc` in the app registration.
36
+
> > [!div class="nextstepaction"]
37
+
> > [Make this change for me]()
38
+
>
39
+
> > [!div class="alert alert-info"]
40
+
> >  Your application is configured with these attributes.
41
+
>
42
+
> ## Step 2: Download the ASP.NET Core project
43
+
>
44
+
> Run the project.
45
+
>
46
+
> > [!div class="nextstepaction"]
47
+
> > [Download the code sample](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/archive/aspnetcore3-1-callsgraph.zip)
> ## Step 3: Your app is configured and ready to run
53
+
>
54
+
> We have configured your project with values of your app's properties and it's ready to run.
55
+
>
56
+
> > [!NOTE]
57
+
> > `Enter_the_Supported_Account_Info_Here`
58
+
>
59
+
> ## About the code
60
+
>
61
+
> This section gives an overview of the code required to sign in users and call the Microsoft Graph API on their behalf. This overview can be useful to understand how the code works, main arguments, and also if you want to add sign-in to an existing ASP.NET Core application and call Microsoft Graph. It uses [Microsoft.Identity.Web](microsoft-identity-web.md), which is a wrapper around [MSAL.NET](msal-overview.md).
62
+
>
63
+
> ### How the sample works
64
+
>
65
+
> 
66
+
>
67
+
> ### Startup class
68
+
>
69
+
> The *Microsoft.AspNetCore.Authentication* middleware uses a `Startup` class that's executed when the hosting process initializes:
> Thelinecontaining `.AddMicrosoftIdentityWebApp` addstheMicrosoftidentityplatformauthenticationtoyourapplication. Thisisprovidedby [Microsoft.Identity.Web](microsoft-identity-web.md). It's then configured to sign in using the Microsoft identity platform based on the information in the `AzureAD` section of the *appsettings.json* configuration file:
>| `Instance` |Securitytokenservice (STS) endpointfor the user to authenticate. This value is typically `https://login.microsoftonline.com/`, indicating the Azure public cloud. |
112
+
> | `TenantId` | Name of your tenant or its tenant ID (aGUID), or*common*tosigninuserswithworkorschoolaccountsorMicrosoftpersonalaccounts. |
>The `Configure()` methodcontainstwoimportantmethods, `app.UseAuthentication()` and `app.UseAuthorization()`, thatenabletheirnamedfunctionality. Alsointhe `Configure()` method, youmustregisterMicrosoftIdentityWeb's routes with at least one call to `endpoints.MapControllerRoute()` or a call to `endpoints.MapControllers()`.
>// endpoints.MapControllers(); // REQUIRED if MapControllerRoute() isn't called.
132
+
> ```
133
+
>
134
+
> ### Protectacontrolleroracontroller's method
135
+
>
136
+
>Youcanprotectacontrolleroritsmethodsbyapplyingthe `[Authorize]` attributetothecontroller's class or one or more of its methods. This `[Authorize]` attribute restricts access by allowing only authenticated users. If the user isn'talreadyauthenticated, anauthenticationchallengecanbestartedtoaccessthecontroller. Inthisquickstart, thescopesarereadfromtheconfigurationfile:
0 commit comments