You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This sample shows how to build a .NET Core MVC Web app that uses OpenID Connect to sign in users with their Work and School or Microsoft personal account (formerly live accounts). It leverages the ASP.NET Core OpenID Connect middleware.
13
+
This sample shows how to build a .NET Core MVC Web app that uses OpenID Connect to sign in personal accounts (including outlook.com, live.com, and others) as well as work and school accounts from any company or organization that has integrated with Azure Active Directory. It leverages the ASP.NET Core OpenID Connect middleware.
14
14
15
15
16
16
17
-
For more information on how the protocols work in this scenario and other scenarios, see [Authentication Scenarios for Azure AD](http://go.microsoft.com/fwlink/?LinkId=394414).
18
-
19
17
## How to run this sample
20
18
21
19
To run this sample:
22
20
23
-
- Install .NET Core (for example for Windows) by following the instructions at [.NET and C# - Get Started in 10 Minutes](https://www.microsoft.com/net/core). In addition to developing on Windows, you can develop on [Linux](https://www.microsoft.com/net/core#linuxredhat), [Mac](https://www.microsoft.com/net/core#macos), or [Docker](https://www.microsoft.com/net/core#dockercmd).
24
-
- An Azure AD tenant. For more information on how to obtain an Azure AD tenant, see [How to get an Azure AD tenant](https://azure.microsoft.com/documentation/articles/active-directory-howto-tenant/).
21
+
> Pre-requisites: Install .NET Core (for example for Windows) by following the instructions at [.NET and C# - Get Started in 10 Minutes](https://www.microsoft.com/net/core). In addition to developing on Windows, you can develop on [Linux](https://www.microsoft.com/net/core#linuxredhat), [Mac](https://www.microsoft.com/net/core#macos), or [Docker](https://www.microsoft.com/net/core#dockercmd).
25
22
26
23
### Step 1: Register the sample with your Azure AD tenant
27
24
28
-
1. Sign in to the [Application registration portal](https://apps.dev.microsoft.com) either a personal or work or school Microsoft account
29
-
1. Look at your list of Microsoft apps
30
-
1. Click **Add an app**, and give it a name. Then press **Create**. The portal will assign your app a globally unique Application ID that you'll use later in your code.
31
-
1. Click on **Add Platform**, and in the dialog press the **Web** icon.
25
+
1. Sign in to the [Application registration portal](https://apps.dev.microsoft.com/portal/register-app) either using a personal Microsoft account (live.com or hotmail.com) or work or school account.
26
+
1. Give a name to your Application, make sure that the *Guided Setup* option is **Unchecked**. Then press **Create**. The portal will assign your app a globally unique *Application ID* that you'll use later in your code.
27
+
1. Click **Add Platform**, and select **Web**.
32
28
1. In the Redirect URLs field, add `http://localhost:5000/` and `http://localhost:5000/signin-oidc`
33
29
34
-
> [!NOTE]
35
-
> The base address in the **Sign-on URL** and **Logout URL** settings is `http://localhost:5000`. This localhost address allows the sample app to run insecurely from your local system. Port 5000 is the default port for the [Kestrel server](https://docs.microsoft.com/aspnet/core/fundamentals/servers/kestrel). Update these URLs if you configure the app for production use (for example, `https://www.contoso.com/signin-oidc` and `https://www.contoso.com/signout-oidc`).
30
+
> Note: The base address in the **Sign-on URL** and **Logout URL** settings is `http://localhost:5000`. This localhost address allows the sample app to run insecurely from your local system. Port 5000 is the default port for the [Kestrel server](https://docs.microsoft.com/aspnet/core/fundamentals/servers/kestrel). Update these URLs if you configure the app for production use (for example, `https://www.contoso.com/signin-oidc` and `https://www.contoso.com/signout-oidc`).
36
31
37
-
### Step 2: Create the sample
32
+
### Step 2: Download/ Clone this sample code or build the application using a template
38
33
39
-
This sample was created from the dotnet core 2.0 template [dotnet new mvc](https://docs.microsoft.com/dotnet/core/tools/dotnet-new?tabs=netcore2x) template with `SingleOrg` authentication, and then tweaked to let it support tokens for the Azure AD V2 endpoint. You can create the sample from the command line or clone/download this repository:
34
+
This sample was created from the dotnet core 2.0 [dotnet new mvc](https://docs.microsoft.com/dotnet/core/tools/dotnet-new?tabs=netcore2x) template with `SingleOrg` authentication, and then tweaked to let it support tokens for the Azure AD V2 endpoint. You can clone/download this repository or create the sample from the command line:
40
35
41
-
#### To create the sample from the command line
36
+
#### Option 1: Download/ clone this sample
42
37
43
-
- Execute the following command:
38
+
You can clone this sample from your shell or command line:
44
39
45
40
```console
46
-
dotnet new mvc --auth SingleOrg --client-id <CLIENT_ID_(APP_ID)>
Use the value that you recorded from the Azure portal for \<CLIENT\_ID\_(APP\_ID)>.
44
+
In the **appsettings.json** file, replace the `ClientID` value with the *Applicaiton ID* from the application you just registered in Application Registration portal on *Step 1*.
45
+
46
+
#### Option 2: Create the sample from the command line
50
47
51
-
- Then:
48
+
1. Run the following command to create a sample from the command line using the `MultiOrg` template:
49
+
```console
50
+
dotnet new mvc --auth SingleOrg --client-id <Enter_the_Application_Id_here>
51
+
```
52
+
53
+
> Note: Replace *`Enter_the_Application_Id_here`* with the *Application Id* from the application Id you just registered in the Application Registration Portal.
52
54
53
-
- Modify the `Configure` method in `Extensions\AzureAdAuthenticationBuilderExtensions.cs` file. This method show be as follows (the changed lines are the lines containing `Authority`, and `ValidateIssuer`)
55
+
2. Open **Extensions\AzureAdAuthenticationBuilderExtensions.cs** file and replace the `Configure` method with:
54
56
55
57
```CSharp
56
58
public void Configure(string name, OpenIdConnectOptions options)
57
59
{
58
60
options.ClientId = _azureOptions.ClientId;
59
-
options.Authority=$"{_azureOptions.Instance}common/v2.0"; // V2 specific
> Note: This change is needed because certain token claims from Azure AD V1 endpoint (on which the original .NET core template is based) are different than Azure AD V2 endpoint.
2. Open your web browser and make a request to the app. The app immediately attempts to authenticate you via the Azure AD v2 endpoint. Sign in with your personal account or with work or school account.
96
97
97
-
In the **appsettings.json* file, provide values for the `Domain`, `TenantId`, and `ClientID` that you recorded earlier from the Azure portal.
98
+
## Optional: Restrict sign-in access to your application
98
99
99
-
### Step 3: Run the sample
100
+
By default, when you use the dotnet core template with `SingleOrg` authentication option and follow the instructions in this guide to configure the application to use the Azure Active Directory v2 endpoint, both personal accounts - like outlook.com, live.com, and others - as well as Work or school accounts from any organizations that are integrated with Azure AD can sign in to your application. This is typically used on SaaS applications.
100
101
101
-
Build the solution and run it.
102
+
To restrict who can sign in to your application, use one of the options:
102
103
103
-
Make a request to the app. The app immediately attempts to authenticate you via Azure AD. Sign in with the username and password of a user account that is in your Azure AD tenant or your microsoft personal account.
104
+
### Option 1: Restrict access to a single organization (single-tenant)
104
105
105
-
## About The code
106
+
You can restrict sign-in access for your application to only user accounts that are in a single Azure AD tenant - including *guest accounts* of that tenant. This scenario is a common for *line-of-business applications*:
106
107
107
-
### ASP.NET Core middleware
108
+
1. Open **appsettings.json** and replace the line containing the `TenantId` value with the domain of your tenant, for example, *contoso.onmicrosoft.com* or the guid for the Tenant Id:
109
+
110
+
```json
111
+
"TenantId": "[Enter the domain of your tenant, e.g. contoso.onmicrosoft.com or the Tenant Id]",
112
+
```
113
+
114
+
2. In your **Extensions\AzureAdAuthenticationBuilderExtensions.cs** file, replace the `Configure` method with:
115
+
116
+
```CSharp
117
+
public void Configure(string name, OpenIdConnectOptions options)
options.TokenValidationParameters.ValidateIssuer = true; // Validate the tenant
124
+
}
125
+
```
126
+
127
+
### Option 2: Restrict access to a list of organizations
128
+
129
+
You can restrict sign-in access to only user accounts that are in a specific list of Azure AD organizations:
130
+
131
+
1. In your **Extensions\AzureAdAuthenticationBuilderExtensions.cs** file, set the `ValidateIssuer` argument to **`true`**
132
+
2. Add a `ValidIssuers` `TokenValidationParameters` parameter containing the list of allowed organizations.
133
+
134
+
### Option 3: Use a custom method to validate issuers
135
+
136
+
You can implement a custom method to validate issuers by using the **IssuerValidator** parameter. For more information about how to use this parameter, read about the [TokenValidationParameters class](https://msdn.microsoft.com/library/system.identitymodel.tokens.tokenvalidationparameters.aspx) on MSDN.
137
+
138
+
### Variations
139
+
140
+
You can also decide which types of user accounts can sign in to your Web App by changing the Authority. The picture below shows all the possibilities
141
+
142
+
143
+
144
+
## About The code
108
145
109
146
This sample shows how to use the OpenID Connect ASP.NET Core middleware to sign in users from a single Azure AD tenant. The middleware is initialized in the `Startup.cs` file by passing it the Client ID of the app and the URL of the Azure AD tenant where the app is registered, which is read from the `appsettings.json` file. The middleware takes care of:
110
147
@@ -130,26 +167,3 @@ return SignOut(
130
167
```
131
168
132
169
The middleware in this project is created as a part of the open-source [ASP.NET Security](https://github.com/aspnet/Security) project.
133
-
134
-
### What is specific to Azure AD V2?
135
-
136
-
ASP.NET Core creates Web applications for the V1 endpoint. It's easy, however to update the code to let users sign-in with both work and school accounts and Microsoft personal accounts. It's also possible to restrict the accounts used to sign-in
137
-
138
-
#### Modified code
139
-
140
-
The specific Azure AD V2 code is in `Configure(string name, OpenIdConnectOptions options)`:
141
-
142
-
```CSharp
143
-
options.Authority=$"{_azureOptions.Instance}common/v2.0"; // V2 specific
144
-
options.TokenValidationParameters.ValidateIssuer=false; // accept any tenant
145
-
```
146
-
147
-
The first line tells the middleware to let sign-in users with the Azure AD V2 endpoint, that is with their work and school account or Microsoft personal account.
148
-
149
-
The second line tells the middleware to not validate the tenants. If you want to validate the tenants, you can set `ValidateIssuer` to true, and add a delegate as the `options.TokenValidationParameters.IssuerValidator` property.
150
-
151
-
#### Variations
152
-
153
-
You can decide which user accounts can sign-in to your Web App by changing the Authority. The picture below shows all the possibilities
0 commit comments