Skip to content

Commit 64aa3a2

Browse files
kalyankrishna1kalyankrishna1
committed
minor edits
1 parent b767e6b commit 64aa3a2

File tree

3 files changed

+167
-192
lines changed

3 files changed

+167
-192
lines changed

‎5-AccessControl/2-call-api-groups/AppCreationScripts/Configure.ps1‎

Lines changed: 14 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -122,42 +122,6 @@ Function ReplaceInTextFile([string] $configFilePath, [System.Collections.HashTab
122122
Set-Content -Path $configFilePath -Value $lines -Force
123123
}
124124

125-
<#.Description
126-
This function creates a new Azure AD scope (OAuth2Permission) with default and provided values
127-
#>
128-
Function CreateScope( [string] $value, [string] $userConsentDisplayName, [string] $userConsentDescription, [string] $adminConsentDisplayName, [string] $adminConsentDescription)
129-
{
130-
$scope = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphPermissionScope
131-
$scope.Id = New-Guid
132-
$scope.Value = $value
133-
$scope.UserConsentDisplayName = $userConsentDisplayName
134-
$scope.UserConsentDescription = $userConsentDescription
135-
$scope.AdminConsentDisplayName = $adminConsentDisplayName
136-
$scope.AdminConsentDescription = $adminConsentDescription
137-
$scope.IsEnabled = $true
138-
$scope.Type = "User"
139-
return $scope
140-
}
141-
142-
<#.Description
143-
This function creates a new Azure AD AppRole with default and provided values
144-
#>
145-
Function CreateAppRole([string] $types, [string] $name, [string] $description)
146-
{
147-
$appRole = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphAppRole
148-
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
149-
$typesArr = $types.Split(',')
150-
foreach($type in $typesArr)
151-
{
152-
$appRole.AllowedMemberTypes += $type;
153-
}
154-
$appRole.DisplayName = $name
155-
$appRole.Id = New-Guid
156-
$appRole.IsEnabled = $true
157-
$appRole.Description = $description
158-
$appRole.Value = $name;
159-
return $appRole
160-
}
161125
<#.Description
162126
This function takes a string input as a single line, matches a key value and replaces with the replacement value
163127
#>
@@ -338,12 +302,14 @@ Function ConfigureApplications
338302
-SignInAudience AzureADMyOrg `
339303
-GroupMembershipClaims "SecurityGroup" `
340304
#end of command
305+
341306
#add a secret to the application
342307
$pwdCredential = Add-MgApplicationPassword -ApplicationId $clientAadApplication.Id -PasswordCredential $key
343308
$clientAppKey = $pwdCredential.SecretText
344309

345310
$clientIdentifierUri = 'api://'+$clientAadApplication.AppId
346311
Update-MgApplication -ApplicationId $clientAadApplication.Id -IdentifierUris @($clientIdentifierUri)
312+
347313

348314
# create the service principal of the newly created application
349315
$currentAppId = $clientAadApplication.AppId
@@ -368,10 +334,10 @@ Function ConfigureApplications
368334

369335
$newClaim = CreateOptionalClaim -name "groups"
370336
$optionalClaims.IdToken += ($newClaim)
371-
$newClaim = CreateOptionalClaim -name "groups"
372-
$optionalClaims.AccessToken += ($newClaim)
373-
$newClaim = CreateOptionalClaim -name "groups"
374-
$optionalClaims.Saml2Token += ($newClaim)
337+
# $newClaim = CreateOptionalClaim -name "groups"
338+
# $optionalClaims.AccessToken += ($newClaim)
339+
# $newClaim = CreateOptionalClaim -name "groups"
340+
# $optionalClaims.Saml2Token += ($newClaim)
375341

376342
# Add Optional Claims
377343

@@ -399,10 +365,10 @@ Function ConfigureApplications
399365

400366
$scopes = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphPermissionScope]
401367
$scope = CreateScope -value access_via_group_assignments `
402-
-userConsentDisplayName "Access 'msal-angular-app' as the signed-in user assigned to group memberships." `
403-
-userConsentDescription "Allow the app to access the 'msal-angular-app' on your behalf after assignment to one or more security groups." `
404-
-adminConsentDisplayName "Access 'msal-angular-app' as the signed-in user assigned to group memberships." `
405-
-adminConsentDescription "Allow the app to access the 'msal-angular-app' as a signed-in user assigned to one or more security groups."
368+
-userConsentDisplayName "Access 'msal-angular-app' as the signed-in user assigned to group memberships" `
369+
-userConsentDescription "Allow the app to access the 'msal-angular-app' on your behalf after assignment to one or more security groups" `
370+
-adminConsentDisplayName "Access 'msal-angular-app' as the signed-in user assigned to group memberships" `
371+
-adminConsentDescription "Allow the app to access the 'msal-angular-app' as a signed-in user assigned to one or more security groups"
406372

407373
$scopes.Add($scope)
408374

@@ -442,8 +408,7 @@ Function ConfigureApplications
442408
# $requiredResourcesAccess
443409

444410
Update-MgApplication -ApplicationId $clientAadApplication.Id -RequiredResourceAccess $requiredResourcesAccess
445-
Write-Host "Granted permissions."
446-
411+
Write-Host "Granted permissions."
447412

448413
# Create any security groups that this app requires.
449414

@@ -484,8 +449,9 @@ Function ConfigureApplications
484449
Write-Host "IMPORTANT: Please follow the instructions below to complete a few manual step(s) in the Azure portal":
485450
Write-Host "- For client"
486451
Write-Host " - Navigate to $clientPortalUrl"
487-
Write-Host " - This script has created a group named GroupAdmin for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it." -ForegroundColor Red
488-
Write-Host " - This script has created a group named GroupMember for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it." -ForegroundColor Red
452+
Write-Host " - This script has created a group named 'GroupAdmin' for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it." -ForegroundColor Red
453+
Write-Host " - This script has created a group named 'GroupMember' for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it." -ForegroundColor Red
454+
Write-Host " - Security groups matching the names you provided have been created in this tenant (if not present already). On Azure portal, assign some users to it, and configure ID & Access tokens to emit Group IDs" -ForegroundColor Red
489455
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
490456

491457
if($isOpenSSL -eq 'Y')

‎5-AccessControl/2-call-api-groups/AppCreationScripts/sample.json‎

Lines changed: 130 additions & 126 deletions
Original file line numberDiff line numberDiff line change
@@ -1,133 +1,137 @@
11
{
2-
"Sample": {
3-
"Title": "Angular single-page application calling a protected AspNet Core web API and using Security Groups to implement Role-Based Access Control",
4-
"Level": 300,
5-
"Client": "Angular SPA",
6-
"Service": ".NET Core web API",
7-
"RepositoryUrl": "ms-identity-javascript-angular-tutorial",
8-
"Endpoint": "AAD v2.0",
9-
"platform": "javascript",
10-
"Languages": [
11-
"typescript",
12-
"csharp",
13-
"javascript"
14-
],
15-
"Description": "Angular single-page application calling a protected AspNet web API and using Security Groups to implement Role-Based Access Control (RBAC)",
16-
"products": [
17-
"azure-active-directory",
18-
"ms-graph",
19-
"msal-js",
20-
"msal-angular",
21-
"microsoft-identity-web"
2+
"Sample": {
3+
"Title": "Angular single-page application calling a protected ASP.NET Core web API and using Security Groups to implement Role-Based Access Control",
4+
"Level": 300,
5+
"Client": "Angular SPA",
6+
"Service": ".NET Core web API",
7+
"RepositoryUrl": "ms-identity-javascript-angular-tutorial",
8+
"Endpoint": "AAD v2.0",
9+
"platform": "javascript",
10+
"Languages": [
11+
"typescript",
12+
"csharp",
13+
"javascript"
14+
],
15+
"Description": "An Angular single-page application calling a protected AspNet web API and using Security Groups to implement Role-Based Access Control (RBAC)",
16+
"products": [
17+
"azure-active-directory",
18+
"ms-graph",
19+
"msal-js",
20+
"msal-angular",
21+
"microsoft-identity-web"
22+
]
23+
},
24+
"AADApps": [
25+
{
26+
"Id": "client",
27+
"Name": "msal-angular-app",
28+
"Kind": "SinglePageApplication",
29+
"Audience": "AzureADMyOrg",
30+
"HomePage": "http://localhost:4200/",
31+
"ReplyUrls": "http://localhost:4200/, http://localhost:4200/auth",
32+
"GroupMembershipClaims": "SecurityGroup",
33+
"PasswordCredentials": "Auto",
34+
"Scopes": [
35+
"access_via_group_assignments"
36+
],
37+
"Sample": {
38+
"SampleSubPath": "5-AccessControl\\2-call-api-groups\\SPA",
39+
"ProjectDirectory": "\\2-call-api-groups\\SPA"
40+
},
41+
"SecurityGroups": [
42+
{
43+
"Name": "GroupAdmin",
44+
"Description": "Admin Security Group"
45+
},
46+
{
47+
"Name": "GroupMember",
48+
"Description": "User Security Group"
49+
}
50+
],
51+
"RequiredResourcesAccess": [
52+
{
53+
"Resource": "client",
54+
"DelegatedPermissions": [
55+
"access_via_group_assignments"
56+
]
57+
},
58+
{
59+
"Resource": "Microsoft Graph",
60+
"DelegatedPermissions": [
61+
"User.Read",
62+
"GroupMember.Read.All"
63+
]
64+
}
65+
],
66+
"OptionalClaims": {
67+
"IdTokenClaims": [
68+
"acct"
2269
]
23-
},
24-
"AADApps": [
25-
{
26-
"Id": "client",
27-
"Name": "msal-angular-app",
28-
"Kind": "SinglePageApplication",
29-
"Audience": "AzureADMyOrg",
30-
"HomePage": "http://localhost:4200/",
31-
"ReplyUrls": "http://localhost:4200/, http://localhost:4200/auth",
32-
"GroupMembershipClaims": "SecurityGroup",
33-
"PasswordCredentials": "Auto",
34-
"Scopes": [
35-
"access_via_group_assignments"
36-
],
37-
"Sample": {
38-
"SampleSubPath": "5-AccessControl\\2-call-api-groups\\SPA",
39-
"ProjectDirectory": "\\2-call-api-groups\\SPA"
40-
},
41-
"SecurityGroups": [
42-
{
43-
"Name": "GroupAdmin",
44-
"Description": "Admin Security Group"
45-
},
46-
{
47-
"Name": "GroupMember",
48-
"Description": "User Security Group"
49-
}
50-
],
51-
"RequiredResourcesAccess": [
52-
{
53-
"Resource": "client",
54-
"DelegatedPermissions": [
55-
"access_via_group_assignments"
56-
]
57-
},
58-
{
59-
"Resource": "Microsoft Graph",
60-
"DelegatedPermissions": [
61-
"User.Read",
62-
"GroupMember.Read.All"
63-
]
64-
}
65-
],
66-
"OptionalClaims": {
67-
"IdTokenClaims": [
68-
"acct"
69-
]
70-
},
71-
"ManualSteps": [
72-
{ "Comment": "This script has created a group named GroupAdmin for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it." },
73-
{ "Comment": "This script has created a group named GroupMember for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it." }
74-
]
70+
},
71+
"ManualSteps": [
72+
{
73+
"Comment": "This script has created a group named 'GroupAdmin' for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it."
74+
},
75+
{
76+
"Comment": "This script has created a group named 'GroupMember' for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it."
7577
}
76-
],
77-
"CodeConfiguration": [
78-
{
79-
"App": "client",
80-
"SettingKind": "Replace",
81-
"SettingFile": "\\..\\API\\TodoListAPI\\appsettings.json",
82-
"Mappings": [
83-
{
84-
"key": "Enter the ID of your Azure AD tenant copied from the Azure portal",
85-
"value": "$tenantId"
86-
},
87-
{
88-
"key": "Enter the application ID (clientId) of the 'TodoListAPI' application copied from the Azure portal",
89-
"value": "client.AppId"
90-
},
91-
{
92-
"key": "Enter the Client Secret of the 'TodoListAPI' application copied from the Azure portal",
93-
"value": "client.AppKey"
94-
},
95-
{
96-
"key": "Enter the object ID for GroupAdmin group copied from Azure Portal",
97-
"value": "$GroupAdmin.objectId"
98-
},
99-
{
100-
"key": "Enter the object ID for GroupMember group copied from Azure Portal",
101-
"value": "$GroupMember.objectId"
102-
}
103-
]
78+
]
79+
}
80+
],
81+
"CodeConfiguration": [
82+
{
83+
"App": "client",
84+
"SettingKind": "Replace",
85+
"SettingFile": "\\..\\API\\TodoListAPI\\appsettings.json",
86+
"Mappings": [
87+
{
88+
"key": "Enter the ID of your Azure AD tenant copied from the Azure portal",
89+
"value": "$tenantId"
90+
},
91+
{
92+
"key": "Enter the application ID (clientId) of the 'TodoListAPI' application copied from the Azure portal",
93+
"value": "client.AppId"
94+
},
95+
{
96+
"key": "Enter the Client Secret of the 'TodoListAPI' application copied from the Azure portal",
97+
"value": "client.AppKey"
98+
},
99+
{
100+
"key": "Enter the object ID for GroupAdmin group copied from Azure Portal",
101+
"value": "$GroupAdmin.Id"
104102
},
105103
{
106-
"App": "client",
107-
"SettingKind": "Replace",
108-
"SettingFile": "\\..\\SPA\\src\\app\\auth-config.ts",
109-
"Mappings": [
110-
{
111-
"key": "Enter_the_Application_Id_Here",
112-
"value": "client.AppId"
113-
},
114-
{
115-
"key": "Enter_the_Tenant_Info_Here",
116-
"value": "$tenantId"
117-
},
118-
{
119-
"key": "Enter_the_Web_Api_Application_Id_Here",
120-
"value": "client.AppId"
121-
},
122-
{
123-
"key": "Enter the object ID for GroupAdmin group copied from Azure Portal",
124-
"value": "$GroupAdmin.objectId"
125-
},
126-
{
127-
"key": "Enter the object ID for GroupMember group copied from Azure Portal",
128-
"value": "$GroupMember.objectId"
129-
}
130-
]
104+
"key": "Enter the object ID for GroupMember group copied from Azure Portal",
105+
"value": "$GroupMember.Id"
131106
}
132-
]
107+
]
108+
},
109+
{
110+
"App": "client",
111+
"SettingKind": "Replace",
112+
"SettingFile": "\\..\\SPA\\src\\app\\auth-config.ts",
113+
"Mappings": [
114+
{
115+
"key": "Enter_the_Application_Id_Here",
116+
"value": "client.AppId"
117+
},
118+
{
119+
"key": "Enter_the_Tenant_Info_Here",
120+
"value": "$tenantId"
121+
},
122+
{
123+
"key": "Enter_the_Web_Api_Application_Id_Here",
124+
"value": "client.AppId"
125+
},
126+
{
127+
"key": "Enter the object ID for GroupAdmin group copied from Azure Portal",
128+
"value": "$GroupAdmin.Id"
129+
},
130+
{
131+
"key": "Enter the object ID for GroupMember group copied from Azure Portal",
132+
"value": "$GroupMember.Id"
133+
}
134+
]
135+
}
136+
]
133137
}

0 commit comments

Comments
 (0)