aad-app-registrations.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Prerequisites\r\n",
    "\r\n",
    "To run this .NET Interactive run book, you need a create an AppRegistration in Azure AD with the following settings\r\n",
    "- Authentication -> Platform: Mobile and Desktop\r\n",
    "- Authentication -> Platform -> RedirectUris: Msal...\r\n",
    "- Authentication -> Supported Account Types: Single Tenant\r\n",
    "- Authentication -> Advanced Settings -> Allow public client flows: True\r\n",
    "- Press **Save**\r\n",
    "\r\n",
    "- API Permissions -> Add a Permission -> Delegated Permisions -> MS Graph: `Application.ReadWrite.All`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We start by importing the necessary NuGet packages to be used throughout this runbook"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "dotnet_interactive": {
     "language": "csharp"
    }
   },
   "outputs": [],
   "source": [
    "#r \"nuget:Microsoft.Graph,3.32.0\"\r\n",
    "#r \"nuget:Microsoft.Identity.Client,4.31.0\"\r\n",
    "#r \"nuget:Microsoft.Graph.Auth,1.0.0-preview.7\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Create the MSAL Client\r\n",
    "Ensure that you add the appropriate `usings` so that we can interact with Graph and AAD.\r\n",
    "\r\n",
    "Instantiate the MSAL Client to authenticate against AAD and get the right Graph Permissions.\r\n",
    "The MSAL Client requires the 2 following properties:\r\n",
    "- `ClientID` (From the Overview tab of your AAD App Registration)\r\n",
    "- `TenantID` (From the Overview tab. Can be the tenant id [Guid] or the tenant name)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "dotnet_interactive": {
     "language": "csharp"
    }
   },
   "outputs": [],
   "source": [
    "using Microsoft.Identity.Client;\r\n",
    "using System.Threading.Tasks;\r\n",
    "using Microsoft.Graph.Auth;\r\n",
    "\r\n",
    "public static DeviceCodeProvider GetMsalClient()\r\n",
    "{\r\n",
    "    var clientId = \"<the client id>\";\r\n",
    "    var tenantId = \"<the tenant id>\";\r\n",
    "    \r\n",
    "    IPublicClientApplication publicClientApplication = PublicClientApplicationBuilder\r\n",
    "        .Create(clientId)\r\n",
    "        .WithTenantId(tenantId)\r\n",
    "        .Build();\r\n",
    "    var scopes = new string[]{\"Application.ReadWrite.All\", \"User.Read\"};\r\n",
    "    return new DeviceCodeProvider(publicClientApplication, scopes);\r\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Create an API App Registration in Azure AD\r\n",
    "\r\n",
    "Right now the scope is hardcoded to `access_as_user`. Feel free to change this to meet your needs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "dotnet_interactive": {
     "language": "csharp"
    }
   },
   "outputs": [],
   "source": [
    "using Microsoft.Graph;\r\n",
    "\r\n",
    "var apiAppName = \"Minimal API Demo\";\r\n",
    "\r\n",
    "var graphClient = new GraphServiceClient(GetMsalClient());\r\n",
    "var apiApp = GetApiApplication(apiAppName);\r\n",
    "\r\n",
    "var apiAppRegistration = await graphClient.Applications\r\n",
    "                            .Request()\r\n",
    "                            .AddAsync(apiApp);\r\n",
    "                            \r\n",
    "Console.WriteLine($\"Client Id: {apiAppRegistration.AppId}\");\r\n",
    "Console.WriteLine($\"Domain: {apiAppRegistration.PublisherDomain}\");\r\n",
    "Console.WriteLine($\"Tenant Id: {await GetTenantId()}\");\r\n",
    "                            \r\n",
    "private async Task<string> GetTenantId()\r\n",
    "{\r\n",
    "    var organization = await graphClient.Organization\r\n",
    "                                .Request()\r\n",
    "                                .GetAsync();\r\n",
    "    return organization.FirstOrDefault().Id;\r\n",
    "}\r\n",
    "\r\n",
    "private static Application GetApiApplication(string displayName) => new Application\r\n",
    "{\r\n",
    "    DisplayName = displayName,\r\n",
    "    IdentifierUris = new List<String>()\r\n",
    "    {\r\n",
    "        $\"api://{Guid.NewGuid().ToString()}\"\r\n",
    "    },\r\n",
    "    Api = new ApiApplication\r\n",
    "    {\r\n",
    "        AcceptMappedClaims = null,\r\n",
    "        KnownClientApplications = new List<Guid>()\r\n",
    "        {\r\n",
    "        },\r\n",
    "        RequestedAccessTokenVersion = 2,\r\n",
    "        Oauth2PermissionScopes = new List<PermissionScope>()\r\n",
    "        {\r\n",
    "            new PermissionScope\r\n",
    "            {\r\n",
    "                Id = Guid.NewGuid(),\r\n",
    "                AdminConsentDescription = \"access the app as a user\",\r\n",
    "                AdminConsentDisplayName = \"access the app as a user\",\r\n",
    "                IsEnabled = true,\r\n",
    "                Type = \"User\",\r\n",
    "                UserConsentDescription = \"access the app as a user\",\r\n",
    "                UserConsentDisplayName = \"access the app as a user\",\r\n",
    "                Value = \"access_as_user\"\r\n",
    "            }\r\n",
    "        },\r\n",
    "        PreAuthorizedApplications = new List<PreAuthorizedApplication>()\r\n",
    "        {\r\n",
    "        }\r\n",
    "    }\r\n",
    "};"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Create a client secret for the API\r\n",
    "The following code, will create a client secret that the API will use to authenticate\r\n",
    "itself to Azure AD. Make sure to copy the value into your MSAL configuration.\r\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "dotnet_interactive": {
     "language": "csharp"
    }
   },
   "outputs": [],
   "source": [
    "using Microsoft.Graph;\r\n",
    "\r\n",
    "var passwordCredential = new PasswordCredential\r\n",
    "{\r\n",
    "\tDisplayName = \"delete me\"\r\n",
    "};\r\n",
    "\r\n",
    "var credential = await graphClient.Applications[$\"{apiAppRegistration.Id}\"]\r\n",
    "\t.AddPassword(passwordCredential)\r\n",
    "\t.Request()\r\n",
    "\t.PostAsync();\r\n",
    "\r\n",
    "Console.WriteLine($\"Client Secret: {credential.SecretText}\");"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Web App App Registration\r\n",
    "Create a client App Registration for a server-side **web app** (.NET, Node, Java etc).\r\n",
    "\r\n",
    "Users signing in to the client app, will be able to request an access token for the API ().\r\n",
    "You'll need to set the following two properties before running this script:\r\n",
    "- `clientAppName` -> the name for your App Registration\r\n",
    "- `redirectUri` -> the URI where your app expects the returned tokens. For .NET web apps, \r\n",
    "it's usually `https://localhost:5001/signin-oidc`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "dotnet_interactive": {
     "language": "csharp"
    }
   },
   "outputs": [],
   "source": [
    "using Microsoft.Graph;\r\n",
    "\r\n",
    "var clientAppName = \"Automation Demo Web Client\";\r\n",
    "var redirectUri = \"https://localhost:5001/signin-oidc\";\r\n",
    "\r\n",
    "var clientApp = GetClientApplication(\r\n",
    "    apiAppRegistration,\r\n",
    "    clientAppName,\r\n",
    "    redirectUri);\r\n",
    "\r\n",
    "var clientAppRegistration = await graphClient.Applications\r\n",
    "                                .Request()\r\n",
    "                                .AddAsync(clientApp);\r\n",
    "\r\n",
    "Console.WriteLine($\"Client Id: {clientAppRegistration.AppId}\");\r\n",
    "private static Application GetClientApplication(Application app,string displayName, string redirectUri) \r\n",
    "    => new Application\r\n",
    "{\r\n",
    "    DisplayName = displayName,\r\n",
    "    Web = new WebApplication\r\n",
    "    {\r\n",
    "        RedirectUris = new List<string>(){redirectUri}\r\n",
    "    },\r\n",
    "    RequiredResourceAccess = new List<RequiredResourceAccess>()\r\n",
    "    {\r\n",
    "        new RequiredResourceAccess\r\n",
    "        {\r\n",
    "            ResourceAppId = app.AppId,\r\n",
    "            ResourceAccess = new List<ResourceAccess>()\r\n",
    "            {\r\n",
    "                new ResourceAccess\r\n",
    "                {\r\n",
    "                    Id = app.Api.Oauth2PermissionScopes.FirstOrDefault().Id,\r\n",
    "                    Type = \"Scope\"\r\n",
    "                }\r\n",
    "            }\r\n",
    "        },\r\n",
    "        new RequiredResourceAccess\r\n",
    "        {\r\n",
    "            // OIDC - Graph scope (user.read)\r\n",
    "            ResourceAppId = \"00000003-0000-0000-c000-000000000000\",\r\n",
    "            ResourceAccess = new List<ResourceAccess>()\r\n",
    "            {\r\n",
    "                new ResourceAccess\r\n",
    "                {     \r\n",
    "                    Id = new Guid(\"e1fe6dd8ba314d6189e788639da4683d\"),\r\n",
    "                    Type = \"Scope\"\r\n",
    "                }\r\n",
    "            }\r\n",
    "        }\r\n",
    "    } \r\n",
    "};"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Add a Client Secret"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "dotnet_interactive": {
     "language": "csharp"
    }
   },
   "outputs": [],
   "source": [
    "using Microsoft.Graph;\r\n",
    "\r\n",
    "var passwordCredential = new PasswordCredential\r\n",
    "{\r\n",
    "\tDisplayName = \"delete me\"\r\n",
    "};\r\n",
    "\r\n",
    "var credential = await graphClient.Applications[$\"{clientAppRegistration.Id}\"]\r\n",
    "\t.AddPassword(passwordCredential)\r\n",
    "\t.Request()\r\n",
    "\t.PostAsync();\r\n",
    "\r\n",
    "Console.WriteLine($\"Client Secret: {credential.SecretText}\");"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": ".NET (C#)",
   "language": "C#",
   "name": ".net-csharp"
  },
  "language_info": {
   "file_extension": ".cs",
   "mimetype": "text/x-csharp",
   "name": "C#",
   "pygments_lexer": "csharp",
   "version": "9.0"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}