Skip to content

Commit 63087e8

Browse files
jmprieurjmprieur
authored
Jmprieur/update to microsoft identity web 0 2 0 (#148)
* Update to Microsoft.Identity.Web 0.2.0 and MSAL.NET 4.16.0 * Updating the 2nd folder * Updating the 3rd folder * Updating folder 4
1 parent 82728c9 commit 63087e8

File tree

26 files changed

+118
-84
lines changed

26 files changed

+118
-84
lines changed

‎1. Desktop app calls Web API/README-incremental.md‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -289,10 +289,10 @@ Replace:
289289
With:
290290

291291
```CSharp
292-
services.AddProtectedWebApi(Configuration);
292+
services.AddMicrosoftWebApiAuthentication(Configuration);
293293
```
294294

295-
The method `AddProtectedWebApi` in Microsoft.Identity.Web ensures that:
295+
The method `AddMicrosoftWebApiAuthentication` in Microsoft.Identity.Web ensures that:
296296

297297
- the tokens are validated with Microsoft Identity Platform
298298
- the valid audiences are both the ClientID of our Web API (default value of `options.Audience` with the ASP.NET Core template) and api://{ClientID}
@@ -314,10 +314,14 @@ If you are not using Visual Studio, edit the `TodoListService\Properties\launchs
314314

315315
## Choosing which scopes to expose
316316

317-
This sample exposes a delegated permission (access_as_user) that will be presented in the access token claim. The method `AddProtectedWebApi` does not validate the scope, but Microsoft.Identity.Web has a HttpContext extension method, `VerifyUserHasAnyAcceptedScope`, where you can validate the scope as below:
317+
This sample exposes a delegated permission (access_as_user) that will be presented in the access token claim. The method `AddMicrosoftWebApiAuthentication` does not validate the scope, but Microsoft.Identity.Web has a HttpContext extension method, `VerifyUserHasAnyAcceptedScope`, where you can validate the scope from a controller action, as below:
318318

319319
```csharp
320-
HttpContext.VerifyUserHasAnyAcceptedScope(scopeRequiredByApi);
320+
public IEnumerable<TodoItem> Get()
321+
{
322+
HttpContext.VerifyUserHasAnyAcceptedScope(scopeRequiredByApi);
323+
// process the action
324+
}
321325
```
322326

323327
### For delegated permissions how to access scopes

‎1. Desktop app calls Web API/README.md‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -298,10 +298,10 @@ Replace:
298298
With:
299299

300300
```CSharp
301-
services.AddProtectedWebApi(Configuration);
301+
services.AddMicrosoftWebApiAuthentication(Configuration);
302302
```
303303

304-
The method `AddProtectedWebApi` in Microsoft.Identity.Web ensures that:
304+
The method `AddMicrosoftWebApiAuthentication` in Microsoft.Identity.Web ensures that:
305305

306306
- the tokens are validated with Microsoft Identity Platform
307307
- the valid audiences are both the ClientID of our Web API (default value of `options.Audience` with the ASP.NET Core template) and api://{ClientID}
@@ -323,12 +323,15 @@ If you are not using Visual Studio, edit the `TodoListService\Properties\launchs
323323

324324
## Choosing which scopes to expose
325325

326-
This sample exposes a delegated permission (access_as_user) that will be presented in the access token claim. The method `AddProtectedWebApi` does not validate the scope, but Microsoft.Identity.Web has a HttpContext extension method, `VerifyUserHasAnyAcceptedScope`, where you can validate the scope as below:
326+
This sample exposes a delegated permission (access_as_user) that will be presented in the access token claim. The method `AddMicrosoftWebApiAuthentication` does not validate the scope, but Microsoft.Identity.Web has a HttpContext extension method, `VerifyUserHasAnyAcceptedScope`, where you can validate the scope, from a controller action, as below:
327327

328328
```csharp
329-
HttpContext.VerifyUserHasAnyAcceptedScope(scopeRequiredByApi);
329+
public IEnumerable<TodoItem> Get()
330+
{
331+
HttpContext.VerifyUserHasAnyAcceptedScope(scopeRequiredByApi);
332+
// process the action
333+
}
330334
```
331-
332335
### For delegated permissions how to access scopes
333336

334337
If a token has delegated permission scopes, they will be in the `scp` or `http://schemas.microsoft.com/identity/claims/scope` claim.

‎1. Desktop app calls Web API/TodoListClient/TodoListClient.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@
109109
</ItemGroup>
110110
<ItemGroup>
111111
<PackageReference Include="Microsoft.Identity.Client">
112-
<Version>4.11.0</Version>
112+
<Version>4.16.0</Version>
113113
</PackageReference>
114114
<PackageReference Include="Newtonsoft.Json">
115115
<Version>11.0.2</Version>

‎1. Desktop app calls Web API/TodoListService/Properties/serviceDependencies.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"dependencies": {
3+
"secrets1": {
4+
"type": "secrets"
5+
}
6+
}
7+
}

‎1. Desktop app calls Web API/TodoListService/Properties/serviceDependencies.local.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"dependencies": {
3+
"secrets1": {
4+
"type": "secrets.user"
5+
}
6+
}
7+
}

‎1. Desktop app calls Web API/TodoListService/Startup.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public Startup(IConfiguration configuration)
2222
// This method gets called by the runtime. Use this method to add services to the container.
2323
public void ConfigureServices(IServiceCollection services)
2424
{
25-
services.AddProtectedWebApi(Configuration);
25+
services.AddMicrosoftWebApiAuthentication(Configuration);
2626

2727
services.AddControllers();
2828
}

‎1. Desktop app calls Web API/TodoListService/TodoListService.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@
77
</PropertyGroup>
88

99
<ItemGroup>
10-
<PackageReference Include="Microsoft.Identity.Web" Version="0.1.2-preview" />
10+
<PackageReference Include="Microsoft.Identity.Web" Version="0.2.0-preview" />
1111
</ItemGroup>
1212
</Project>

‎2. Web API now calls Microsoft Graph/README-incremental.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -187,12 +187,12 @@ Update `Startup.cs` file:
187187
by
188188

189189
```csharp
190-
services.AddProtectedWebApi(Configuration)
191-
.AddProtectedApiCallsWebApis(Configuration)
190+
services.AddMicrosoftWebApiAuthentication(Configuration)
191+
.AddMicrosoftWebApiCallsWebApi(Configuration)
192192
.AddInMemoryTokenCaches();
193193
```
194194

195-
`AddProtectedWebApi` does the following:
195+
`AddMicrosoftWebApiAuthentication` does the following:
196196
- add the **Jwt**BearerAuthenticationScheme (Note the replacement of BearerAuthenticationScheme by **Jwt**BearerAuthenticationScheme)
197197
- set the authority to be the Microsoft identity platform identity
198198
- sets the audiences to validate
@@ -231,7 +231,7 @@ Update `Startup.cs` file:
231231

232232
The implementations of these classes are in the Microsoft.Identity.Web library (and folder), and they are designed to be reusable in your applications (Web apps and Web apis)
233233

234-
`AddProtectedApiCallsWebApis` subscribes to the `OnTokenValidated` JwtBearerAuthentication event, and, in this event, adds the user account into MSAL.NET's user token cache by using the AcquireTokenOnBehalfOfUser method. This is done by the `AddAccountToCacheFromJwt` method of the `ITokenAcquisition` micro-service, which wraps MSAL.NET
234+
`AddMicrosoftWebApiCallsWebApi` subscribes to the `OnTokenValidated` JwtBearerAuthentication event, and, in this event, adds the user account into MSAL.NET's user token cache by using the AcquireTokenOnBehalfOfUser method. This is done by the `AddAccountToCacheFromJwt` method of the `ITokenAcquisition` micro-service, which wraps MSAL.NET
235235

236236
```CSharp
237237
services.Configure<JwtBearerOptions>(AzureADDefaults.JwtBearerAuthenticationScheme, options =>
@@ -293,7 +293,7 @@ This method is the following. It:
293293
}
294294
catch (MsalUiRequiredException ex)
295295
{
296-
tokenAcquisition.ReplyForbiddenWithWwwAuthenticateHeader(scopes, ex);
296+
await tokenAcquisition.ReplyForbiddenWithWwwAuthenticateHeaderAsync(scopes, ex);
297297
return string.Empty;
298298
}
299299
}
@@ -305,7 +305,7 @@ This method is the following. It:
305305

306306
An interesting piece is how `MsalUiRequiredException` are handled. These exceptions are typically sent by Azure AD when there is a need for a user interaction. This can be the case when the user needs to re-sign-in, or needs to grant some additional consent, or to obtain additional claims. For instance, the user might need to do multi-factor authentication required specifically by a specific downstream API. When these exceptions happen, given that the Web API does not have any UI, it needs to challenge the client passing all the information enabling this client to handle the interaction with the user.
307307

308-
This sample uses the `ReplyForbiddenWithWwwAuthenticateHeader` method of the `TokenAcquisition` service. This method uses the HttpResponse to:
308+
This sample uses the `ReplyForbiddenWithWwwAuthenticateHeaderAsync` method of the `TokenAcquisition` service. This method uses the HttpResponse to:
309309

310310
- Send an HTTP 404 (Forbidden) to the client
311311
- Set information in the www-Authenticate header of the HttpResponse with information that would enable a client to get more consent from the user that is:

‎2. Web API now calls Microsoft Graph/README.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -304,12 +304,12 @@ Update `Startup.cs` file:
304304
by
305305

306306
```csharp
307-
services.AddProtectedWebApi(Configuration)
308-
.AddProtectedApiCallsWebApis(Configuration)
307+
services.AddMicrosoftWebApiAuthentication(Configuration)
308+
.AddMicrosoftWebApiCallsWebApi(Configuration)
309309
.AddInMemoryTokenCaches();
310310
```
311311

312-
`AddProtectedWebApi` does the following:
312+
`AddMicrosoftWebApiAuthentication` does the following:
313313
- add the **JwtBearerAuthenticationScheme** (Note the replacement of BearerAuthenticationScheme by JwtBearerAuthenticationScheme)
314314
- set the authority to be the Microsoft identity platform identity
315315
- set the audiences to be validated
@@ -322,7 +322,7 @@ Update `Startup.cs` file:
322322

323323
The implementations of these classes are in the [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) library, and they are designed to be reusable in your applications (Web apps and Web apis).
324324

325-
`AddProtectedApiCallsWebApis` subscribes to the `OnTokenValidated` JwtBearerAuthentication event, and in this event, adds the user account into MSAL.NET's user token cache.
325+
`AddMicrosoftWebApiCallsWebApi` subscribes to the `OnTokenValidated` JwtBearerAuthentication event, and in this event, adds the user account into MSAL.NET's user token cache.
326326

327327
`AddInMemoryTokenCaches` adds an in memory token cache provider, which will cache the Access Tokens acquired for the downstream Web API.
328328

@@ -363,7 +363,7 @@ This method:
363363
}
364364
catch (MsalUiRequiredException ex)
365365
{
366-
tokenAcquisition.ReplyForbiddenWithWwwAuthenticateHeader(scopes, ex);
366+
await tokenAcquisition.ReplyForbiddenWithWwwAuthenticateHeaderAsync(scopes, ex);
367367
return string.Empty;
368368
}
369369
}
@@ -375,7 +375,7 @@ This method:
375375

376376
An interesting piece is how `MsalUiRequiredException` are handled. These exceptions are typically sent by Azure AD when there is a need for a user interaction. This can be the case when the user needs to re-sign-in, or needs to grant some additional consent, or to obtain additional claims. For instance, the user might need to do multi-factor authentication required specifically by a specific downstream API. When these exceptions happen, given that the Web API does not have any UI, it needs to challenge the client app passing all the required information, so this client app can handle the interaction with the user.
377377

378-
This sample uses the `ReplyForbiddenWithWwwAuthenticateHeader` available on the `TokenAcquisition` service (part of Microsoft.Identity.Web library), which uses the HttpResponse to:
378+
This sample uses the `ReplyForbiddenWithWwwAuthenticateHeaderAsync` available on the `TokenAcquisition` service (part of Microsoft.Identity.Web library), which uses the HttpResponse to:
379379

380380
- Send an HTTP 403 (Forbidden) to the client app
381381
- Set information in the www-Authenticate header of the HttpResponse with information that would enable a client to get more consent from the user that is:

‎2. Web API now calls Microsoft Graph/TodoListClient/TodoListClient.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@
109109
</ItemGroup>
110110
<ItemGroup>
111111
<PackageReference Include="Microsoft.Identity.Client">
112-
<Version>4.11.0</Version>
112+
<Version>4.16.0</Version>
113113
</PackageReference>
114114
<PackageReference Include="Newtonsoft.Json">
115115
<Version>11.0.2</Version>

0 commit comments

Comments
 (0)