Search code examples
asp.net-mvcazureauthenticationazure-active-directorysingle-sign-on

How to configure Azure AD authentication for an on-premise web app

i need help to configure the Azure AD authentication for an existing on-premise web application (ASP.NET MVC). Each client has its own installation (own database and own server).

What we want to do:

  • give the possibility to use the Microsoft account to login to application (many clients manage company accounts with Microsoft Azure AD)
  • minimize customer configuration

Our idea is to proceed in this way:

  1. register a multi-tenant application in our Azure AD enabled to support all account types (organizations and privates)
  2. use these parameters to connect the web app:

Expected result:

  • clients can login with their own Microsoft account: the AAD application support all account types
  • after credentials validation, Azure creates a service principal to the client Azure with all the rules neeeded to read the user info
  • no security problems: the AAD application is in our Azure but the security principal lives in the client Azure (each on-premise web app installation creates a security principal, if used)

Questions:

  • Is the right way to proceed?
  • How can we configure the redirect url parameter? We need to redirect the user to the home page of the web app but the url is different for each installation.
Solution

  • Yes, you are right. To support all Account types, create an Azure AD Multi-Tenant Application like below:

    enter image description here

    To read the user information, grant the API permission:

    enter image description here

    How can we configure the redirect url parameter? We need to redirect the user to the home page of the web app but the url is different for each installation.

    You can set Dynamic redirect URL in Azure AD but it doesn't support the Application registered as Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts. Refer Microsoft Q&A by AmanpreetSingh-MSFT and this MSDoc.

    Hence, you can add multiple static redirect URIs in the Authentication tab like below:

    enter image description here

    To authenticate the users, you can make use of below authorize endpoint:

    https://login.microsoftonline.com/common/oauth2/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms 
&response_mode=query
&scope=https://graph.microsoft.com/User.Read
&state=12345

    enter image description here

    Once, the other tenant user consents, the auth-code will be generated like below:

    enter image description here

    Now, this MultiTenantApp will be registered as Service Principal in the user's tenant:

    enter image description here

    I generated the access token by using below parameters via Postman:

    https://login.microsoftonline.com/common/oauth2/v2.0/token

client_id:ClientID
grant_type:authorization_code
scope:https://graph.microsoft.com/User.Read
code:code
redirect_uri:https://jwt.ms
client_secret:ClientSecret

    enter image description here

    By using the above access token, one can able to fetch the signed in user details:

    https://graph.microsoft.com/v1.0/me

    enter image description here