>> Hello, I'm Michael Mainer.
A software engineer on the Microsoft Graph team.
Today, I'm going to briefly talk about
Microsoft Graph and.NET Core,
and why this is an important scenario.
I'll go over the OAuth 2.0,
Client Credential Flow and
the scenarios where you might use it.
And then I'll go over a quick demo of
using Visual Studio 2017 for Mac to create
a client application that uses
the Client Credential Flow to get an
access token and make calls to the Microsoft Graph.
Microsoft Graph and.NET Core provide
another way to make cross platform solutions.
In addition to
our cross platform client libraries such as JavaScript,
Java and PHP, you can now create.NET
Microsoft Graph solutions that will run
on Windows, Mac, and Linux.
The cross platform opportunity
for.NET developers is supported
by tools that work across these platforms.
So, we have Visual Studio for Windows,
which you may already be familiar with,
Visual Studio 2017 for Mac,
and Visual Studio Code that will run
on Windows, Mac, and Linux.
You can create your Microsoft Graph.NET
solution on any of these three major platforms,
using tools on those platforms that can
target all three of these platforms.
These scenarios are web
and service, and client applications.
So now let's go and talk about
the Client Credential for Microsoft Graph.
So, before we go any further,
I'd like to talk about how in our demo,
that we are using Cloud Credential Flow as a way
to get a token for our client library.
So first off, the Client Credential Flow
use the identity of the application to access resources.
This enables server-to-server and service scenarios.
Basically, these are scenarios where
a user is not directly interacting with the application.
Permissions are granted to the application itself.
This is instead of the application being granted
permissions to access resources on behalf of the user.
So, an end user will never see the all familiar dialog,
because the end user is not actually making
the call, the application is.
And in order for the application to make
these calls and get the token,
a tenant admin must grant permissions.
The granted permissions are for
an application that will not be
controlled by any user but will be accessing user data.
The tenant admin will need to trust that
the application will behave as expected.
In our scenario, the admin will provide
the consent to the application.
I'm going to demo a simple Microsoft Graph application
that was created using Visual Studio 2017 for Mac.
We'll quickly demonstrate admin consent to give
the application access to Microsoft Graph resources.
We will briefly review the code and
then fill out the missing information.
More information about this code and how to run it
yourself will be provided in a link
to a repo later in this presentation.
This demo application was created
using Visual Studio 2017 for Mac,
and can be used in Visual Studio 2017 on Windows,
and Visual Studio Code on Windows, Mac, and Linux.
This solution has a single code file
it's a that.NET Core console application.
I'm using console application just for
demo purposes but this could easily be
a stand-alone service application running
on Windows, Mac, or Linux.
So, let's review the code.
This is a simple console app with the main.
Here we are on line 17,
getting a Graph service client object.
And here's where we run it,
where we're getting a collection of users.
And then what we're going to end up doing is,
writing out the information about the first user,
actually, the first user principle name.
So, let's look at how we are going to authenticate
this Graph service client
with the Client Credential OAuth flow.
So first off, we're going to need to get a client ID.
So, when you register your application,
you're going to get an application ID.
You're going to copy that information and paste it here.
Now that we have our client ID,
we'll put it in here.
Next, following the instructions
in the linked Github repo.
One of the steps we'll do is,
get a client secret or generate a password.
So, let's go get that password
that we generated previously.
Let's paste our password in.
Okay. So, we've gotten
information from our app registration,
the next thing we need to do is get
a hold of the tenant ID for our tenant.
Here's the tenant ID.
Information on how to get your tenant ID
will be provided in the link repo.
So now, we have our URL that we are going to use to
post our requests to
get access token for our application.
Now, let's go take a look at the post body.
Here, we are specifying
the Client Credentials Grant type.
And in the next line, on line 45,
we're specifying that we want to use
the scopes that were specified in the app registration.
So, we're not providing these scopes here ourselves,
we're just going to use the default ones
that we specified when we registered our app.
And on line 46, we can see that this is
our post body that we're going to be
using to request access token.
So, these are client ID, our Scopes,
our password, and our grant type.
So, let's create our Graph Client object.
So, in the authentication delegate,
we're going to create a request message
with the post verb
and the token URL that we created earlier,
and we'll also pass in our post body.
We're going to create a client and then send
our request message to get that access token.
In the response body,
we're going to get the access
token as part of a JSON object,
and then we're going to
inject it into our request message.
Every time a call is made to Microsoft Graph,
this code is going to run and inject a
token into the request,
so that we have an authenticated request every time.
But before we can run this code,
we need to authenticate.
We actually have to give admin consent
to this application to run.
So, let's do that next.
Okay. So, in order to authenticate,
to provide this application access
to the Microsoft Graph resources,
we need an admin to consent.
So here's the basic URL structure
for the Client Credential flow.
We have to specify the tenant ID,
then specify this as admin consents,
and then we specify the client ID here,
and the redirect URL that we got
from our app registration.
So, let's do this right now.
We'll sign in with
our administrator account and
then our administrator is going to
carefully read these permissions
and determine that they're going to accept it.
Now this is going to be a redirect 404,
and that's because we don't have
a web server right now at local host.
But we know this was a success
because in the redirect URL,
we have admin consent equals true.
So, now application is ready
to run and access the Microsoft Graph resources.
So let's do that now.
Now that we have
consented this application to
be able to access Microsoft Graph resources,
we can run this program.
And we're going to run it.
Just going to open up a terminal window
and specify a success.
The first user returned from Microsoft Graph is,
and here's the VPN of that first user.
So, now we have the basic set up to create
a headless Microsoft Graph application
that you can run on Windows, Mac, or Linux.
This sample shows how you can use
Visual Studio for Mac 2017 to create a
simple.NET Core 2.0 application
that uses the Microsoft Graph client library.
So, for more information you can go
to dev.microsoft.com/graph to get
information about samples, SDKs, and documentation.
You can go to github.com/microsoftgraph for
samples and all of
our client libraries for Microsoft Graph.
If you have questions about Microsoft Graph,
go to StackOverflow and use the Microsoft Graph tab.
For more information about
the demo sample in this presentation,
go to github.com?MichaelMainer/GraphNetCore2 and
you can download this repo
and run this code sample yourself.
Thank you very much for watching and have a great day.