>> Hey, friends, the wonderful thing about software is
there's an infinite number of
things that you can do as a developer.
However, there are some things you probably should never
do, like roll your own identity management solution.
Fortunately, with Microsoft identity you can add
scalable authentication and authorization to any language,
any platform with only a few lines of code.
Christos Matskas is here to show me how today on Azure Friday.
[MUSIC]
>> Hey friends, I'm Scott Hanselman and it's
Azure Friday I'm here with Christos Matskas.
We're going to talk about Microsoft identity in the platform that
you can build on as a developer. How are you, sir?
>> I'm good. Nice to be here.
>> You have said that it is not my job
to write my own identity server. Why not?
>> Indeed, yes, please don't.
Because every week we hear
in the news yet another company has been compromised.
Yet another company has made the news for their own reasons
because their user data has been compromised,
because there's so much complexity when it comes to identity that,
we have 1,500 engineers working day in,
day out to make sure that you don't have to
work as hard to do identity.
Therefore, I've made a mistake in the past,
rolling my own identity and its extremely hard.
There are a lot of idiosyncrasies.
Even though everything is open sourced
and the standards like OAuth 2.0 and OpenID
Connect there are a lot of complexities there and
it goes beyond just a simple username and password for example,
how do you implement multi-factor authentication?
Requires additional services.
How do you do conditional access?
Then how do you get all the goodness from
the newer capabilities that come
into identity such as
conditional access valuation and so on and so on.
As you can see, even within
the first one minute I've already thrown
so many terminologies in
wars they can actually inundate developers.
We don't want developers to feel like that.
We want them to feel confident that when it comes to identity,
they can successfully complete the task and move
on to something more exciting because we
know identity is not the most exciting topic
that the developers deal with but it's an important one.
>> Yeah, not the most exciting one but definitely,
if not the most essential one.
Privacy, security, all those things matter and honestly,
I can't tell you how many times I've
found open-source projects that
literally check a password against a string and set a cookie.
They think that's our identity solution.
The thing that I thought was most interesting
about what you said is that there are standards.
This isn't an area that is
being new trails are being blazed like identity is understood.
There are experts that handle this.
I as the developer, build on top of the work of those experts.
>> Exactly. Yeah. I mean,
there's nothing stopping you from
looking into the RFCs and looking at
what OAuth 2.0 and OpenID Connect can do for you,
but the same time you don't want to implement
your own solution on top of that.
The Microsoft Identity platform is built on top of open standards.
It's totally compatible with all the open-source libraries.
If you want to bring your own OpenID Connect library
to authenticate, that's absolutely fine.
But the bottom line is that we want developers to be successful.
We want developers to move quickly when it comes
to managing user identities.
At the same time, we want them to do it securely
and move on to the next task as quickly as possible.
So if you can do it in one line,
then why not do it right?
>> I understand that you have a few brief slides
and then a demo where you're going
to show me how to do it in one line.
>> Yes, very few brief slides because
I don't want to spend too much time talking.
I want to spend more time building
demos and showing people how to do that.
We talked about building identity,
what we don't want people is to build
their own username and password databases and manners
their identities because as you can see
from Troy Hunt's Awesome Have I Been Pawned website.
There are over 11 billion accounts had been owned by
different hacks throughout the few years
that he's been maintaining the website
and it's growing every week.
Somewhere somehow developers have screwed up,
they're set up and they made the news.
Therefore, we don't want
you to make the news for the wrong reasons.
Now, that's a weird wardrobe but we offer
the ability for you to use the buckshot identity platform
to implement authentication and
supports every language in any platform.
We'll talk about that in a bit.
But the important bit here is
those 30 billion daily authentications,
this is an insanely scalable platform.
You might not be a 30 or one billion account company.
You might only do five authentications per
day but the fact that
the platform can scale it for you and you don't have,
as a developer, worry about how am I going to scale my platform,
where's my user objects are going to be stored,
and how they're going to scale.
That's an important thing. I'm going to skip the other numbers or
just marketing fluff and I don't want to worry about that.
One important thing here is that when it
comes to implementing identity,
one of the things that we look at when we're assigning tasks is,
do I already have something in my company that can support it?
Now if you have Azure or Microsoft Office 365 then
you are actually using
an Azure Active Directory behind the scenes.
It's free for you. It's available for you. You can start today.
For implementing stuff, it's easy to get started.
It takes a few lines of code.
We have the appropriate libraries for you.
It's very straightforward, there's
a certain pattern that we follow when it comes
to adding authentication or authorization no matter what language.
Therefore, if you're using Visual Studio or Visual Studio code
or Node.net Java we will support you along the way.
But the most important bit,
the one I'm really excited about is the out of
the box advanced security capabilities, MFA.
Your IT admin has just flick a suite inside
your Azure AD portal and suddenly
all the users now are forced to
go through multi-factor authentication.
You as a developer don't have to implement anything there.
The mark for authentication library will do it for you.
Then I talked about conditional access.
How would you code conditional access to your application?
Like I don't want specific IPs to be able
to access my application on certain times of
the day or I don't want to onset and geographic regions or
GPS capabilities on your mobile devices.
These are all available to you for free as a developer so again,
you don't have to worry about coding the stuff and that's
very important when it comes to moving quickly with Identity.
Now when it comes to implementing
authentication and authorization with a much identity platform,
there are two things that you need to do.
One is to go into
Azure Active Directory and create an app registration.
This is very similar to things that you would do in the past with
Facebook and Google if you want to authenticate with them.
You need to create an app registration that shows the intent.
You can do that through the portal as we will do today or you
can make it more
complex and scripted so you can use much of graph,
you can use PowerShell.
Therefore, that can be part of your CICD if you
want to automate the app or provision it.
>> Can you register an app that's so that you can later revoke it?
That's a way you can tell it.
This is the app is trying to use identity.
>> Exactly. Yeah, you create
a one-to-one kind of an association where you say,
my mobile app will be authenticating
against Azure Active Directory. I'm showing the intent.
If it's a web app and you
usually create a separate operative decision.
You can have this one-to-one relationship.
In there, you define what the permissions will be for the users.
Like I'm going to authenticate and I also want to get
some access tokens for calling
other services further down the line.
This is fairly simple.
Sometimes developers do that,
sometimes IT admins do that because not
every developer has access to the production tenants.
Then once you do that,
the first part is that.
The second part is just adding a little bit of code.
Now, we do provide you with libraries out of the box.
Then Microsoft Authentication Library,
MSAL for most of the major languages.
In fact, we've just released there the nodes MSAL,
the official package that is now supporting Node end to end.
If you're creating web services or even electron apps,
you can use the Node MSAL library and we're working on things like
React and Angular to make it more
inducing chromatic for developers to build these.
However, since we're operating on top of
open standards like OpenID Connect,
any library that supports that protocol can actually be used.
You can bring your own libraries if you want to. That's it.
When it comes to account,
sometimes you might have to call an API.
At that point, you might need to go back to
the Azure Active Directory and say,
not only do I need to authenticate my users but I also want
to access some APIs like Graph or My Storage,
or some custom APIs that I have
built internally and I want to secure them end to end.
>> It's really significant that you can use your own libraries.
This is built on standards.
It's not a big opaque box.
>> Exactly. It's not a black box.
As long as it's built on top of the OpenID,
Connect in OAuth 2.0 standards then it can be used with us.
We have very well published endpoints
that anybody can use and hit.
When it comes to managing identities again there are
two major decisions they have to make at the rate
or one decision for two different types.
One is the work and school accounts.
I am creating a line of business application for
my enterprise and I want my internal users to come and sign in.
That's Azure Active Directory for you.
On the other side is I'm creating an application for the Internet.
I'm creating a forum for my buddies to
manage their Minecraft scores
or I'm creating a mobile app and I need to sign in users
or I'm Walmart and I want people to come and sign in,
sign up and buy my stuff.
That is where Azure Active Directory B2C comes to play.
There is a username and password database,
more or less. You start with that.
Then you can also bring social
media accounts and you can extend it,
you can add any OpenID Connect provider.
The other day we build something with tweets where
we're using tweets to authenticate people into our solution.
They sign in with their Twitch account,
they don't have to get a new account.
They can benefit from all the data that comes
from Twitch as well, it's fully extensible.
Then I've already talked about ANC standards.
I'm not going to cover that again.
But the fact that we support
these and we even go all the way back to
SAML because some people still like
SAML means that we're fully backwards compatible.
Now, one thing I want to clarify is that much of
that in the platform extends beyond
just the usernames and passwords.
All these tools, all these platforms are supported.
We don't really care where you run or what
you running. We will support you.
However, if you are in
the Microsoft platform or if you are on the Microsoft ecosystem,
there's a lot of goodness that comes with it minus identities.
Collaboration between the Power Platform
and your Visual Studio and
your services all tie together and
secured with the Microsoft identity platform.
I would urge you to have a look at that.
If you are running on Azure then it's
a fantastic tool to allow you to secure your applications.
I want to jump into a demo now because we've been talking a lot
about how easy it is to get started and
how we can help developers be successful.
Let's see that in action.
Here I'm going to create a brand new.NET Web
application.net new web app.
Then we'll say name Azure Friday of course.
Then we will say dash off.
Many will be single.
With this command, what we're doing
is we're getting a brand new web app
that will also use Azure Active Directory for authentication.
Let's jump into the code.
You'll open this in visual code,
let's change the directory firstly Azure Fridays.
Then opening code by code dots.
Here we have plain standard vanilla razor webpages.
>> You can hit Control Minus.
>> Yeah. As you can see,
the authentication here is on line 3233.
We can close this one so we don't see it.
In effect, it's literally one line
of code to other authentication.
You might say, well, extensive two lines of code.
We can actually change it to one line of code by doing services.
AddMicrosoftIdentityWebAppAuthentication,
pass the configuration, and that's it.
There's two libraries that support
this authentication out of the box,
the Microsoft Identity Web and Web.UI.
The first one is for the middleware,
and the other one is for actually pointing you to a
sign-in and sign-out pages when you navigate to that.
There are a couple of settings I will need to set.
Let's go and actually create the App registration in Azure AD.
We talked about the App registrations
here if you come into your Azure Active Directory,
scroll down to your App registrations.
Keep the new registration,
will say AzureFriday, obviously, my knot.
Then we'll leave this as they are.
I'm going to click Register.
That's us showing our intent.
Then we need to say what kind of authentication do
we want or what kind of platform we're using.
Here we're going to add the platform.
It's an ASP.Net application.
It's a web app,
as you can see, there's Desktop,
there's mobile, there's single-page apps.
Since we're running on.Net,
it's https://localhost5001 for our Castro
and then sign-in oidc.
You might wonder where
that information came from, the sign-in oidc.
If we jump back to the code,
the callback path is sign in oidc.
You can change that if you want to,
as long as the configuration and your operating session match.
With that, let's save this.
We're using implicit flow. It's fine.
That's all we need to do.
Here now we'll go back into our overview.
We need to grab our application ID and put it here.
Client ID, application ID are interchangeably used.
We need to grab our tenant ID or the directory ID.
Let's put it down here.
We need to change the domain.
You see it's a placeholder here
so that'll be cmaskats.OnMicrosoft.com.
If you're wondering where did that information is coming from,
then it's all over your Azure Active Directory.
It's here, cmatskas.OnMicrosoft.com, so in the overview pane.
We talked about the endpoints and the well-known configuration.
If you come into your application,
once it loads, I'm going to close this.
AzureFriday.
Endpoints up here.
You can see these are all the endpoints for this Tenant.
Now, we have everything we need to run the application.
Let me make sure that we save this one,
please always save, otherwise it won't work.
We're good, comments negation, okay, now.Net run.
Building and it's running.
Let's navigate to that.
The first thing that it will do is ask us to authenticates.
There you have it. I'm going to sign in with
my account for this tenant.
It will prompt me to consent
and accepted that it needs to read my profile,
which is standard. Lo and behold.
One line of code four configuration settings
and you're good to go now.
Simple as that. It doesn't look more than that.
That used which standard of the ones that we talked about.
Right now we're using the OpenID Connect because we're
only using that information designing the users.
I haven't tapped into [inaudible] to grab any access tokens,
but if I were to call an API or Graph,
then I would be doing that.
>> Then we saw that when it said App Info,
the name of the app was AzureFriday,
which is this app.
It's the app that you
registered that we talked about at
the beginning of the conversation.
If that app became a compromise,
you could revoke access to the entire app.
You could revoke access from the organization you have all,
it can revoke access to a specific user.
All of those kinds of things that you don't want to have to do.
You'd have to write any code for that.
That's just exactly what are the process.
>> You delete the app registration or you
delete any sequence that you might have used in
some of the access to that information has been revoked.
>> Then you used a razor page,
you use.net and C Sharp.
You could have used Ruby and Rails,
you could use whatever and use
their libraries and you'd be talking to
an endpoint using a well-known standard protocol.
>> Exactly available for any language and any platform.
>> Wow. Okay, so where can people go to learn more about this?
>> I would say the best place to go,
is to go the docs,
we have information about how to get started.
We have an overview of the platform and we have
examples about single-page apps, web apps.
It can take you through the steps and how to set things up.
It has tutorials and quickstarts and
everything is actually on GitHub.
You can also go there and look at the code
and how we implemented things.
>> I see even Android and iOS and Windows as well.
>> Yes, Katlyn, Objective-C, Swift, everything.
>> All right, fantastic.
I'm learning all about this introduction to
the Microsoft Identity platform for
developers today on AzureFriday.
>> Hey, thanks for watching this episode of AzureFriday.
Now I need you to like it.
Comment on it, tell your friends, retweet it,
watch more AzureFriday.
[MUSIC]