Skip to content

Commit f94a7be

Browse files
v-thepetv-thepet
committed
revert
1 parent 5cb131e commit f94a7be

File tree

1 file changed

+29
-31
lines changed

1 file changed

+29
-31
lines changed

‎articles/app-service/configure-authentication-user-identities.md

Lines changed: 29 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Work with User Identities in AuthN/AuthZ
33
description: Learn how to access user identities when you use the built-in authentication and authorization in Azure App Service.
44
ms.topic: how-to
5-
ms.date: 07/01/2025
5+
ms.date: 03/29/2021
66
ms.custom: AppServiceIdentity
77
author: cephalin
88
ms.author: cephalin
@@ -14,32 +14,29 @@ This article shows you how to work with user identities when you use built-in [a
1414

1515
## Access user claims in app code
1616

17-
Authenticated end users or client applications make claims in incoming tokens. App Service makes the claims available to your code by injecting them into request headers. External requests aren't allowed to set these headers, so they're present only if set by App Service.
17+
For all language frameworks, App Service makes the claims in the incoming token (whether from an authenticated end user or from a client application) available to your code by injecting them into the request headers. External requests aren't allowed to set these headers, so they're present only if set by App Service.
1818

19-
The following table describes some example headers:
19+
Some example headers are described in the following table:
2020

2121
| Header | Description |
2222
|------------------------------|-----------------------------------------------------------------------|
2323
| `X-MS-CLIENT-PRINCIPAL` | A Base64-encoded JSON representation of available claims. For more information, see [Decode the client principal header](#decode-the-client-principal-header). |
2424
| `X-MS-CLIENT-PRINCIPAL-ID` | An identifier for the caller, which the identity provider sets. |
25-
| `X-MS-CLIENT-PRINCIPAL-NAME` | A human-readable name that the identity provider sets for the caller, such as an email address or user principal name. |
25+
| `X-MS-CLIENT-PRINCIPAL-NAME` | A human-readable name for the caller, set by the identity provider, such as an email address or a user principal name. |
2626
| `X-MS-CLIENT-PRINCIPAL-IDP` | The name of the identity provider that App Service authentication uses. |
2727

28-
Similar headers expose [provider tokens](configure-authentication-oauth-tokens.md). For example, Microsoft Entra sets `X-MS-TOKEN-AAD-ACCESS-TOKEN` and `X-MS-TOKEN-AAD-ID-TOKEN` provider token headers as appropriate.
28+
Provider tokens are also exposed through similar headers. For example, Microsoft Entra also sets `X-MS-TOKEN-AAD-ACCESS-TOKEN` and `X-MS-TOKEN-AAD-ID-TOKEN` as appropriate.
2929

3030
> [!NOTE]
31-
> App Service makes the request headers available to all language frameworks. Different language frameworks might present these headers to the app code in different formats, such as lowercase or title case.
31+
> Different language frameworks might present these headers to the app code in different formats, such as in lowercase or by using title case.
3232
33-
Code in any language or framework can get the information it needs from the request headers. Some code frameworks provide extra options that might be more convenient. See [Framework-specific alternatives](#framework-specific-alternatives).
33+
Code that is written in any language or framework can get the information that it needs from these headers. [Decode the client principal header](#decode-the-client-principal-header) covers this process. For some frameworks, the platform also provides extra options that might be more convenient.
3434

35-
### Decode the X-MS-CLIENT-PRINCIPAL header
35+
### Decode the client principal header
3636

37-
The `X-MS-CLIENT-PRINCIPAL` header contains the full set of available claims in Base64-encoded JSON. To process this header, your app must decode the payload and iterate through the `claims` array to find relevant claims. These claims undergo a default claims-mapping process, so some might have different names than if you process the token directly.
37+
`X-MS-CLIENT-PRINCIPAL` contains the full set of available claims as Base64-encoded JSON. These claims go through a default claims-mapping process, so some might have different names than you would see if you processed the token directly.
3838

39-
> [!NOTE]
40-
> For claims mapping to work, you must enable the [token store](overview-authentication-authorization.md#token-store) in your app.
41-
42-
The decoded payload is structured as follows:
39+
Here's how the decoded payload is structured:
4340

4441
```json
4542
{
@@ -58,13 +55,13 @@ The decoded payload is structured as follows:
5855
| Property | Type | Description |
5956
|------------|------------------|---------------------------------------|
6057
| `auth_typ` | string | The name of the identity provider that App Service authentication uses. |
61-
| `claims` | array | An array of objects that represent the available claims. Each object contains `typ` and `val` properties. |
62-
| `typ` | string | The name of the claim, which might be subject to default claims mapping and be different from the corresponding claim in the token. |
58+
| `claims` | array of objects | An array of objects that represent the available claims. Each object contains `typ` and `val` properties. |
59+
| `typ` | string | The name of the claim. It might be subject to default claims mapping and might be different from the corresponding claim that is contained in a token. |
6360
| `val` | string | The value of the claim. |
64-
| `name_typ` | string | The name claim type, which is typically a URI that provides schema information about the `name` claim if one is defined. |
65-
| `role_typ` | string | The role claim type, which is typically a URI that provides schema information about the `role` claim if one is defined. |
61+
| `name_typ` | string | The name claim type, which is typically a URI that provides scheme information about the `name` claim if one is defined. |
62+
| `role_typ` | string | The role claim type, which is typically a URI that provides scheme information about the `role` claim if one is defined. |
6663

67-
For convenience, you can convert claims into a representation that the app's language framework uses. The following example of this process uses C# to construct a [`ClaimsPrincipal`](/dotnet/api/system.security.claims.claimsprincipal) type for the app to use.
64+
To process this header, your app must decode the payload and iterate through the `claims` array to find relevant claims. It might be convenient to convert claims into a representation that the app's language framework uses. Here's an example of this process in C# that constructs a [`ClaimsPrincipal`](/dotnet/api/system.security.claims.claimsprincipal) type for the app to use:
6865

6966
```csharp
7067
using System;
@@ -109,12 +106,17 @@ public static class ClaimsPrincipalParser
109106
var json = Encoding.UTF8.GetString(decoded);
110107
principal = JsonSerializer.Deserialize<ClientPrincipal>(json, new JsonSerializerOptions { PropertyNameCaseInsensitive = true });
111108
}
112-
```
113-
At this point, the code can iterate through `principal.Claims` to check claims as part of validation. Alternatively, you can convert `principal.Claims` into a standard object and use it to do those checks later in the request pipeline. You can also use that object to associate user data and for other uses.
114109

115-
The rest of this function performs this conversion to create a `ClaimsPrincipal` that can be used in other .NET code.
110+
/**
111+
* At this point, the code can iterate through `principal.Claims` to
112+
* check claims as part of validation. Alternatively, you can convert
113+
* it into a standard object with which to perform those checks later
114+
* in the request pipeline. That object can also be leveraged for
115+
* associating user data, and so on. The rest of this function performs such
116+
* a conversion to create a `ClaimsPrincipal` as might be used in
117+
* other .NET code.
118+
*/
116119

117-
```csharp
118120
var identity = new ClaimsIdentity(principal.IdentityProvider, principal.NameClaimType, principal.RoleClaimType);
119121
identity.AddClaims(principal.Claims.Select(c => new Claim(c.Type, c.Value)));
120122

@@ -125,23 +127,19 @@ The rest of this function performs this conversion to create a `ClaimsPrincipal`
125127

126128
### Framework-specific alternatives
127129

128-
- For ASP.NET 4.6 apps, App Service populates [`ClaimsPrincipal.Current`](/dotnet/api/system.security.claims.claimsprincipal.current) with the authenticated user's claims. You can follow the standard .NET code pattern, including the [`Authorize`] attribute.
130+
For ASP.NET 4.6 apps, App Service populates [`ClaimsPrincipal.Current`](/dotnet/api/system.security.claims.claimsprincipal.current) with the authenticated user's claims. You can follow the standard .NET code pattern, including the [`Authorize`] attribute. Similarly, for PHP apps, App Service populates the `_SERVER['REMOTE_USER']` variable. For Java apps, the claims are [accessible from the Tomcat servlet](configure-language-java-security.md#authenticate-users-easy-auth).
129131

130-
- For PHP apps, App Service similarly populates the `_SERVER['REMOTE_USER']` variable.
132+
For [Azure Functions](../azure-functions/functions-overview.md), `ClaimsPrincipal.Current` isn't populated for .NET code, but you can still find the user claims in the request headers, or get the `ClaimsPrincipal` object from the request context or even through a binding parameter. For more information, see [Work with client identities in Azure Functions](../azure-functions/functions-bindings-http-webhook-trigger.md#working-with-client-identities).
131133

132-
- For Java apps, the claims are [accessible from the Tomcat servlet](configure-language-java-security.md#authenticate-users-easy-auth).
134+
For .NET Core, [`Microsoft.Identity.Web`](https://www.nuget.org/packages/Microsoft.Identity.Web/) supports populating the current user with App Service authentication. To learn more, review the [Microsoft.Identity.Web wiki](https://github.com/AzureAD/microsoft-identity-web/wiki/1.2.0#integration-with-azure-app-services-authentication-of-web-apps-running-with-microsoftidentityweb) or see it demonstrated in [this tutorial for a web app accessing Microsoft Graph](./scenario-secure-app-access-microsoft-graph-as-user.md?tabs=command-line#install-client-library-packages).
133135

134-
- For [Azure Functions](../azure-functions/functions-overview.md), `ClaimsPrincipal.Current` isn't populated for .NET code, but you can still find the user claims in the request headers, or get the `ClaimsPrincipal` object from the request context or through a binding parameter. For more information, see [Work with client identities in Azure Functions](../azure-functions/functions-bindings-http-webhook-trigger.md#working-with-client-identities).
135-
136-
- For .NET Core, [`Microsoft.Identity.Web`](https://www.nuget.org/packages/Microsoft.Identity.Web/) supports populating the current user with App Service authentication.
137-
138-
For more information, see [Integration with Azure App Services authentication of web Apps running with Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web/wiki/1.2.0#integration-with-azure-app-services-authentication-of-web-apps-running-with-microsoftidentityweb). For a demonstration of a web app accessing Microsoft Graph, see [Install client library packages](scenario-secure-app-access-microsoft-graph-as-user.md?tabs=command-line#install-client-library-packages) in [Tutorial: Access Microsoft Graph from a secured .NET app as the user](scenario-secure-app-access-microsoft-graph-as-user.md).
136+
> [!NOTE]
137+
> For claims mapping to work, you must enable the [token store](overview-authentication-authorization.md#token-store).
139138
140139
## Access user claims by using the API
141140

142141
If the [token store](overview-authentication-authorization.md#token-store) is enabled for your app, you can also obtain other details on the authenticated user by calling `/.auth/me`.
143142

144143
## Related content
145144

146-
- [Authentication and authorization in Azure App Service and Azure Functions](overview-authentication-authorization.md)
147145
- [Tutorial: Authenticate and authorize users end to end](tutorial-auth-aad.md)

0 commit comments

Comments
 (0)