diff --git a/console-cli/README.md b/console-cli/README.md index dbad94e..3668533 100644 --- a/console-cli/README.md +++ b/console-cli/README.md @@ -28,23 +28,23 @@ $ dotnet run To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXXXX to authenticate. { "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity", - "businessPhones": ["+1 (999) 5551001"], + "businessPhones": ["+1 (000) 1112222"], "displayName": "Contoso Employee", "givenName": "Contoso", "jobTitle": "Worker", "mail": "cemployee@contoso.com", - "mobilePhone": "1 999-555-1001", + "mobilePhone": "1 000-111-2222", "officeLocation": "Contoso Plaza/F30", "preferredLanguage": null, "surname": "Employee", "userPrincipalName": "contoso_employee@contoso.com", - "id": "e3a49d8b-d849-48eb-9947-37c1f9589812" + "id": "00aa11bb-cc22-dd33-ee44-ff55ee66dd77" } ``` ## Prerequisites -- Azure Active Directory (Azure AD) tenant and the permissions or role required for managing app registrations in the tenant. +- Microsoft Entra tenant and the permissions or role required for managing app registrations in the tenant. - [.NET 6.0 SDK](https://dotnet.microsoft.com/download/dotnet/6.0) ## Setup @@ -85,17 +85,17 @@ Follow the device code flow instructions that are presented. If everything worke ```json { "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity", - "businessPhones": ["+1 (999) 5551001"], + "businessPhones": ["+1 (000) 1112222"], "displayName": "Contoso Employee", "givenName": "Contoso", "jobTitle": "Worker", "mail": "cemployee@contoso.com", - "mobilePhone": "1 999-555-1001", + "mobilePhone": "1 000-111-2222", "officeLocation": "Contoso Plaza/F30", "preferredLanguage": null, "surname": "Employee", "userPrincipalName": "contoso_employee@contoso.com", - "id": "e3a49d8b-d849-48eb-9947-37c1f9589812" + "id": "00aa11bb-cc22-dd33-ee44-ff55ee66dd77" } ``` diff --git a/console-daemon/README.md b/console-daemon/README.md index e18d87e..4491a7d 100644 --- a/console-daemon/README.md +++ b/console-daemon/README.md @@ -26,9 +26,9 @@ dotnet run Could not find a cached token, so fetching a new one. { "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applications/$entity", - "id": "0aa1b222-3ccc-4d55-e666-f7g888h9i000", + "id": "00aa11bb-cc22-dd33-ee44-ff55ee66dd77", "deletedDateTime": null, - "appId": "0aa1b222-3ccc-4d55-e666-f7g888h9i000", + "appId": "00001111-aaaa-2222-bbbb-3333cccc4444", "applicationTemplateId": null, "disabledByMicrosoftStatus": null, "createdDateTime": "2021-01-17T15:30:55Z", @@ -87,9 +87,9 @@ If successful, an output simialir to the following is displayed in the console ( ```json { "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applications/$entity", - "id": "0aa1b222-3ccc-4d55-e666-f7g888h9i000", + "id": "00aa11bb-cc22-dd33-ee44-ff55ee66dd77", "deletedDateTime": null, - "appId": "0aa1b222-3ccc-4d55-e666-f7g888h9i000", + "appId": "00001111-aaaa-2222-bbbb-3333cccc4444", "applicationTemplateId": null, "disabledByMicrosoftStatus": null, "createdDateTime": "2021-01-17T15:30:55Z", diff --git a/desktop-winforms/MainWindow.cs b/desktop-winforms/MainWindow.cs index fb9c307..e2df887 100644 --- a/desktop-winforms/MainWindow.cs +++ b/desktop-winforms/MainWindow.cs @@ -23,7 +23,7 @@ public MainWindow() msalPublicClientApp = PublicClientApplicationBuilder .CreateWithApplicationOptions(new PublicClientApplicationOptions { - // 'Tenant ID' of your Azure AD instance - this value is a GUID + // 'Tenant ID' of your Microsoft Entra instance - this value is a GUID TenantId = "", // 'Application (client) ID' of app registration in Azure portal - this value is a GUID diff --git a/desktop-winforms/README.md b/desktop-winforms/README.md index 9ea55ac..1bb5ed3 100644 --- a/desktop-winforms/README.md +++ b/desktop-winforms/README.md @@ -26,7 +26,7 @@ This .NET Windows Forms application authenticates a user and then makes a reques ## Prerequisites -- Azure Active Directory (Azure AD) tenant and the permissions or role required for managing app registrations in the tenant. +- Microsoft Entra tenant and the permissions or role required for managing app registrations in the tenant. - Visual Studio 2022, [configured for the .NET 6 desktop development workload](https://docs.microsoft.com/dotnet/desktop/winforms/get-started/create-app-visual-studio?view=netdesktop-6.0#prerequisites) ## Setup @@ -55,7 +55,7 @@ Next, open the _MsalExamples.csproj_ project in Visual Studio. Finally, set the following values in _MainWindow.cs_. ```csharp -// 'Tenant ID' of your Azure AD instance - this value is a GUID +// 'Tenant ID' of your Microsoft Entra instance - this value is a GUID TenantId = "", // 'Application (client) ID' of app registration in Azure portal - this value is a GUID diff --git a/desktop-winforms/app.png b/desktop-winforms/app.png index 2bda28d..82c4fe7 100644 Binary files a/desktop-winforms/app.png and b/desktop-winforms/app.png differ diff --git a/desktop-winui/MainWindow.xaml.cs b/desktop-winui/MainWindow.xaml.cs index cfb2b47..851551b 100644 --- a/desktop-winui/MainWindow.xaml.cs +++ b/desktop-winui/MainWindow.xaml.cs @@ -32,7 +32,7 @@ public MainWindow() msalPublicClientApp = PublicClientApplicationBuilder .CreateWithApplicationOptions(new PublicClientApplicationOptions { - // 'Tenant ID' of your Azure AD instance - this value is a GUID + // 'Tenant ID' of your Microsoft Entra instance - this value is a GUID TenantId = "", // 'Application (client) ID' of app registration in Azure portal - this value is a GUID diff --git a/desktop-winui/README.md b/desktop-winui/README.md index afc3d6a..f688ac1 100644 --- a/desktop-winui/README.md +++ b/desktop-winui/README.md @@ -26,7 +26,7 @@ This .NET WinUI 3 Packaged Desktop App authenticates a user and then makes a req ## Prerequisites -- Azure Active Directory (Azure AD) tenant and the permissions or role required for managing app registrations in the tenant. +- Microsoft Entra tenant and the permissions or role required for managing app registrations in the tenant. - Visual Studio 2022, [configured with WinUI 3 workload and components](https://docs.microsoft.com/windows/apps/windows-app-sdk/set-up-your-development-environment?tabs=vs-2022-17-1-a%2Cvs-2022-17-1-b#required-workloads-and-components) ## Setup @@ -56,7 +56,7 @@ Finally, set the following values in _MainWindow.xaml.cs_. ```csharp -// 'Tenant ID' of your Azure AD instance - this value is a GUID +// 'Tenant ID' of your Microsoft Entra instance - this value is a GUID TenantId = "", // 'Application (client) ID' of app registration in Azure portal - this value is a GUID diff --git a/desktop-wpf/MainWindow.xaml.cs b/desktop-wpf/MainWindow.xaml.cs index f911ebc..9f2d258 100644 --- a/desktop-wpf/MainWindow.xaml.cs +++ b/desktop-wpf/MainWindow.xaml.cs @@ -28,7 +28,7 @@ public MainWindow() _msalPublicClientApp = PublicClientApplicationBuilder .CreateWithApplicationOptions(new PublicClientApplicationOptions { - // 'Tenant ID' of your Azure AD instance - this value is a GUID + // 'Tenant ID' of your Microsoft Entra instance - this value is a GUID TenantId = "", // 'Application (client) ID' of app registration in Azure portal - this value is a GUID diff --git a/desktop-wpf/README.md b/desktop-wpf/README.md index 04e18be..94ba863 100644 --- a/desktop-wpf/README.md +++ b/desktop-wpf/README.md @@ -26,7 +26,7 @@ This .NET Windows Presentation Foundation (WPF) application authenticates a user ## Prerequisites -- Azure Active Directory (Azure AD) tenant and the permissions or role required for managing app registrations in the tenant. +- Microsoft Entra tenant and the permissions or role required for managing app registrations in the tenant. - Visual Studio 2022, [configured for the .NET 6 desktop development workload](https://docs.microsoft.com/dotnet/desktop/winforms/get-started/create-app-visual-studio?view=netdesktop-6.0#prerequisites) ## Setup @@ -55,7 +55,7 @@ Next, open the _MsalExamples.csproj_ project in Visual Studio. Finally, set the following values in _MainWindow.xaml.cs_. ```csharp -// 'Tenant ID' of your Azure AD instance - this value is a GUID +// 'Tenant ID' of your Microsoft Entra instance - this value is a GUID TenantId = "", // 'Application (client) ID' of app registration in Azure portal - this value is a GUID diff --git a/desktop-wpf/app.png b/desktop-wpf/app.png index aafb4f5..32268bf 100644 Binary files a/desktop-wpf/app.png and b/desktop-wpf/app.png differ diff --git a/spa-blazor-wasm/README.md b/spa-blazor-wasm/README.md index 4d11ee8..2a3f0f5 100644 --- a/spa-blazor-wasm/README.md +++ b/spa-blazor-wasm/README.md @@ -15,9 +15,9 @@ urlFragment: ms-identity-docs-code-spa-blazor-wasm-csharp # ASP.NET Core 8.0 Blazor WebAssembly | standalone app | user sign-in, protected web API access (Microsoft Graph) | Microsoft identity platform -The standalone app in this scenario is created using the ASP.NET Core 8.0 Blazor WebAssembly template and modified to allow sign-in with a Microsoft Entra ID account. It uses the [Microsoft.Authentication.WebAssembly.Msal](https://www.nuget.org/packages/Microsoft.Authentication.WebAssembly.Msal) package to authenticate users and obtain tokens for calling protected APIs. In other words, the app adds an authentication layer that allows users to sign in with their Work and school accounts and make web API calls to protected resources on their behalf. +The standalone app in this scenario is created using the ASP.NET Core 8.0 Blazor WebAssembly template and modified to allow sign-in with a Microsoft Entra account. It uses the [Microsoft.Authentication.WebAssembly.MSAL](https://www.nuget.org/packages/Microsoft.Authentication.WebAssembly.Msal) package to authenticate users and obtain tokens for calling protected APIs. In other words, the app adds an authentication layer that allows users to sign in with their Work and school accounts and make web API calls to protected resources on their behalf. -> Note: This code sample uses the Microsoft.Authentication.WebAssembly.Msal package, which is a modified version of the Microsoft.Identity.Client library. +> Note: This code sample uses the Microsoft.Authentication.WebAssembly.MSAL package, which is a modified version of the Microsoft.Identity.Client library. ![A screenshot of an ASP.NET Core 8.0 Blazor WebAssembly application displaying a response from Microsoft Graph.](./media/app-signedin.png) @@ -28,7 +28,9 @@ The standalone app in this scenario is created using the ASP.NET Core 8.0 Blazor ## Setup -### 1. Register the web API application in your Azure Active Directory + + +### 1. Register the web API application in your Microsoft Entra ID First, complete the steps in [Register an application with the Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app) to register the sample app. @@ -85,7 +87,7 @@ For more information, please refer to [.NET WebAssembly build tools](https://lea ## About the code -This ASP.NET Core Web App is created using .NET Blazor WebAssembly. The app has two main routes, one is public while the another one is requiring the user to be authenticated in Azure Active Directory. +This ASP.NET Core Web App is created using .NET Blazor WebAssembly. The app has two main routes, one is public while the another one is requiring the user to be authenticated in Microsoft Entra ID. When a user logs out, their browser is redirected to a public route confirming the user signed-out. After signing in, and if they've not previously done so, the user is asked to consent to the app's request for permission to access their data. diff --git a/spa-blazor-wasm/media/app-signedin.png b/spa-blazor-wasm/media/app-signedin.png index 8fdefc6..fc191fe 100644 Binary files a/spa-blazor-wasm/media/app-signedin.png and b/spa-blazor-wasm/media/app-signedin.png differ diff --git a/spa-blazor-wasm/wwwroot/appsettings.json b/spa-blazor-wasm/wwwroot/appsettings.json index 431b2f8..809c09c 100644 --- a/spa-blazor-wasm/wwwroot/appsettings.json +++ b/spa-blazor-wasm/wwwroot/appsettings.json @@ -1,6 +1,6 @@ { "AzureAd": { - "Authority": "https://login.microsoftonline.com/Enter the tenant ID obtained from the Microsoft Entra admin center", + "Authority": "https://login.microsoftonline.com/", "ClientId": "Enter the client ID obtained from the Microsoft Entra admin center", "ValidateAuthority": true } diff --git a/web-api-azure-function/README.md b/web-api-azure-function/README.md index 1aeefd4..687552f 100644 --- a/web-api-azure-function/README.md +++ b/web-api-azure-function/README.md @@ -31,7 +31,7 @@ Hello, world. You were able to access this because you provided a valid access t ## Prerequisites -- Azure Active Directory (Azure AD) tenant and the permissions or role required for managing app registrations in the tenant. +- Microsoft Entra tenant and the permissions or role required for managing app registrations in the tenant. - [.NET 6.0 SDK](https://dotnet.microsoft.com/download/dotnet/6.0) - An empty [C# Azure function (v4)](https://docs.microsoft.com/azure/azure-functions/create-first-function-cli-csharp) deployed to Azure, and the permissions or role required to modify its settings. - [Azure Functions Core Tools](https://docs.microsoft.com/azure/azure-functions/functions-run-local) @@ -55,7 +55,7 @@ Use these settings in your app registration. ### 2. Enable Function app authentication -Next, complete the steps in [Enable Azure Active Directory in your App Service app](https://docs.microsoft.com/azure/app-service/configure-authentication-provider-aad?toc=/azure/azure-functions/toc.json#-enable-azure-active-directory-in-your-app-service-app) to add Azure Active Directory as an identity provider for your API. +Next, complete the steps in [Enable Microsoft Entra ID in your App Service app](https://docs.microsoft.com/azure/app-service/configure-authentication-provider-aad?toc=/azure/azure-functions/toc.json#-enable-azure-active-directory-in-your-app-service-app) to add Microsoft Entra ID as an identity provider for your API. Use these settings in your identity provider configuration. @@ -65,7 +65,7 @@ Use these settings in your identity provider configuration. | **App registration type** | **Provide the details of an existing app registration** | Required value for this sample. | | **Application (client) ID** | `` | Required value for this sample.
'Application (client) ID' of the API's app registration in Azure portal - this value is a GUID | | **Client secret (recommended)** | _None_ | Suggested value for this sample.
This sample doesn't require this feature. | -| **Issuer URL** | `https://login.microsoftonline.com//v2.0` | Required value for this sample.
Update to include 'Tenant ID' of your Azure AD instance - this value is a GUID | +| **Issuer URL** | `https://login.microsoftonline.com//v2.0` | Required value for this sample.
Update to include 'Tenant ID' of your Microsoft Entra instance - this value is a GUID | | **Allowed token audiences** | `api://` | Required value for this sample.
'Application ID URI' of app registration in Azure portal - this value typically starts with api:// | | **Restrict access** | **Require authentication** | Required value for this sample. | | **Unauthenticated requests** | **HTTP 401 Unauthorized: recommended for APIs** | Suggested value for this sample. | diff --git a/web-api-obo-client/Program.cs b/web-api-obo-client/Program.cs index 926ae44..e28f118 100644 --- a/web-api-obo-client/Program.cs +++ b/web-api-obo-client/Program.cs @@ -7,8 +7,8 @@ // WebApplicationBuilder builder = WebApplication.CreateBuilder(args); -// Acquire an access token from Azure AD for this client to access Microsoft Graph based -// on the permissions granted this application in its Azure AD App registration. +// Acquire an access token from Microsoft Entra ID for this client to access Microsoft Graph based +// on the permissions granted this application in its Microsoft Entra App registration. // The client credential flow will automatically attempt to use or renew any cached // tokens, without the need to call acquireTokenSilently first. builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) diff --git a/web-api-obo-client/README.md b/web-api-obo-client/README.md index 5303a78..9a663bd 100644 --- a/web-api-obo-client/README.md +++ b/web-api-obo-client/README.md @@ -26,9 +26,9 @@ This ASP.NET Core minimal web API issues a call to a protected web API (Microsof $ curl https://localhost:5001/api/application { "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applications/$entity", - "id": "537a552c-58b7-4468-abdf-a7cbfa000dde", + "id": "00aa11bb-cc22-dd33-ee44-ff55ee66dd77", "deletedDateTime": null, - "appId": "5b2c581d-e3ac-415e-a770-7f16254fdbf7", + "appId": "00001111-aaaa-2222-bbbb-3333cccc4444", "applicationTemplateId": null, "disabledByMicrosoftStatus": null, "createdDateTime": "2022-02-23T21:35:20Z", @@ -53,7 +53,7 @@ $ curl https://localhost:5001/api/application ## Prerequisites -- An Azure Active Directory (Azure AD) tenant. You can [open an Azure account for free](https://azure.microsoft.com/free) to get an Azure AD instance. +- A Microsoft Entra tenant. You can [open an Azure account for free](https://azure.microsoft.com/free) to get a Microsoft Entra instance. - [.NET 6.0 SDK](https://dotnet.microsoft.com/download/dotnet/6.0) ## Setup @@ -110,9 +110,9 @@ If everything worked, you should receive a response from the downstream web API $ curl https://localhost:5001/api/application -ki { "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applications/$entity", - "id": "537a552c-58b7-4468-abdf-a7cbfa000dde", + "id": "00aa11bb-cc22-dd33-ee44-ff55ee66dd77", "deletedDateTime": null, - "appId": "5b2c581d-e3ac-415e-a770-7f16254fdbf7", + "appId": "00001111-aaaa-2222-bbbb-3333cccc4444", "applicationTemplateId": null, "disabledByMicrosoftStatus": null, "createdDateTime": "2022-02-23T21:35:20Z", diff --git a/web-api-obo-user/README.md b/web-api-obo-user/README.md index b85ecb2..1fc999a 100644 --- a/web-api-obo-user/README.md +++ b/web-api-obo-user/README.md @@ -35,7 +35,7 @@ $ curl https://localhost:5001/api/me -H "Authorization: Bearer {valid-access-tok "officeLocation": null, "preferredLanguage": null, "surname": null, - "id": "cff40dac-17ea-4183-9caf-65f2ee90c562" + "id": "00aa11bb-cc22-dd33-ee44-ff55ee66dd77" } ``` @@ -43,12 +43,14 @@ $ curl https://localhost:5001/api/me -H "Authorization: Bearer {valid-access-tok ## Prerequisites -- An Azure Active Directory (Azure AD) tenant. You can [open an Azure account for free](https://azure.microsoft.com/free) to get an Azure AD instance. +- A Microsoft Entra tenant. You can [open an Azure account for free](https://azure.microsoft.com/free) to get a Microsoft Entra instance. - [.NET 6.0 SDK](https://dotnet.microsoft.com/download/dotnet/6.0) ## Setup -### 1. Register the web API application in Azure Active Directory (Azure AD) + + +### 1. Register the web API application in Microsoft Entra ID First, complete the steps in [Configure an application to expose a web API](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app) to register the sample API and expose a scope. @@ -65,7 +67,9 @@ Use the following settings for your app registration: > :information_source: **Bold text** in the table matches (or is similar to) a UI element in the Azure portal, while `code formatting` indicates a value you enter into a text box or select in the Azure portal. -### 2. Register a client application in Azure AD + + +### 2. Register a client application in Microsoft Entra ID Second, complete the steps in [Register an application with the Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app) to register the client sample app. diff --git a/web-api/README.md b/web-api/README.md index 16f87f9..4d628a7 100644 --- a/web-api/README.md +++ b/web-api/README.md @@ -22,7 +22,7 @@ The sample code provided here has been created using minimal web API in ASP.NET ## Prerequisites -- An Azure Active Directory (Azure AD) tenant. You can [open an Azure account for free](https://azure.microsoft.com/free) to get an Azure AD instance. +- A Microsoft Entra tenant. You can [open an Azure account for free](https://azure.microsoft.com/free) to get a Microsoft Entra instance. - [.NET 6.0 SDK](https://dotnet.microsoft.com/download/dotnet/6.0) ## Setup @@ -61,8 +61,8 @@ In the _./appsettings.json_ file, replace these `{PLACEHOLDER}` values with the For example: ```json -"ClientId": "00000000-11aa-bbbb-2222-33333ddddddd", -"TenantId": "00000000-11aa-bbbb-2222-33333ddddddd", +"ClientId": "00001111-aaaa-2222-bbbb-3333cccc4444", +"TenantId": "dddd5555-eeee-6666-ffff-00001111aaaa", ``` ## Run the application diff --git a/web-app-aspnet/README.md b/web-app-aspnet/README.md index a469013..b6edd3d 100644 --- a/web-app-aspnet/README.md +++ b/web-app-aspnet/README.md @@ -15,7 +15,7 @@ urlFragment: ms-identity-docs-code-csharp-sign-in # ASP.NET Core 6.0 Web App - Sign-in user | Microsoft identity platform -This web app, built with ASP.NET Core 6.0 Razor, has added sign-in features. It uses the [Open Id Connect](https://docs.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc) and [ASP.NET Core Identity](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-6.0) for authentication. This allows users to sign in with their Microsoft Entra ID accounts. Once signed in, the app can access protected resources on the user’s behalf. +This web app, built with ASP.NET Core 6.0 Razor, has added sign-in features. It uses the [OpenID Connect](https://docs.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc) and [ASP.NET Core Identity](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-6.0) for authentication. This allows users to sign in with their Microsoft Entra accounts. Once signed in, the app can access protected resources on the user’s behalf. ## Quickstart and tutorial guides for this sample @@ -30,7 +30,9 @@ This web app, built with ASP.NET Core 6.0 Razor, has added sign-in features. It ## Setup -### 1. Register the web API application in your Azure Active Directory + + +### 1. Register the web API application in your Microsoft Entra ID First, complete the steps in [Register an application with the Microsoft identity platform](https://docs.microsoft.com/entra/identity-platform/tutorial-web-app-dotnet-register-app) to register a web application in the Microsoft identity platform. diff --git a/web-app-aspnet/media/app-signedin.png b/web-app-aspnet/media/app-signedin.png index 0863d10..9dcacd0 100644 Binary files a/web-app-aspnet/media/app-signedin.png and b/web-app-aspnet/media/app-signedin.png differ diff --git a/web-app-blazor-server/README.md b/web-app-blazor-server/README.md index 91d0266..18b44e6 100644 --- a/web-app-blazor-server/README.md +++ b/web-app-blazor-server/README.md @@ -27,7 +27,7 @@ This ASP.NET Core Blazor Server application application authenticates a user and ## Prerequisites -- Azure Active Directory (Azure AD) tenant and the permissions or role required for managing app registrations in the tenant. +- Microsoft Entra tenant and the permissions or role required for managing app registrations in the tenant. - [.NET 6.0 SDK](https://dotnet.microsoft.com/download/dotnet/6.0) ## Setup @@ -56,8 +56,8 @@ Next, open the _Api.csproj_ project under the the sign-in-blazorserver folder in In _appsettings.json_, update each variable with values from the app registration you created earlier. ```json -"TenantId": "[Enter 'common', or 'organizations' or the Tenant ID (Obtained from the Azure portal. Select 'Endpoints' from the 'App registrations' blade and use the GUID in any of the URLs), e.g. da41245a5-11b3-996c-00a8-4d99re19f292]", -"ClientId": "[Enter the Client Id (Application ID obtained from the Azure portal), e.g. ba74781c2-53c2-442a-97c2-3d60re42f403]", +"TenantId": "[Enter 'common', or 'organizations' or the Tenant ID obtained from the Azure portal]", +"ClientId": "[Enter the Client Id (Application ID) obtained from the Azure portal]", "ClientSecret": "[Copy the client secret added to the app from the Azure portal]", ``` @@ -84,11 +84,11 @@ In _appsettings.json_, update each variable with values from the app registratio ## About the code -This ASP.NET Core 6 Blazor Server application is created using the .NET Blazor Server App template. The app is adding sign-in to protect itself, and as a consequence this is requiring the user to be authenticated in Azure Active Directory. +This ASP.NET Core 6 Blazor Server application is created using the .NET Blazor Server App template. The app is adding sign-in to protect itself, and as a consequence this is requiring the user to be authenticated in Microsoft Entra ID. -When this .NET Blazor Server starts and before listening for any HTTP requests, it bootstraps the application using a single-surface API provided as part of **Microsoft.Identity.Web** and **Microsoft.Idenitty.Web.UI**. The former is tying ASP.NET Core, its authentication middleware for sign-in, and the [Microsoft Authentication Library (MSAL) for .NET](https://github.com/azuread/microsoft-authentication-library-for-dotnet), while the latter adds UI components and controllers to facilitate user sign-in, sign-out, and other account experiences. All the details required for authentication are being gathered from a configuration section named `AzureAd` as well as others entries used during the call to a protected API, like the scopes. As for authorization, it is using the default policy options. Additionally, special services are injected [specifically for Blazor for re-signing, consent and conditional access purposes](https://github.com/AzureAD/microsoft-identity-web/wiki/Managing-incremental-consent-and-conditional-access#in-blazor-server). The recommended pattern to acquire tokens is first attempting to acquire them [non-interactevelly (or silent from cache), and then interactively](https://docs.microsoft.com/azure/active-directory/develop/msal-authentication-flows#interactive-and-non-interactive-authentication). Therefore, it is required to store the tokens for them to be cached. In this tutorial tokens are being stored in memory. +When this .NET Blazor Server starts and before listening for any HTTP requests, it bootstraps the application using a single-surface API provided as part of **Microsoft.Identity.Web** and **Microsoft.Idenitty.Web.UI**. The former is tying ASP.NET Core, its authentication middleware for sign-in, and the [Microsoft Authentication Library (MSAL) for .NET](https://github.com/azuread/microsoft-authentication-library-for-dotnet), while the latter adds UI components and controllers to facilitate user sign-in, sign-out, and other account experiences. All the details required for authentication are being gathered from a configuration section named `AzureAd` as well as others entries used during the call to a protected API, like the scopes. As for authorization, it is using the default policy options. Additionally, special services are injected [specifically for Blazor for re-signing, consent and Conditional Access purposes](https://github.com/AzureAD/microsoft-identity-web/wiki/Managing-incremental-consent-and-conditional-access#in-blazor-server). The recommended pattern to acquire tokens is first attempting to acquire them [non-interactevelly (or silent from cache), and then interactively](https://docs.microsoft.com/azure/active-directory/develop/msal-authentication-flows#interactive-and-non-interactive-authentication). Therefore, it is required to store the tokens for them to be cached. In this tutorial tokens are being stored in memory. -When users navigate to the home page, the application initiates an authentication flow, more specifically an **Authorization code type flow (OAuth 2 authorization code grant)**. During this authentication flow, the user is prompted for their credentials, by Azure AD, if the token has to be acquired interactively, and then asked to consent to the permissions. Upon successful authentication, this web app is making a call to the Microsoft Graph /me endpoint from the **Index** page by using an injected **IDownstreamWebApi** service. This helper facilitates making an HTTP GET request to the protected web API adding the cached or newly acquired user's access token in the HTTP Authorization header. The app displays that you've successfully logged in using your Azure Active Directory credentials, and the Microsoft Graph API response. +When users navigate to the home page, the application initiates an authentication flow, more specifically an **Authorization code type flow (OAuth 2 authorization code grant)**. During this authentication flow, the user is prompted for their credentials, by Microsoft Entra ID, if the token has to be acquired interactively, and then asked to consent to the permissions. Upon successful authentication, this web app is making a call to the Microsoft Graph /me endpoint from the **Index** page by using an injected **IDownstreamWebApi** service. This helper facilitates making an HTTP GET request to the protected web API adding the cached or newly acquired user's access token in the HTTP Authorization header. The app displays that you've successfully logged in using your Microsoft Entra credentials, and the Microsoft Graph API response. When a user logs out, their browser is redirected to a public route confirming the user signed-out. diff --git a/web-app-blazor-server/app-signed-in.png b/web-app-blazor-server/app-signed-in.png index 120f4b2..6c72efd 100644 Binary files a/web-app-blazor-server/app-signed-in.png and b/web-app-blazor-server/app-signed-in.png differ diff --git a/xplat-maui/README.md b/xplat-maui/README.md index db6900f..4db8514 100644 --- a/xplat-maui/README.md +++ b/xplat-maui/README.md @@ -30,7 +30,7 @@ This sample demonstrates a Windows desktop and Android mobile .NET MAUI Multi-pl ## Prerequisites -- An Azure Active Directory (Azure AD) tenant. You can [open an Azure account for free](https://azure.microsoft.com/free) to get an Azure AD instance. +- A Microsoft Entra tenant. You can [open an Azure account for free](https://azure.microsoft.com/free) to get a Microsoft Entra instance. - [.NET 6.0 SDK](https://dotnet.microsoft.com/download/dotnet/6.0) - [.NET MAUI](https://docs.microsoft.com/en-us/dotnet/maui/get-started/installation) - **Install apps from any source** enabled in Windows' developer settings @@ -38,7 +38,9 @@ This sample demonstrates a Windows desktop and Android mobile .NET MAUI Multi-pl ## Setup -### 1. Register the web API application in your Azure Active Directory + + +### 1. Register the web API application in your Microsoft Entra ID First, complete the steps in [Register an application with the Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app) to register the sample app. @@ -98,7 +100,7 @@ Use the following settings for your app registration: This app uses the .NET MAUI Multi-platform App UI to provide a cross-platform experience in which the Microsoft Identity Client library is used to sign the user in and out of the application. -When a signed-out user clicks the sign in button, the app offers a native Azure AD sign in experience. After signing in, and if they've not previously done so, the user is asked to consent to the app's request for permission to access their data. +When a signed-out user clicks the sign in button, the app offers a native Microsoft Entra sign-in experience. After signing in, and if they've not previously done so, the user is asked to consent to the app's request for permission to access their data. While signing in, a new token is acquired and passed in an Authorization header as Bearer for a subsequent call to Microsoft Graph. When a signed-out user the account is removed from the client cleaning up the user's retrieved information. diff --git a/xplat-maui/app-signedin.png b/xplat-maui/app-signedin.png index b58e6ae..208a5f6 100644 Binary files a/xplat-maui/app-signedin.png and b/xplat-maui/app-signedin.png differ diff --git a/xplat-maui/app.png b/xplat-maui/app.png index c9716e5..5227595 100644 Binary files a/xplat-maui/app.png and b/xplat-maui/app.png differ