Session from

1. Programming
Azure Active Directory

3. 17
COLUMBUS, OH OCTOBER 17, 2014 CLOUDDEVELOP.ORG

4. Opening Keynote
Scott Guthrie
October 21st, 2014
8:00am – 5:00pm PST
http://azureconf.net

5. Assume you know what Microsoft Azure is
and likely have an Azure subscription.
This is not a Active Directory design session.
Review common scenarios . . . Yours may be
different.
We’re not going to cover it all today . . .
large, complicated topics with many
options/scenarios.

6. Azure Active Directory -
What is it?

7. Multi-tenant “directory-as-a-service”
Identity & access for on-premises and
cloud applications
NOT a cloud version of
Windows Server AD
Image Source: http://technet.microsoft.com/en-us/library/jj573650.aspx

8. Extend Windows Server AD
to the cloud
Directory & identity services
w/o need for Windows
Server AD
Each O365 tenant has
instance of AAD
Your App
AAD
Authentication
platform
Directory
store
Active Directory

9. Register an application with Azure AD
Permissions
Open source Azure AD authentication libraries

11. Visual Studio 2013 wizard makes it easy
Register the application in Azure AD
Set a database
Set Sign-On URL, App ID and Reply URL
Basic set of claims available from AAD

12. Working with the Graph

13. Read

14. Read
Write

15. REST API Endpoints

16. REST API Endpoints
Authentication with Azure AD

17. REST API Endpoints
Authentication with Azure AD
Role Based Access Control (RBAC)

18. REST API Endpoints
Authentication with Azure AD
Role Based Access Control (RBAC)
Differential Queries

19. REST API Endpoints
Authentication with Azure AD
Role Based Access Control (RBAC)
Differential Queries
Directory Extensions

20. What’s in the directory?
REST Graph API

21. Graph URL
Tenant
(domain or objectID)
https://graph.windows.net/
Entity
(user, group, role, etc)
?$filter=givenName eq 'Jon'&api-version=2013-11-08
OData query
($filter, $top)
collierdemo.onmicrosoft.com/
API Version
users

22. Active Directory Authentication Library (ADAL)
for .NET

23. Microsoft.Azure.ActiveDirectory.GraphClient
GraphConnection

24. Graph Security

25. My
Application
Service-to-Service
OAuth 2.0 Grant Type Client Credentials
Azure AD Authentication Endpoint
(OAuth)
(https://graph.windows.net)
REST Service
(validates token,
process, returns data)
Authorization
Check
Azure Active Directory
1) Request JWT token (provide
clienID and secret)
2) Return
JWT token
3) HTTP Request w/ JWT token
4) Return response

26. OAuth 2.0 Grant Type = Client Credentials
// get OAuth token using Client Credentials
string tenantName = "GraphDir1.onMicrosoft.com";
string issuingAuthority = "https://login.windows.net/" + tenantName;
AuthenticationContext authenticationContext = new AuthenticationContext(issuingAuthority,false);
// Config for OAuth client credentials
string clientId = "118473c2-7619-46e3-a8e4-6da8d5f56e12";
string clientSecret = "hOrJ0r0TZ4GQ3obp+vk3FZ7JBVP+TX353kNo6QwNq7Q=";
ClientCredential clientCred = new ClientCredential(clientId, clientSecret);
string resource = "https://graph.windows.net";
string token;
AuthenticationResult authenticationResult = authenticationContext.AcquireToken(resource, clientCred);
token = authenticationResult.AccessToken;
* Some values removed for readability
OAuth 2.0 grant type, client_id, and client_secret configured in Azure portal

27. OAuth 2.0 Grant Type = Client Credentials
POST https://login.windows.net/GraphDir1.onMicrosoft.com/oauth2/token
Content-Type: application/x-www-form-urlencoded
client-request-id: 1e38c3d3-dca3-42ff-8149-5db607b3488c
return-client-request-id: true
resource=https%3A%2F%2Fgraph.windows.net&
client_id=118473c2-7619-46e3-a8e4-6da8d5f56e12&
client_secret=hOrJ0r0TZ4GQ3obp%2Bvk3FZ7JBVP%2BTX353kNo6QwNq7Q%3D&
grant_type=client_credentials
* Some values removed for readability

28. OAuth 2.0 Grant Type = Client Credentials
Content-Type: application/json; charset=utf-8
client-request-id: 1e38c3d3-dca3-42ff-8149-5db607b3488c
Content-Length: 1160
{"token_type":"Bearer","expires_in":"3599","expires_on":"1407640794","not_before":"1407636894","resource":"https:
//graph.windows.net","access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImtyaU1QZG1Cdng2OHNrV
DgtbVBBQjNCc2VlQSJ9.eyJhdWQiOiJodHRwczovL2dyYXBoLndpbmRvd3MubmV0IiwiaXNzIjoiaHR0cHM6Ly9zdHMud
2luZG93cy5uZXQvNGZkMmIyZjItZWEyNy00ZmU1LWE4ZjMtN2IxYTdjOTc1ZjM0LyIsImlhdCI6MTQwNzYzNjg5NCwib
mJmIjoxNDA3NjM2ODk0LCJleHAiOjE0MDc2NDA3OTQsInZlciI6IjEuMCIsInRpZCI6IjRmZDJiMmYyLWVhMjctNGZlNS1
hOGYzLTdiMWE3Yzk3NWYzNCIsIm9pZCI6ImIwZGVhNTFlLWJkMDQtNGI5OS05NmEyLTE0ZDk5YjE5YmM2YSI…………
………….."}
* Some values removed for readability

30. 1. Leverage ADAL and Graph Library
2. Obtain authentication token
3. Set GraphSetting with API version of choice
4. Set filter properties (if desired)
5. Get, Create, or Delete User, Group,
Application, etc.

31. Provide means to bring on-premises / custom
schema extensions to Azure AD.

33. 1. Obtain authentication token
2. Write against REST API directly
3. Ability to set custom properties on directory
objects

34. Azure AD extends directory authentication to the cloud
Enables single sign-on for web applications
CRUD objects in the directory

35. Azure AD Graph API
Azure AD Samples
Azure AD Graph Team Blog
Graph Explorer
Building Web Apps and Mobile Apps Using Microsoft Azure Active
Directory for Identity Management

36. Questions?