Azure Active Directory Authentication for .NET Core Services

Development, Security

If upgrading an existing application, the following are required from NuGet:

  • Microsoft.Identity.Web
  • Microsoft.Identity.Web.UI

Generating the Project

The project in this repository was generated from the ASP.NET Core Web App template. When generating the project, select ‘Microsoft identity platform’ as the Authentication type in the Additional Information section. HTTPS and Docker were also enabled for this project.

After installing dotnet msidentity tool, Visual Studio will display the Service Dependencies and Service References. In Service Dependencies, the Microsoft identity platform needs to be configured. Visual Studio will display the Microsoft identity platform window, with the current user’s account, the default tenant and a list of App Registrations. It might be necessary to click the refresh button to get a list of these.

The following information should enable the upgrade of an existing service to use Azure Active Directory Authentication.

Startup.cs

The following assembly references are added:

  • Microsoft.AspNetCore.Authentication
  • Microsoft.AspNetCore.Authentication.OpenIdConnect
  • Microsoft.AspNetCore.Authorization
  • Microsoft.AspNetCore.Mvc.Authorization
  • Microsoft.Identity.Web
  • Microsoft.Identity.Web.UI

Along with the following builder.Services sections:

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddAuthorization(options =>
{
    options.FallbackPolicy = options.DefaultPolicy;
});
builder.Services.AddRazorPages()
    .AddMicrosoftIdentityUI();

app.UseAuthentication();
app.UseAuthorization();

appsettings.json

The following section is added for the App Registrations entry:

"AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "[Domain]",
    "TenantId": "e5aafe7c-971b-4ab7-b039-141ad36acec0",
    "ClientId": "56bfc2f2-3c6d-4792-8293-df85cf9cac48",
    "CallbackPath": "/signin-oidc",
    "Scopes": "access_as_user",
    "SignedOutCallbackPath": "/signout-callback-oidc"
  }

It should be possible to just replace the ClientId and Scopes values, as required, after an App Registration is created by the Azure service administrator.

Properties/launchSettings.json

There don’t appear to be any changes in this file relevant to Azure AD authentication.

Properties/servicesDepencies.json

{
  "dependencies": {
    "identityapp1": {
      "type": "identityapp"
    },
    "secrets1": {
      "type": "secrets"
    }
  }
}

Connected Services

A reference to Microsoft identity platform is added under the Connected Services section. This can be edited at any point to add a new TenantId and/or ClientId.

Dependencies

Under the Depemdencies section there is the following:

  • Microsoft.AspNetCore.Authentication.JwtBearer
  • Microsoft.AspNetCore.Authentication.OpenIdConnect
  • Microsoft.Identity.Web
  • Microsoft.Identity.Web.UI

The above dependencies can be installed through the NuGet Package Manager.