damienbod / microsoftentraidauthmicrosoftidentityweb

Microsoft Entra ID (Azure AD) flows using ASP.NET Core and Microsoft.Identity.Web

Microsoft Entra ID (Azure AD) authentication, authorization with ASP.NET Core

Blogs

• Implement Microsoft Entra ID Client credentials flow using Client Certificates for service APIs
• Using Key Vault certificates with Microsoft.Identity.Web and ASP.NET Core applications
• Using encrypted access tokens in Azure with Microsoft.Identity.Web and Azure App registrations
• Implement a Web APP and an ASP.NET Core Secure API using Microsoft Entra ID which delegates to a second API
• Using multiple APIs in Angular and ASP.NET Core with Microsoft Entra ID authentication
• Using multiple APIs in Blazor with Microsoft Entra ID authentication
• Microsoft Entra ID Access Token Lifetime Policy Management in ASP.NET Core
• Implement OAUTH Device Code Flow with Microsoft Entra ID and ASP.NET Core
• Implement app roles authorization with Microsoft Entra ID and ASP.NET Core
• Securing Blazor Web assembly using cookies
• Implementing authorization in Blazor ASP.NET Core applications using Microsoft Entra ID security groups
• Implementing OAuth2 APP to APP security using Microsoft Entra ID from a Web APP

History

• 2024-04-11 Updated packages
• 2023-12-01 Updated .NET 8
• 2023-08-14 Updated downstream APIs solution
• 2023-08-14 Updated packages
• 2023-05-05 Updated packages
• 2023-03-12 Updated .NET 7, updated nuget packages, implicit usings
• 2022-10-09 Updated nuget packages
• 2022-08-01 Updated nuget packages
• 2022-04-03 Updated nuget packages, added nullable to projects, added CC flow demo
• 2022-02-19 Updated nuget packages
• 2022-01-07 Updated nuget packages
• 2021-11-04 Updated to .NET 6
• 2021-08-13 Updated Blazor BFF app and fixed login button
• 2021-07-03 Microsoft.Identity.Web to 1.14, Angular OIDC V12
• 2021-06-20 Microsoft.Identity.Web to 1.13.1
• 2021-06-06 Microsoft.Identity.Web to 1.12
• 2021-05-13 Microsoft.Identity.Web to 1.9.2, updated packages
• 2021-04-15 Microsoft.Identity.Web to 1.9.1
• 2021-03-11 Microsoft.Identity.Web to 1.8.0
• 2021-03-05 Microsoft.Identity.Web to 1.7.0
• 2021-02-13 Added MSAL exception handling, Microsoft.Identity.Web to 1.6.0
• 2021-02-01 Added app roles authorization example
• 2021-01-28 Added device code flow, Microsoft.Identity.Web to 1.5.1
• 2021-01-19 Updated nuget, npm packages, moved to latest secrets access for certs in Key Vault
• 2021-01-05 Added token management, updated Microsoft.Identity.Web to 1.4.1
• 2020-12-14 Using multiple APIs in Blazor with Microsoft Entra ID authentication
• 2020-12-12 Updated Microsoft.Identity.Web to 1.4.0
• 2020-12-08 Added Using multiple APIs in Angular and ASP.NET Core with Microsoft Entra ID authentication
• 2020-12-04 Updated to .NET 5
• 2020-11-15 Updated Microsoft.Identity.Web to 1.3.0
• 2020-10-25 Updated Microsoft.Identity.Web to 1.2.0

Links Private key JWT Client authentication

https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow#second-case-access-token-request-with-a-certificate

Links Microsoft Entra ID Client credentials flow

https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Client-credential-flows

https://tools.ietf.org/html/rfc7523

https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

Links

https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens

https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Client-Assertions

https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow

https://github.com/AzureAD/microsoft-identity-web/wiki/Using-certificates#describing-client-certificates-to-use-by-configuration

https://www.youtube.com/watch?v=ACZQk61Iq9I

https://www.scottbrady91.com/OAuth/Removing-Shared-Secrets-for-OAuth-Client-Authentication

https://github.com/KevinDockx/ApiSecurityInDepth

https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki

Links Certs

https://docs.microsoft.com/en-us/azure/azure-app-configuration/quickstart-aspnet-core-app?tabs=core3x

https://github.com/a-patel/azure-app-configuration-labs/blob/ce6c57c0d9837dcdff246bab005b321d4897ee71/src/AzureAppConfigurationLabs.Demo/Program.cs

https://devblogs.microsoft.com/azure-sdk/authentication-and-the-azure-sdk/

https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-verification-scope-app-roles

https://dev.to/425show/just-what-is-the-default-scope-in-the-microsoft-identity-platform-azure-ad-2o4d

Links Azure SDK

Authentication and the Azure SDK

microsoftentraidauthmicrosoftidentityweb's Issues

By cftf B BBC BBQ d, d cc b CCB TCF CV cc cc cc g by GT v ACC BB BBC BC TVC I'm: ®< by Rd BB cc cc cc ccB be BBC cc 6 CF BBC cc cc cc cc cc cc cc U BB B be off cc be.

Y my b BBC cc her x cc v BB. BB f BBC by v for too d3 .. Fax bv. BBC BBQ BBC in an. Kcv.nj in v BB J, CV in to can been C an C BB the agb been b inn J CV g by BB c b JJ f until I'm. To do one in no I'm d RF BB c be cv BB BB BBC cc n at CV b been

Possible to call api's directly from WASM (Client)?

Hello @damienbod ; Thanks for your blog post and this example project.

I was wondering if it's possible to call API's directly from the WASM client, without using a Blazor Server project ?

See picture below:

BlazorBFF works w/Azure AD B2C, but get error when add SignUpSignInPolicyId

Hi Damien,

Thanks so much for this excellent example code. I've been able to get it to work pretty much as-is, however, it is with AAD B2C instead of AAD. Everything works great until I create a User Flow then add the SignUpSignInPolicyId key to the settings (which effectively eliminates the need for TenantId). Do I need to add an Authority setting here? Do we have to introduce MSAL in some way?

The error I'm getting is:
**An unhandled exception occurred while processing the request.
IOException: IDX20807: Unable to retrieve document from: 'System.String'. HttpResponseMessage: 'System.Net.Http.HttpResponseMessage', HttpResponseMessage.Content: 'System.String'.
Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(string address, CancellationToken cancel)

InvalidOperationException: IDX20803: Unable to obtain configuration from: 'System.String'.
Microsoft.IdentityModel.Protocols.ConfigurationManager.GetConfigurationAsync(CancellationToken cancel)**

Below shows your appSettings.json with the AzureAdB2C name and SignUpSignInPolicyId key (of course I'm using other guids in my code)
{ "AzureAdB2C": { "Instance": "https://login.microsoftonline.com", "Domain": "damienbodhotmail.onmicrosoft.com", "TenantId": "7ff95b15-dc21-4ba6-bc92-824856578fc1", "ClientId": "46d2f651-813a-4b5c-8a43-63abcb4f692c", "CallbackPath": "/signin-oidc", "SignedOutCallbackPath ": "/signout-callback-oidc", //"ClientSecret": "add secret to the user secrets" "SignUpSignInPolicyId": "UserFlow1" }, "UserApiOne": { "ScopeForAccessToken": "api://b2a09168-54e2-4bc4-af92-a710a64ef1fa/access_as_user User.ReadBasic.All user.read", "ApiBaseAddress": "https://localhost:44395" }

Here is the code to parse the settings and conf auth:
services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAdB2C") .EnableTokenAcquisitionToCallDownstreamApi(initialScopes) .AddMicrosoftGraph("https://graph.microsoft.com/beta", "User.ReadBasic.All user.read") .AddInMemoryTokenCaches();

Your help to get beyond this error would be greatly appreciated.

Thanks in advance...Bob Baldwin
aka VSDotNetGuy