>> Hi, I'm Jean-Marc Prieur,
a Program Manager on the Microsoft Identity Team.
In this video, I'm going to show you
the code related to authentication in
a Web Application that lets users
sign-in with Azure Active Directory,
using their work or
school account or their Microsoft personal account.
Signing in users is a prerequisite to
many scenarios such as having the Web App access,
with the users consent,
their data using the Microsoft Graph.
I'm assuming here that you are familiar with
the notion of Azure Active Directory tenant,
and understand.NET Core Two Web Applications.
So, what's our agenda?
After our quick intro to set the context,
I'm going to explain,
why you'd want to enable sign-in,
in your Web Application.
Then, I'll quickly provide insight
into what's happening during the sign-in process.
Then, we'll walk through
which part of the code does the magic.
Finally,
I'll share some resources to get to the next steps,
including the sample used in this video,
and other samples, which will help you
go farther for instance,
to code the Microsoft Graph.
So, what is relatively new this year is that you can use
the Azure AD v2 endpoint
which lets you sign-in users with,
either work or school accounts,
or Microsoft personal accounts,
formerly named live accounts.
From there, you can code your own Web APIs.
Sign-in users leverages ASP.NET core components,
which implement industry standards
such as OpenID Connect.
So, why would you want to
enable sign-in in a Web Application?
I've shown a few scenarios here.
For example, you might be
developing a line of business application,
hosted in Azure, but still would want
only the users in
your organization to access the application.
So, this protects your application.
Or, you might want to offer users customized experience,
or finally, sign-in users is
a preliminary step to coding
a Web API in the name of the user.
So, you really need to understand this part first.
What happens when a user sign-ins?
It does well that the Web Application delegates
to Azure Active Directory the
task of signing in the user.
For that to happen,
the application needs to be
registered with Azure Active Directory,
and the code of the application must be
configured to match this registration.
We'll see that in detail in the demo.
I want to show you,
here in this video,
how you can create the ASP.NET Core
2.0 application from scratch and register it.
But, for that, you would have to follow the sample
mentioned in the resource file at the end of this video.
Now, let's see the coding details.
Here, I am in Visual Studio.
I've opened the code for the application,
and I'm going to run it to show what happens.
The sign-in, so that's pretty obvious,
everybody has seen that but I
will attract your attention to a few points.
By the way, what you saw just behind us
was the configuration of
the application, we'll come back to that.
When the application starts,
what happens is you are forced to sign in,
I'm going to sign in with this account.
That's done, and if I put that full page,
you have seen that with Azure Active Directory,
and I see, hello.
And my identity, so I'm recognized.
Then, there is a button which is
a "Sign-out" button but which
can be replaced by the "Sign-in" button,
and I express which identity I will sign off with,
and then that is transformed into a "Sign-in" button.
So, what code does the magic?
When the application starts,
what happens is you get to a controller which is the
"HomeController" and in the
"HomeController" you have this attribute,
the "Authorize attribute" which
will force the authentication.
And then, how does it force the authentication?
As a new program,
this ASP.NET Core application starts with a program,
that's not always the case.
And then, this program,
Wheeler Khula method in a class name startup,
and this startup class has two interesting section.
One, which is the fact of
enabling authentication, user authentication.
The second is about configuring
the services and here for a webapp.
We said that we want to use first OpenID Connect,
which I mentioned previously to do the authentication,
and we want to keep the identity in fact in a cookie.
This is configured, I mentioned the fact that we
were configuring thing. This is configured.
This line tells us that the configuration is in
a section of a config file than Azure ID,
and that that will populate some options,
and the options are really here Azure ID options.
So, what is this config file?
To understand that a bit better,
I'm going to split my screen between two parts,
one which shows the ID,
and the second which shows
the configuration for the Web Application.
This configuration shows you
that the application has an application ID,
the application ID is exactly that what you have here,
that"s the same UAD.
That also tells you where we are going to authenticate.
What is Azure Active Directory?
This is listing and where will
Azure Active Directory call us back?
And, it will call us back to the same [inaudible] ,
or IDC URL which you
need also explain in the redirect URL.
By the way, If you are familiar with Azure ASP.NET Core,
you know that the url where your sign-in
is specified in the lounge setting
and you find it here as well.
So, that's part of configuration.
Let's go back to what happened in this class where,
and I will be full screen again,
where we read these options from
the configuration file and then, we configure things.
So, we configure the client ID for these Web Application.
The authority is what we will accept tokens
from and when you do the ASP.NET Core application,
you will have a specific tenant
which I haven't filled here because I'm exiting.
Actually, I don't teach it
from any tenant in new work, school,
or Microsoft personal accounts
hence this common little thing.
To do that by the way,
I won't let the framework validate.
I would say, "Okay, I'm happy with any of those
are coming," of course
you could enforce some validation here.
The last thing I would like to show you is the [inaudible].
Where do these buttons come from?
So, these buttons come from the "Chart Folder"
in the layout which is included in every page.
ASP.NET includes LoginPartial and LoginPartial is this.
And what this tells us is that,
depending on whether the user
is authenticated or not, we will show.
So, if this user is authenticated
will show a "Sign-out" button so
that the user can sign out and otherwise,
will show a "sign-in" button.
If the user is authenticated,
will show the name,
the email address in that case,
and the email address is extracted from the identity.
In terms of identity,
we mentioned this notion of claims,
which are evidence about the user,
as provided by the states,
by the security, let's say Azure Active Directory,
and in that case,
we extract the preferred username
by casting to claims identity,
and then extracting this value.
That code had to be changed,
or solve it too compare to what you would
have generated for a viewer application
because ASP.NET Core 2.0
provide a solution for v1 application.
So, that's it for the demo.
I hope you found it useful.
We've explored the most important part of the code
related to authentication in
an Azure AD v2 Web Application.
The slide behind me recaps
the files I did to enable authentication in the web app,
and the ones which are changed, see the colors.
To conclude, here are
some resources you can follow to find more information.
I encourage you to go through the sample yourself,
and learn how to recreate it.
I've also included some parts,
which will take you from this point,
to calling the Microsoft Graph,
or link to our documentation,
and the links on how to get help,
ask questions and pass suggestions.
Thanks for watching.