Does Microsoft.Owin.Security.ActiveDirectory support Microsoft identity platform (v2.0)?

[darkato42]

I couldn't find any tutorials using Azure AD v2.0 endpoints to secure AspNet.MVC web APIs. Most of the samples are now in dotnet core using different middlewares.

The below code configuration only works when the application's manifest is set to "accessTokenAcceptedVersion": 1,. Is WindowsAzureActiveDirectoryBearerAuthenticationOptions configurable to use v2.0 endpoints?

app.UseWindowsAzureActiveDirectoryBearerAuthentication(
    new WindowsAzureActiveDirectoryBearerAuthenticationOptions
    {
        Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
        TokenValidationParameters = new TokenValidationParameters
        {
            ValidAudience = ConfigurationManager.AppSettings["ida:Audience"],
            RoleClaimType = "roles",
            //IssuerValidator = AadIssuerValidator.ValidateAadIssuer
    }

});

[Tratcher]

It should be possible but you may have to go down a layer to the Bearer middleware and wire things up manually. @jmprieur Any current samples for Microsoft.Owin and AzureAd v2?

[jmprieur]

@Tratcher @JimmyWuMadchester There is an ASP.NET (not core) sample here: https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect.

See, in particular:

https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/blob/master/WebApp/App_Start/Startup.Auth.cs

[Tratcher]

That looks like an interactive flow. How about a JWT Bearer sample?

[jmprieur]

oh yes, sorry, I was too quick @Tratcher we have this sample: https://github.com/Azure-Samples/ms-identity-aspnet-webapi-onbehalfof

[Tratcher]

Warmer. That's still using the v1 endpoints, correct? https://github.com/Azure-Samples/ms-identity-aspnet-webapi-onbehalfof/blob/master/TodoListService/App_Start/Startup.Auth.cs https://github.com/aspnet/AspNetKatana/blob/e2b18ec84ceab7ffa29d80d89429c9988ab40144/src/Microsoft.Owin.Security.ActiveDirectory/WindowsAzureActiveDirectoryBearerAuthenticationExtensions.cs#L19

[jmprieur]

The token which is received is what it is.

The On behalf of flow uses the v2.0 endpoint: https://github.com/Azure-Samples/ms-identity-aspnet-webapi-onbehalfof/blob/1e5b6a2158a24794428b399bb1451cc4be47f73c/TodoListService/Controllers/TodoListController.cs#L132