Adding Support for Azure AD Login (O365) to MVC Apps
I spent the day toying around with ASP.NET MVC 5 web applications and authentication. I won’t cover the step-by-step as there are plenty of blogs that have it covered.
It seems that online, most examples and tutorials show you either how to use your organizational Azure AD account or social identity providers but not both.
I wanted to be able to log in using Facebook, Google, and/or the organizational account I use to connect to Office 365.
This requires that you select Individual User Accounts when prompted to change the authentication mode (whereas most tutorials have you select “Organization Accounts”):
This will give you the baseline needed to add the social login providers (more on that later).
To enable Windows Azure AD, you will need to first login into Azure and add an application to your default AD domain. In the management portal:
- Click on ACTIVE DIRECTORY in the left nav
- Click the directory
- Click the APPLICATIONS link at the top
- Now at the bottom, click ADD to add a new application
- Select Add an application my organization is developing
- Enter an arbitrary name and click next
- Now in the App properties screen, you will need to enter your login URL (e.g. https://localhost:4465/Account/Login) and for the APP ID URI, you cannot use “localhost”. You should use your Azure account info like: https://myazure.onmicrosoft.com/MyApp. The “MyApp” part is arbitrary, but the bolded text must match your directory identifier.
Most importantly, once you’ve created it, you need to click on the CONFIGURE link at the top and turn on the setting APPLICATION IS MULTI-TENANT:
If you fail to turn this on, the logins are limited to the users that are in your Azure AD instance only; you will not be able to log on with accounts you use to connect to Office 365. You’ll get an error like this:
Error: AADSTS50020: User account ‘jdoe@myo365domain.com’ from external identity provider ‘https://sts.windows.net/1234567e-b123-4123-9112-912345678e51/’ is not supported for application ‘2123456f-b123-4123-9123-4123456789e5′. The account needs to be added as an external user in the tenant. Please sign out and sign in again with an Azure Active Directory user account.
An important note is that if you used “localhost” in step 7, the UI will not allow you to save the settings with an error “The App ID URI is not available. The App ID URI must be from a verified domain within your organization’s directory.”
Once you’ve enabled this, we’re ready to make the code changes required.
First, you will need to install the OpenId package from nuget using the following command:
|
1 |
install-package microsoft.owin.security.openidconnect |
Next, in the default Startup.Auth.cs file generated by the project template, you will need to add some additional code.
First, add this line:
|
1 |
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType); |
Then, add this:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions { ClientId = "138C1130-4B29-4101-9C84-D8E0D34D222A", Authority = "https://login.windows.net/common", PostLogoutRedirectUri = "https://localhost:44301/", Description = new AuthenticationDescription { AuthenticationType = "OpenIdConnect", Caption = "Azure OpenId Connect" }, TokenValidationParameters = new TokenValidationParameters { // If you don't add this, you get IDX10205 ValidateIssuer = false } }); |
There are two very important notes. The first is that the Authority must have the /common path and not your Azure AD *.onmicrosoft.com path.
The second note is that you must add the TokenValidationParameters and set ValidateIssuer to false.
If you don’t set this to false, you’ll get the following 500 error after you successfully authenticate against Azure AD with your organizational O365 account:
IDX10205: Issuer validation failed. Issuer: ‘https://sts.windows.net/F92E09B4-DDD1-40A1-AE24-D51528361FEC/’. Did not match: validationParameters.ValidIssuer: ‘null’ or validationParameters.ValidIssuers: ‘https://sts.windows.net/{tenantid}/’
I think that this is a hack and to be honest, I’m not quite certain of the consequences of not validating the issuer, but it seems that there aren’t many answers on the web for this scenario yet. Looking at the source code where the exception originates, you’ll see the method that generates it:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 |
public static string ValidateIssuer(string issuer, SecurityToken securityToken, TokenValidationParameters validationParameters) { if (validationParameters == null) { throw new ArgumentNullException("validationParameters"); } if (!validationParameters.ValidateIssuer) { return issuer; } if (string.IsNullOrWhiteSpace(issuer)) { throw new SecurityTokenInvalidIssuerException(string.Format(CultureInfo.InvariantCulture, ErrorMessages.IDX10211)); } // Throw if all possible places to validate against are null or empty if (string.IsNullOrWhiteSpace(validationParameters.ValidIssuer) && (validationParameters.ValidIssuers == null)) { throw new SecurityTokenInvalidIssuerException(string.Format(CultureInfo.InvariantCulture, ErrorMessages.IDX10204)); } if (string.Equals(validationParameters.ValidIssuer, issuer, StringComparison.Ordinal)) { return issuer; } if (null != validationParameters.ValidIssuers) { foreach (string str in validationParameters.ValidIssuers) { if (string.Equals(str, issuer, StringComparison.Ordinal)) { return issuer; } } } throw new SecurityTokenInvalidIssuerException( string.Format(CultureInfo.InvariantCulture, ErrorMessages.IDX10205, issuer, validationParameters.ValidIssuer ?? "null", Utility.SerializeAsSingleCommaDelimitedString(validationParameters.ValidIssuers))); } |
We’re simply short circuiting the process. It’s clear that there is no matching issuer, but it’s not quite clear to me yet where/how to configure that.
So what about the other social IdP’s? It’s important to note that for Google, not only do you have to create a new client ID in the Google Developer Console, but you also need to enable the Google+ API:
You’ll just get a bunch of useless error messages if you don’t enable the API.
If you manage to get it all working, you should see the following options in the login screen:
And when you click it, you should be able to log in using the same organizational credentials that you use to connect to Office 365:
I am not using localhost for APP ID URI. I tried even Office 365 tenant URL for the APPID URI. It throws the same error – The App ID URI is not available. The App ID URI must be from a verified domain within your organization’s directory.