Net6 Web Api Azure AD Authentication And Authorization With Azure Ad Groups

[@zia920]

amazing ! thank you very much i was struggling all these times with this Azure AD authentication and authorization, you made it really easy for me now

[@absolutedevelopment]

Thanks!

[@azureteachnet]

Thanks a lot for supporting the channel.

[@anoophn1001]

Thanks

[@azureteachnet]

Thank you for supporting the channel.

[@apoorvasd]

very simple and crisp explanation. thanks v much! really helpful

[@TellaTrix]

Wow, really helpful your all contents on KZbin

[@ulteriormotive]

Superb tutorial and explanation. Thanks so much for the insight!

[@azureteachnet]

Thanks for the feedback. please subscribe to the channel if you have not subscribed yet.

[@dupadhyay67]

Awesome content...that's really helps me... thanks again

[@azureteachnet]

Thanks for the feedback. Please subscribe to the channel if you have not subscribed yet.

[@piyalibasak6886]

thank you very much for this video..The content is really solid..appreciating you a lot.thanks once again

[@azureteachnet]

Thanks for the feedback. Please subscribe to the channel if you have not subscribed yet.

[@piyalibasak6886]

can you please add more videos on azure like event hub,event grid,logic app and also if you uplod a video about azure ad with full configuration after deploy in azure as web app..after deployment how to set up appsettings in azure portal..it will be highly appreciable if you explain the configuration settings after deployment

[@azureteachnet]

@@piyalibasak6886 sure. Even my plan is to make videos on scenarios based including basics. Will do eventually. Thanks a lot for your kind feedback.

[@Stefano-wu8fs]

Great content, really helpful, thanks!

[@azureteachnet]

Thanks for the feedback. Please subscribe to the channel if you have not subscribed yet. Thanks

[@arusuvaiunavu323]

Thank you very much for the valuable content. Unable to understand the reason you add user.read in the url and delegate permission to it. Please explain the reason.

[@KanokpitsunLertprommakul]

Nowadays, Seem like azure have updated about returning claims groups to the new format but thanks for this video.

[@azureteachnet]

May I know what have changed. Will post a new video. Thanks

[@KanokpitsunLertprommakul]

​@@azureteachnet MS Azure has changed some return claims about groups there is no "hasgroups" on 27:00 but just return all the group your code still work perfectly fine but I guess no need to verify "hasgroups" anymore

[@azureteachnet]

@@KanokpitsunLertprommakul Try adding some 100 groups to the user and see. I believe I have explained this in the video. If the user has so many groups and if the groups are added to the claims, the token size increases to the size beyond the http header limit. Then Azure will return hasgroups. Please give a try and let me know.

[@KanokpitsunLertprommakul]

@@azureteachnet I'll try thank you so much.

[@viksdeeps09]

Good explanation and helpful. Do you have a video how one can call the same using webapi instead of postman or swagger.

[@azureteachnet]

see if this helps. kzbin.info/www/bejne/oKfCp5xnfJuYfaM This is not as exact as you wanted, however, we are calling one api with post man and the first api is calling another api on behalf of user. So basically, .net code is calling the second api on behalf of user. Please let me know if this works for you. Thanks.

[@mahmoudkchaou-f9b]

I created an app on Power Apps and also created users on Azure. Now I need to integrate these users into my application by assigning them specific roles. can you help me please

[@bouzidiyakoub3430]

hello, thanks for this video, how to generate this token 14:08 in C# ?

[@azureteachnet]

Please subscribe to the channel if you have not subscribed yet. You can use ITokenAcquisation dependency in your class and use that to capture the token or you can use PublicClientApplication class too. There are many ways to capture the token. The channel already have multiple videos on this. you can refer -kzbin.info/www/bejne/qpfdiaZ9ZrZ2mKM . This video has one way to generate token.

[@bouzidiyakoub3430]

@@azureteachnet thank you very much for the answer, but I meant, how to generate the token using Auth URL, Client ID and Scope, to do the tests from a C# program and not Postman

[@azureteachnet]

@@bouzidiyakoub3430 I hope you have watched the video. In that "short" video, a C# console application is using ClientSecretCredential to access azure storage account. you can get the token from that class. Here is one more video. Accessing Graph API from .net application with delegated permissions. In this, we use ITokenAcquisation to access graph API - kzbin.info/www/bejne/nnOqhppnicaahqc

[@bouzidiyakoub3430]

@@azureteachnet yes I watched it, I understand better now, thank you very much

[@nagamallikaannapureddy9099]

please provide code to generate JWT token in client application instead of using postman

[@azureteachnet]

The channel already have multiple videos for the same. Today or tomorrow, I am going upload a video, which has the similar logic. i.e uses client id and secret to get the token. Thank you.

[@sharmavadali2966]

The Allow Admin Consent is disabled, because of which not able to run the application, any help is appreciated

[@azureteachnet]

Is your app showing user consent after login. If yes, user can login. Otherwise request admin to grant consent. If your app is an internal app, Having admin consent will not hamper. Please subscribe to the channel if you have not subscribed yet. Thanks

[@sharmavadali2966]

@@azureteachnet It is not showing user consent after login.

[@azureteachnet]

@@sharmavadali2966 Consent screen will be shown only once before login. Once you approve, it will not show consent screen unless you modify scopes on app registration. one more case is, If admin provides consent for default directory, it will not show.

Hello, friend, how can get name of groups asigned to my account in token???, thanks for your help, have a nice day

[@rudrapatisravani4328]

I am Getting users in Context as null.Anyone please help me on this?

[@shashankgonuguntla2618]

Hi, After adding I am getting access token and id token using angular 12 but I can see group claims only in id token where as I can't see group claims in access token. Can you help me from this.

[@azureteachnet]

Did you try configuring Claims in your app registration? Group claims are optional claims, you must explicitely configure in App registration.

[@mikemcwilliams6758]

This is a really good video as I'm attempting to get the groups. In your group claims, you are using the GroupID, what about using the sAMAccountName and "Emit groups as a role claims? I just think that there's too much working into getting something simple. (I now understand about the header restriction, thank you!) Also, the base controller suggestion (and common practice here at work), however, the application I'm creating has two auth aproviders -- and the base controller is deeply wired into one of our base controller. Without using graph, Windows Server AD based groups are the only ones appearing in the roles collection; meaning that (for instance), my account has two of them -- but I'm in several groups. Are you saying that the only way I can use groups is through the groupID rather than a group name? (if so, that seems entirely too laborious) Please advise.

[@MatheusAlmeidaC]

hi, i want to make a system that can only be accessed by certain AD groups to access the API you created in the video you need to enter the username and password through the login screen i want the microsoft login screen to only be needed on the frontend, so my backend only receives the jwt token and validates if it can access each route, is it possible to do that? do you have a video explaining this?

[@azureteachnet]

which front end you want to use? Angular , asp.net mvc or any other. Integrate frontend with Azure AD. It will show the Microsoft login screen. The chanel already have videos on integrating Azure AD and asp.net MVC, Angular with Azure AD.

[@Alex-jw6rs]

Please help me. Why if I add mail.read permission and try to get _graphService.Me.Messages, do I get "Message: Resource could not be detected"? I added mail.read and user.read to the scope and ApiPermissions