Page Comparison

...

1. Add the EmpowerID.OwinPlugIn.V47.dll assembly reference to your MVC project and add the assembly level OwinStartupAttribute to the main web application project.

   Code Block
   [assembly: OwinStartupAttribute(typeof(MyAppOwin.Startup))]

2. In the Startup.Configuration method uses the AzDirectoryAuthentication.ConfigureAzureADAuth () method to configure the Azure AD authentication for the application. You may need to use the AntiForgeryConfig.UniqueClaimTypeIdentifier to identify the claim type for the user identity claim.

   Code Block

   public void Configuration(IAppBuilder app) { AntiForgeryConfig.UniqueClaimTypeIdentifier = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"; AzDirectoryAuthentication.ConfigureAzureADAuth(app, Startup.Config, null, delegate(Microsoft.Owin.IOwinContext context, IPrincipal principal) { //TODO: Claims transformation code goes here return new AuthenticationTicket((ClaimsIdentity) principal.Identity, new AuthenticationProperties()); }); }

3. In the Startup class, you can create a static property to return the AuthenticationConfig passed to the AzDirectoryAuthentication.ConfigureAzureADAuth() method. An instance of the AuthenticationConfig class provides the configuration settings for the target Azure AD.
   These are some important settings to configure:
   ▪️ ClientId: The Client ID or Application ID of the registered application in Azure AD.
   ▪️ ClientSecret: A client secret generated in the registered application in Azure AD.
   ▪️ Authority: The global Azure AD authentication endpoint.RedirectUri: The default landing URL of the application.

   Code Block
   public static AuthenticationConfig Config { get { return new AuthenticationConfig { ClientId = ConfigurationManager.AppSettings["ida:ClientId"], ClientSecret = ConfigurationManager.AppSettings["ida:ClientSecret"], RedirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"], Authority = ConfigurationManager.AppSettings["ida:Authority"], BasicScope = "openid profile offline_access", }; } }

   A sample of the configuration in the web config is shown below.

   Code Block
   <appSettings> <add key="ida:ClientId" value="ka05f2e5-e52d-446d-l49e-9ac1e9d492hf" /> <add key="ida:ClientSecret" value="Zju7Q~AFH2OulZ4Pnb_VVJQwnjfS-Tk1YGhvV" /> <add key="ida:Authority" value="https://login.microsoftonline.com/common/v2.0" /> <add key="ida:RedirectUri" value="https://localhost:44327/" /> </appSettings>

Insert excerpt
IL:External Stylesheet IL:External Stylesheet nopanel true

Step 2: Implement the Custom Claims Transformer

1. You implement claims transformation with the Owin Plugin using the delegate passed to the AzDirectoryAuthentication.ConfigureAzureADAuth() method. The delegate must return an instance of AuthenticationTicket with the current identity.

   Code Block
   delegate(Microsoft.Owin.IOwinContext context, IPrincipal principal) { //TODO: Claims transformation code goes here return new AuthenticationTicket((ClaimsIdentity) principal.Identity, new AuthenticationProperties()); });

2. Inside the delegate, you can add and remove Claims from the identity attached to the ClaimsPrincipal. Samples of adding, finding & removing claims are provided below

...

1. .

   Code Block
   var claim = new Claim("preferred_username", "michael@hotmail.com"); ((ClaimsIdentity)principal.Identity).AddClaim(claim);

   Code Block
   System.Security.Claims.Claim claim = System.Security.Claims.ClaimsPrincipal.Current.FindFirst("preferred_username"); (ClaimsIdentity)principal.Identity).RemoveClaim(claim);

Step 3: Implement the Login and Logout Actions

1. Add a using statement to include EmpowerID.OwinPlugIn.V47 DLL in the controller with login and logout actions for your application.

   Code Block
   using EmpowerID.OwinPlugIn.V47;

2. The MsalAppBuilder class contains extensions for the SignInUser() and SignOutUser(), which you can call in the controller for the login and logout actions. An example of the method implementation is shown below.

   Code Block
   [AllowAnonymous] public async Task Login() { await this.SignInUser(); } [HttpPost] [ValidateAntiForgeryToken] public async Task < ActionResult > LogOff() { await this.SignOutUser(Startup.Config); return RedirectToAction("Index", "Home"); }

Step 4: How to Implement Role-based Authorization

1. The [Authorize] attribute allows you to implement role-based authorization in your application. By default, Azure AD user App Roles assignments are included in the default set of claims issued by Azure AD. These App Roles can be used with the [Authorize] attribute.

   Code Block
   [Authorize] public class AccountController: Controller { public AccountController() {} }

2. To protect an action with roles, add the [AzAuthorize] attribute and specify the roles the action demands. You can redirect to the route by specifying the controller and action you wish to redirect if and when authorization fails.

   Code Block
   [AzAuthorize(Roles = "Task.Write", ErrorAction = "NotAuthorized" ErrorController = "Account")] public ActionResult Register() { return View(); }

3. If you wish to allow the application to throw an error with the Forbidden HTTP status code, set the EnableForbidden attribute parameter to true.

   Code Block
   [AzAuthorize(Roles = " Task.Read,Task.Write", EnableForbidden = true)] public ActionResult Register() { return View(); }

Configuring the Redirect URI in Azure

...