Authenticate .NET Core with Azure AD

[@bradleylund6563]

You are a legend! Thanks so much for the video, exactly what I was looking for :)

[@TimBurris]

Glad I could help!

[@milacayn921]

Thank you! this video is much easier to follow than other videos related to the same topic.

[@TimBurris]

Glad it was helpful!

[@CatMucius]

Thanks for the explanation, Tim! One note, though: adding users and groups to the list isn't enough to limit access to the app, you need also to go to the "Properties" tab of the Enterprise Application and enable the "Assignment required" option. Otherwise, all user accounts in the tenant can sign in. Had you used another user account of the same tenant for your negative test (instead of Microsoft account), you'd notice that it succeeds to sign in as well.

[@TimBurris]

Good point! thank you for the feedback!

[@JuanPabloRussi]

Thnaks, Bro! you are the best.

[@ShotMuse]

Great explanation, very helpful thanks.

[@TimBurris]

You are welcome, I'm glad you found it useful!

[@PratapSingh-op8hi]

Thank you! It is helpful.

[@mithunbobade1]

Great Video, Just a doubt, is it the same process for delegated permission?

[@user-nw8oi9vn9y]

Do I use the same nuget identity package if I want to allow multi tenant and MS accounts ?

[@norbertcsibi7720]

What happens if I want to get AAD b2b to be able to sign in? I assume I`d need a multi-tenant selected and do I need to do something extra for the X org to be able to sign in into my app?

[@arihadi2287]

Hi Tim, thanks for the great tutorial video. by the way, I try using your code in Program.cs but there's an error that says "No authenticationScheme was specified, and there was no DefaultChallengeScheme found.". I'm not sure why since we already define the authentication in AddAuthentication method. Did I miss something?

[@TimBurris]

Hopefully by now you have gotten past the scheme error. I pulled the code and tested again just now and I am not getting any error. Additionally, I don't recall running into that error anytime in the past. A quick google search yields a number of different causes, so it's hard to know which one you might have been encountering

[@aavishar]

THanks man

[@TimBurris]

You're welcome!

[@user-hk7st1sl4m]

Hey nice video, but can you tell how we can do the single sign on using azure.

[@TimBurris]

I must be misunderstanding the question. This demonstration is authenticating with Azure, can you elaborate on your question?

[@tagetget2148]

thank you for this video. Is it possible to return some claims from AzureAD using this method ?

[@TimBurris]

absolutely, you can have the Groups that the User is a member of automatically flow into Claims of type Role, or you can use custom logic to map them how you want. here is an example walk through damienbod.com/2021/02/01/implement-app-roles-authorization-with-azure-ad-and-asp-net-core/

[@RidaRamadan]

Hi Thank you for the video. Can you please explain how to hook up with our custom pages? I need to redirect to a checkpoint before redirecting to the main page. I need the get the user's email to get his ID from the Db. Can you please help with that?

[@TimBurris]

absolutely! the short answer is, in your .AddMicrosoftIdentityWebApp call, you can hook into an "OnTokenValidated" callback event. With that you'll have access to all the claims that Azure AD put in, including the email address. Using that email address lookup your user and then add your User ID as a claim so that you can access it during page requests. I just created a branch in the git repo that demonstrates exactly that. here is the branch: github.com/TimBurris/DemoAzureActiveDirectory/tree/local-database-user-lookup DISCLAIMER: I put all the code directly into Program.cs, but in the real world I always have OnTokenValidated invoke a custom class to do all the real work.

[@RidaRamadan]

@@TimBurris Thank you so much. Subscribed. :)

[@RidaRamadan]

@@TimBurris Hi. I applied the configurations and it seems to be ok. But how can I get the UserId from the db in program.cs. And can you please explain invoking a custom class from OnTokenValidated?

[@TimBurris]

to use a custom class, you could create an instance in the OnTokenValidated either by directly "newing it up" like: var service= new CustomClaimService() or using Dependency Injection: var service = ctx.HttpContext.RequestServices.GetService(); regardless how you construct, you would then just pass the TokenValidationContext like this: return service.AssignClaims(ctx); then, inside of you CustomClaimService you could make a database call or do anything you needed

[@hamedamin9324]

can you add a logout button in the next video please

[@aavishar]

Please create a video on using Microsoft authentication library with .net core api .

[@TimBurris]

That's a good idea, I'll see if can throw one together. in the next few weeks