Azure Authentication using OWIN with ASP.NET

The EmpowerID Owin Plugin for Azure is an in-process Open Web Interface for .NET (OWIN) component for enabling Azure AD authentication in legacy MVC-based .NET web applications. This Plugin for Azure is a set of classes in the EmpowerID.OwinPlugIn.V47.dll assembly that you reference and use to modernize your legacy MVC web application with Azure AD authentication and authorization.

Open

Typical process flow involving the Owin Plugin for the Azure component.

Step 1: Configure the Owin Plugin

1. Add the EmpowerID.OwinPlugIn.V47.dll assembly reference to your MVC project and add the assembly level OwinStartupAttribute to the main web application project.

   [assembly: OwinStartupAttribute(typeof(MyAppOwin.Startup))]

    

2. In the Startup.Configuration method uses the AzDirectoryAuthentication.ConfigureAzureADAuth () method to configure the Azure AD authentication for the application. You may need to use the AntiForgeryConfig.UniqueClaimTypeIdentifier to identify the claim type for the user identity claim.

   public void Configuration(IAppBuilder app) { AntiForgeryConfig.UniqueClaimTypeIdentifier = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"; AzDirectoryAuthentication.ConfigureAzureADAuth(app, Startup.Config, null, delegate(Microsoft.Owin.IOwinContext context, IPrincipal principal) { //TODO: Claims transformation code goes here return new AuthenticationTicket((ClaimsIdentity) principal.Identity, new AuthenticationProperties()); }); }

    

3. In the Startup class, you can create a static property to return the AuthenticationConfig passed to the AzDirectoryAuthentication.ConfigureAzureADAuth() method. An instance of the AuthenticationConfig class provides the configuration settings for the target Azure AD.
   These are some important settings to configure:
   ClientId: The Client ID or Application ID of the registered application in Azure AD.
   ClientSecret: A client secret generated in the registered application in Azure AD.
   Authority: The global Azure AD authentication endpoint.RedirectUri: The default landing URL of the application.

   public static AuthenticationConfig Config { get { return new AuthenticationConfig { ClientId = ConfigurationManager.AppSettings["ida:ClientId"], ClientSecret = ConfigurationManager.AppSettings["ida:ClientSecret"], RedirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"], Authority = ConfigurationManager.AppSettings["ida:Authority"], BasicScope = "openid profile offline_access", }; } }

    

   A sample of the configuration in the web config is shown below.

Step 2: Implement the Custom Claims Transformer

1. You implement claims transformation with the Owin Plugin using the delegate passed to the AzDirectoryAuthentication.ConfigureAzureADAuth() method. The delegate must return an instance of AuthenticationTicket with the current identity.

    

2. Inside the delegate, you can add and remove Claims from the identity attached to the ClaimsPrincipal. Samples of adding, finding & removing claims are provided below.

    

Step 3: Implement the Login and Logout Actions

1. Add a using statement to include EmpowerID.OwinPlugIn.V47 DLL in the controller with login and logout actions for your application.

    

2. The MsalAppBuilder class contains extensions for the SignInUser() and SignOutUser(), which you can call in the controller for the login and logout actions. An example of the method implementation is shown below.

Step 4: How to Implement Role-based Authorization

1. The [Authorize] attribute allows you to implement role-based authorization in your application. By default, Azure AD user App Roles assignments are included in the default set of claims issued by Azure AD. These App Roles can be used with the [Authorize] attribute.

    

2. To protect an action with roles, add the [AzAuthorize] attribute and specify the roles the action demands. You can redirect to the route by specifying the controller and action you wish to redirect if and when authorization fails.

    

3. If you wish to allow the application to throw an error with the Forbidden HTTP status code, set the EnableForbidden attribute parameter to true.

Configuring the Redirect URI in Azure

Add the Redirect URL to your application to the registered application in Azure.

Open