This post will show you how to authenticate for the client credentials flow in PowerShell with MSAL.Net using the .pfx file for the certificate authentication instead of loading the certificate from the certificate store. This post is in part based on this: Using PowerShell to Configure a signing certificate for a SAML-based SSO enterprise application Also, special thanks to my team members Bac Hoang and Will Fiddes for assisting with…
Read MoreWhat’s the security implication of changing the default client type from confidential to public in Azure AD?
From time to time, I get asked this question by a few different customers especially when they encounter the error “AADSTS7000218: The request body must contain the following parameter: ‘client_assertion’ or ‘client_secret’” when authenticating to Azure AD. The error is related to the following Default client type setting in the Authentication blade of a registered application: By default the setting is set to No (confidential client). Changing to ‘Yes’ converts…
Read MoreUsing PowerShell to configure a signing certificate for a SAML-based SSO Enterprise Application
In my last blog post I talked about how to use PowerShell to instantiate an MSAL Confidential Client Application to acquire an access token using Client Credentials Grant flow. In this post we will use PowerShell to instantiate an MSAL Public Client Application to perform an Authorization Code Grant flow to obtain a delegated permission Access Token for Microsoft Graph. We will then use that access token to call Microsoft…
Read MoreWhy /memberOf Microsoft Graph API returning null fields for some attributes.
What do below API calls do? https://graph.microsoft.com/v1.0/me/memberOf https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}/memberOf These API calls gives us the list of groups and directory roles that the user is a direct member of. API Call: GET JSON response: { “@odata.context”: “https://graph.microsoft.com/v1.0/$metadata#directoryObjects”, “value”: [ { “@odata.type”: “#microsoft.graph.group”, “id”: “b0a133d4-3f3d-4990-be22-879151155f19”, “deletedDateTime”: null, “classification”: null, “createdDateTime”: null, “creationOptions”: [], “description”: null, “displayName”: null, “expirationDateTime”: null, “groupTypes”: [], “isAssignableToRole”: null, “mail”: null, “mailEnabled”: null, “mailNickname”: null, “membershipRule”: null, “membershipRuleProcessingState”: null, } } What is the reason behind seeing null values? When we make a call…
Read MorePerforming Azure AD OAuth2 Authorization Code Grant flow with PKCE in PostMan
Proof Key for Code Exchange (PKCE) is a mechanism, typically used together with an OAuth2 Authorization Code Grant flow to provide an enhanced level of security when authenticating to an Identity Provider (IDP) to get an access token. In fact for Single Page Applications (SPA), Authorization Code Grant flow with PKCE is now the recommended OAuth2 authentication protocol over its predecessor, the Implicit Grant flow, for acquiring an access token.…
Read MoreUsing MSAL.Net to perform the client credentials flow with a certificate instead of a client secret in a .NetCore console appliction.
The sample files for this post can be found in this GitHub repository: https://github.com/RayGHeld/NetCore_ClientCredentials_withCert There is also a Powershell script there to create a certificate for this sample. You can perform the OAuth2 client_credentials grant flow to sign in as an application for your automated type of services. This flow does not require an interactive user to authenticate and should only be run in secure environments. There are 2 methods…
Read MoreWhere is all the Azure Active Directory for developers (v1.0) documentation?
Where is all the Azure Active Directory for developers (v1.0) documentation? Azure Active Directory (Azure AD) is a cloud identity service that allows developers to build apps that securely sign in users with a Microsoft work or school account. If you have been developing your apps using Azure Active Directory for developers (v1.0), typically ADAL, you might have noticed that it is getting harder to find related documentation. This is…
Read MoreReceiving Error “AADSTS900439 – USGClientNotSupportedOnPublicEndpoint”
Problem: This blog provides more information about the error “AADSTS900439 – USGClientNotSupportedOnPublicEndpoint”. This error typically occurs when a user uses a public cloud endpoint to sign in to an application registered in Azure Government sovereign cloud. It is known fact that the official Azure Active Directory (AAD) Authority for Azure Government changed from `https://login-us.microsoftonline.com` to `https://login.microsoftonline.us`. This change also applied to Microsoft 365 GCC High and DoD, which Azure Government…
Read MoreUsing PostMan to request an Azure AD token via SAML Assertion Grant flow
Azure Active Directory (Azure AD) supports an OAuth2 Extension Grant called “SAML Bearer Assertion flow” which allows an application to request an JWT OAuth2 token from Azure AD by providing a SAML Assertion (Token) acquired during an authentication process to a different Authorization Server. As you can imagine in order for this token exchange mechanism to happen, a trust relation between Azure AD and that Authorization Server must have already…
Read MoreConfigure .Net Application to call Microsoft Graph in a National Cloud Tenant
When authenticating with Azure and making a Microsoft Graph request, for commercial tenants, this is all done with the .com endpoints ( https://login.micorosoftonline.com/… and https://graph.microsoft.com ) and your token audience is for the .com endpoint as well. However, when performing the requests against a National Cloud tenant, you must use the appropriate endpoints. In this article, I will show you how to configure the Microsoft Graph .Net SDK in a…
Read More