You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#Customer intent: As an application developer, I want to know how to write an ASP.NET Core web API that uses the Microsoft identity platform to authorize API requests from clients.
15
15
---
16
16
17
-
In this quickstart, you download an ASP.NET Core web API code sample and review the way it restricts resource access to authorized accounts only. The sample supports authorization of personal Microsoft accounts and accounts in any Azure Active Directory (Azure AD) organization.
18
-
17
+
The following quickstart uses a ASP.NET Core web API code sample to demonstrate how to restrict resource access to authorized accounts. The sample supports authorization of personal Microsoft accounts and accounts in any Azure Active Directory (Azure AD) organization.
19
18
20
19
## Prerequisites
21
20
22
21
- Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
23
22
-[Azure Active Directory tenant](../../quickstart-create-new-tenant.md)
-[Visual Studio 2022](https://visualstudio.microsoft.com/vs/) or [Visual Studio Code](https://code.visualstudio.com/)
26
25
27
26
## Step 1: Register the application
28
27
29
28
First, register the web API in your Azure AD tenant and add a scope by following these steps:
30
29
31
30
1. Sign in to the [Azure portal](https://portal.azure.com/).
32
-
1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.
31
+
1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which to register the application.
33
32
1. Search for and select **Azure Active Directory**.
34
33
1. Under **Manage**, select **App registrations** > **New registration**.
35
-
1. For **Name**, enter a name for your application. For example, enter **AspNetCoreWebApi-Quickstart**. Users of your app will see this name, and you can change it later.
34
+
1. For **Name**, enter a name for the application. For example, enter **AspNetCoreWebApi-Quickstart**. Users of the app will see this name, and can be changed later.
36
35
1. Select **Register**.
37
36
1. Under **Manage**, select **Expose an API** > **Add a scope**. For **Application ID URI**, accept the default by selecting **Save and continue**, and then enter the following details:
38
37
-**Scope name**: `access_as_user`
@@ -48,33 +47,78 @@ First, register the web API in your Azure AD tenant and add a scope by following
48
47
49
48
[Download the ASP.NET Core solution](https://github.com/Azure-Samples/active-directory-dotnet-native-aspnetcore-v2/archive/aspnetcore3-1.zip) from GitHub.
> The code sample currently targets ASP.NET Core 3.1. The sample can be updated to use .NET Core 6.0 and is covered in the following steps: [Update the sample code to ASP.NET Core 6.0](#step-4-update-the-sample-code-to-aspnet-core-60)
52
+
This quickstart will be deprecated in the near future and will be updated to use .NET 6.0.
53
53
54
54
## Step 3: Configure the ASP.NET Core project
55
55
56
-
In this step, configure the sample code to work with the app registration that you created earlier.
57
-
58
-
1. Extract the .zip archive into a folder near the root of your drive. For example, extract into *C:\Azure-Samples*.
56
+
In this step, the sample code will be configured to work with the app registration that was created earlier.
59
57
60
-
We recommend extracting the archive into a directory near the root of your drive to avoid errors caused by path length limitations on Windows.
58
+
1. Extract the *.zip* file to a local folder that's close to the root of the disk to avoid errors caused by path length limitations on Windows. For example, extract to *C:\Azure-Samples*.
61
59
62
-
1. Open the solution in the *webapi* folder in your code editor.
63
-
1.Open the *appsettings.json* file and modify the following code:
60
+
1. Open the solution in the *webapp* folder in your code editor.
61
+
1.In *appsettings.json*, replace the values of `ClientId`, and `TenantId`. The value for the application (client) ID and the directory (tenant) ID, can be found in the app's **Overview** page on the Azure portal.
64
62
65
63
```json
66
64
"ClientId": "Enter_the_Application_Id_here",
67
65
"TenantId": "Enter_the_Tenant_Info_Here"
68
66
```
69
67
70
-
-Replace `Enter_the_Application_Id_here` with the application (client) ID of the application that you registered in the Azure portal. You can find the application (client) ID on the app's **Overview** page.
68
+
-`Enter_the_Application_Id_Here` is the application (client) ID for the registered application.
71
69
- Replace `Enter_the_Tenant_Info_Here` with one of the following:
72
-
- If your application supports **Accounts in this organizational directory only**, replace this value with the directory (tenant) ID (a GUID) or tenant name (for example, `contoso.onmicrosoft.com`). You can find the directory (tenant) ID on the app's **Overview** page.
73
-
- If your application supports **Accounts in any organizational directory**, replace this value with `organizations`.
74
-
- If your application supports **All Microsoft account users**, leave this value as `common`.
70
+
- If the application supports **Accounts in this organizational directory only**, replace this value with the directory (tenant) ID (a GUID) or tenant name (for example, `contoso.onmicrosoft.com`). The directory (tenant) ID can be found on the app's **Overview** page.
71
+
- If the application supports **Accounts in any organizational directory**, replace this value with `organizations`.
72
+
- If the application supports **All Microsoft account users**, leave this value as `common`.
75
73
76
74
For this quickstart, don't change any other values in the *appsettings.json* file.
77
75
76
+
### Step 4: Update the sample code to ASP.NET Core 6.0
77
+
78
+
To update this code sample to target ASP.NET Core 6.0, follow these steps:
79
+
80
+
1. Open webapi.csproj
81
+
1. Remove the following line:
82
+
83
+
```xml
84
+
<TargetFramework>netcoreapp3.1</TargetFramework>
85
+
```
86
+
87
+
1. Add the following line in its place:
88
+
89
+
```xml
90
+
<TargetFramework>netcoreapp6.0</TargetFramework>
91
+
```
92
+
93
+
This step will ensure that the sample is targeting .NET 6.0.
94
+
95
+
### Step 5: Run the sample
96
+
97
+
1. Open a terminal and change directory to the project folder.
98
+
99
+
```powershell
100
+
cd webapi
101
+
```
102
+
103
+
1. Run the following command to build the solution:
104
+
105
+
```powershell
106
+
dotnet run
107
+
```
108
+
109
+
If the build has been successful, the following output is displayed:
110
+
111
+
```powershell
112
+
Building...
113
+
info: Microsoft.Hosting.Lifetime[0]
114
+
Now listening on: https://localhost:{port}
115
+
info: Microsoft.Hosting.Lifetime[0]
116
+
Now listening on: http://localhost:{port}
117
+
info: Microsoft.Hosting.Lifetime[0]
118
+
Application started. Press Ctrl+C to shut down.
119
+
...
120
+
```
121
+
78
122
## How the sample works
79
123
80
124
The web API receives a token from a client application, and the code in the web API validates the token. This scenario is explained in more detail in [Scenario: Protected web API](../../scenario-protected-web-api-overview.md).
@@ -93,13 +137,13 @@ The *Microsoft.AspNetCore.Authentication* middleware uses a `Startup` class that
93
137
94
138
The `AddAuthentication()` method configures the service to add JwtBearer-based authentication.
95
139
96
-
The line that contains `.AddMicrosoftIdentityWebApi` adds the Microsoft identity platform authorization to your web API. It's then configured to validate access tokens issued by the Microsoft identity platform based on the information in the `AzureAD` section of the *appsettings.json* configuration file:
140
+
The line that contains `.AddMicrosoftIdentityWebApi` adds the Microsoft identity platform authorization to the web API. It's then configured to validate access tokens issued by the Microsoft identity platform based on the information in the `AzureAD` section of the *appsettings.json* configuration file:
|`ClientId`| Application (client) ID of the application registered in the Azure portal. |
101
145
|`Instance`| Security token service (STS) endpoint for the user to authenticate. This value is typically `https://login.microsoftonline.com/`, indicating the Azure public cloud. |
102
-
|`TenantId`| Name of your tenant or its tenant ID (a GUID), or `common` to sign in users with work or school accounts or Microsoft personal accounts. |
146
+
|`TenantId`| Name of the tenant or its tenant ID (a GUID), or `common` to sign in users with work or school accounts or Microsoft personal accounts. |
103
147
104
148
The `Configure()` method contains two important methods, `app.UseAuthentication()` and `app.UseAuthorization()`, that enable their named functionality:
105
149
@@ -116,7 +160,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env)
116
160
117
161
### Protecting a controller, a controller's method, or a Razor page
118
162
119
-
You can protect a controller or controller methods by using the `[Authorize]` attribute. This attribute restricts access to the controller or methods by allowing only authenticated users. An authentication challenge can be started to access the controller if the user isn't authenticated.
163
+
A controller or controller methods can be protected by using the `[Authorize]` attribute. This attribute restricts access to the controller or methods by allowing only authenticated users. An authentication challenge can be started to access the controller if the user isn't authenticated.
120
164
121
165
```csharp
122
166
namespacewebapi.Controllers
@@ -157,7 +201,7 @@ namespace webapi.Controllers
157
201
158
202
## Next steps
159
203
160
-
The GitHub repository that contains this ASP.NET Core web API code sample includes instructions and more code samples that show you how to:
204
+
The following GitHub repository contains the ASP.NET Core web API code sample instructions and more samples that show how to achieve the following:
161
205
162
206
- Add authentication to a new ASP.NET Core web API.
#Customer intent: As an application developer, I want to know how to set up OpenId Connect authentication in a web application that's built by using Node.js with Express.
15
15
---
16
16
17
-
In this quickstart, you download and run a code sample that demonstrates how to protect an ASP.NET web API by restricting access to its resources to authorized accounts only. The sample supports authorization of personal Microsoft accounts and accounts in any Azure Active Directory (Azure AD) organization.
17
+
The following quickstart uses quickstart, uses a code sample that demonstrates how to protect an ASP.NET web API by restricting access to its resources to authorized accounts only. The sample supports authorization of personal Microsoft accounts and accounts in any Azure Active Directory (Azure AD) organization.
18
18
19
-
The article also uses a Windows Presentation Foundation (WPF) app to demonstrate how you can request an access token to access a web API.
19
+
The article also uses a Windows Presentation Foundation (WPF) app to demonstrate how to request an access token to access a web API.
20
20
21
21
## Prerequisites
22
22
23
23
* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
24
-
* Visual Studio 2017 or 2019. Download [Visual Studio for free](https://www.visualstudio.com/downloads/).
24
+
* Visual Studio 2022. Download [Visual Studio for free](https://www.visualstudio.com/downloads/).
25
25
26
26
## Clone or download the sample
27
27
28
-
You can obtain the sample in either of two ways:
28
+
The code sample can be obtained in two ways:
29
29
30
30
* Clone it from your shell or command line:
31
31
@@ -127,7 +127,7 @@ Configure your TodoListClient project by adding the Application ID to the *app.c
127
127
128
128
## Run your projects
129
129
130
-
Start both projects. If you are using Visual Studio:
130
+
Start both projects. For Visual Studio users;
131
131
132
132
1. Right click on the Visual Studio solution and select **Properties**
Copy file name to clipboardExpand all lines: articles/active-directory/develop/scenario-desktop-acquire-token-wam.md
+5-7Lines changed: 5 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.subservice: develop
10
10
ms.topic: conceptual
11
11
ms.workload: identity
12
-
ms.date: 06/07/2022
12
+
ms.date: 12/14/2022
13
13
ms.author: dmwendia
14
14
ms.custom: aaddev, devx-track-python
15
15
#Customer intent: As an application developer, I want to know how to write a desktop app that calls web APIs by using the Microsoft identity platform.
@@ -21,11 +21,9 @@ MSAL is able to call Web Account Manager, a Windows 10 component that ships with
21
21
22
22
## Availability
23
23
24
-
MSAL 4.25+ supports WAM on UWP, .NET Classic, .NET Core 3.1, and .NET 5.
24
+
MSAL 4.25+ supports WAM on UWP, and .NET 5.
25
25
26
-
For .NET Classic and .NET Core 3.1, WAM functionality is fully supported but you have to add a reference to [Microsoft.Identity.Client.Desktop](https://www.nuget.org/packages/Microsoft.Identity.Client.Desktop/) package, alongside MSAL, and instead of `WithBroker()`, call `.WithWindowsBroker()`.
27
-
28
-
For .NET 5, target `net5.0-windows10.0.17763.0` (or higher) and not just `net5.0`. Your app will still run on older versions of Windows if you add `<SupportedOSPlatformVersion>7</SupportedOSPlatformVersion>` in the csproj. MSAL will use a browser when WAM isn't available.
26
+
For .NET 5, target `net5.0-windows10.0.17763.0` (or higher) and not just `net5.0`. Your app will still run on older versions of Windows if you add `<SupportedOSPlatformVersion>7</SupportedOSPlatformVersion>` in the *.csproj* file. MSAL will use a browser when WAM isn't available.
29
27
30
28
## WAM value proposition
31
29
@@ -78,7 +76,7 @@ catch (MsalUiRequiredException) // no change in the pattern
78
76
}
79
77
```
80
78
81
-
Call `.WithBroker(true)`. Ifabrokerisn't present (for example, Win8.1, Mac, or Linux), then MSAL will fall back to a browser. Redirect URI rules apply to the browser.
79
+
Call `.WithBroker(true)`. Ifabrokerisn't present (for example, Win8.1, Mac, or Linux), then MSAL will fall back to a browser, where redirect URI rules apply.
82
80
83
81
## Redirect URI
84
82
@@ -131,7 +129,7 @@ Applications cannot remove accounts from Windows!
131
129
- Removes app-only (not OS-wide) accounts.
132
130
133
131
>[!NOTE]
134
-
> Apps cannot remove OS accounts. Only users can do that. If an OS account is passed into `RemoveAsync`, and then `GetAccounts` is called with `ListWindowsWorkAndSchoolAccounts` enabled - the same OS account will still be returned.
132
+
> Ony users can remove OS accounts, whereas apps themselves cannot. If an OS account is passed into `RemoveAsync`, and then `GetAccounts` is called with `ListWindowsWorkAndSchoolAccounts` enabled, the same OS accounts will still be returned.
0 commit comments