Skip to content

Commit 0ce3884

Browse files
author
derisen
committed
add optional claim to sample.json
1 parent 663d503 commit 0ce3884

File tree

2 files changed

+142
-110
lines changed

2 files changed

+142
-110
lines changed

‎3-Authorization-II/1-call-api/AppCreationScripts/Configure.ps1‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,19 @@ Function CreateAppRole([string] $types, [string] $name, [string] $description)
137137
$appRole.Value = $name;
138138
return $appRole
139139
}
140+
Function CreateOptionalClaim([string] $name)
141+
{
142+
<#.Description
143+
This function creates a new Azure AD optional claims with default and provided values
144+
#>
145+
146+
$appClaim = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaim
147+
$appClaim.AdditionalProperties = New-Object System.Collections.Generic.List[string]
148+
$appClaim.Source = $null
149+
$appClaim.Essential = $false
150+
$appClaim.Name = $name
151+
return $appClaim
152+
}
140153

141154

142155
Function ConfigureApplications
@@ -191,6 +204,20 @@ Function ConfigureApplications
191204
New-MgApplicationOwnerByRef -ApplicationId $serviceAadApplication.Id -BodyParameter = @{"@odata.id" = "htps://graph.microsoft.com/v1.0/directoryObjects/$user.ObjectId"}
192205
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($serviceServicePrincipal.DisplayName)'"
193206
}
207+
208+
# Add Claims
209+
210+
$optionalClaims = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaims
211+
$optionalClaims.AccessToken = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaim]
212+
$optionalClaims.IdToken = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaim]
213+
$optionalClaims.Saml2Token = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaim]
214+
215+
216+
# Add Optional Claims
217+
218+
$newClaim = CreateOptionalClaim -name "idtyp"
219+
$optionalClaims.AccessToken += ($newClaim)
220+
Update-MgApplication -ApplicationId $serviceAadApplication.Id -OptionalClaims $optionalClaims
194221

195222
# Add application Roles
196223
$appRoles = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphAppRole]

‎3-Authorization-II/1-call-api/AppCreationScripts/sample.json‎

Lines changed: 115 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -1,113 +1,118 @@
11
{
2-
"Sample": {
3-
"Author": "derisen",
4-
"Title": "An Angular SPA using MSAL Angular to sign-in users with Azure Active Directory and call a protected .NET Core web API",
5-
"Level": 200,
6-
"Client": "Angular SPA",
7-
"Service": ".NET Core web API",
8-
"RepositoryUrl": "ms-identity-javascript-angular-tutorial",
9-
"Endpoint": "AAD v2.0",
10-
"Languages": [
11-
"TypeScript",
12-
"C#"
13-
],
14-
"Description": "An Angular SPA using MSAL Angular to sign-in users with Azure Active Directory and call a protected .NET Core web API",
15-
"Products": [
16-
"Angular",
17-
"ASP.NET Core"
18-
]
19-
},
20-
"AADApps": [
21-
{
22-
"Id": "service",
23-
"Name": "msal-dotnet-api",
24-
"Kind": "WebApi",
25-
"Audience": "AzureADMyOrg",
26-
"Sample": {
27-
"SampleSubPath": "3-Authorization-II\\1-call-api\\API",
28-
"ProjectDirectory": "\\1-call-api\\API"
29-
},
30-
"Scopes": [
31-
"TodoList.Read",
32-
"TodoList.ReadWrite"
33-
],
34-
"AppRoles": [
35-
{
36-
"Types": [
37-
"Application"
38-
],
39-
"Name": "TodoList.Read.All",
40-
"Description": "Allow this application to read every users Todo list items"
41-
},
42-
{
43-
"Types": [
44-
"Application"
45-
],
46-
"Name": "TodoList.ReadWrite.All",
47-
"Description": "Allow this application to read and write every users Todo list items"
48-
}
49-
]
50-
},
51-
{
52-
"Id": "client",
53-
"Name": "msal-angular-spa",
54-
"Kind": "SinglePageApplication",
55-
"Audience": "AzureADMyOrg",
56-
"HomePage": "https://localhost:4200",
57-
"ReplyUrls": "http://localhost:4200",
58-
"Sample": {
59-
"SampleSubPath": "3-Authorization-II\\1-call-api\\SPA",
60-
"ProjectDirectory": "\\1-call-api\\SPA"
61-
},
62-
"RequiredResourcesAccess": [
63-
{
64-
"Resource": "service",
65-
"DelegatedPermissions": [
66-
"TodoList.Read",
67-
"TodoList.ReadWrite"
68-
]
69-
}
70-
]
71-
}
72-
],
73-
"CodeConfiguration": [
74-
{
75-
"App": "service",
76-
"SettingKind": "Replace",
77-
"SettingFile": "\\..\\API\\TodoListAPI\\appsettings.json",
78-
"Mappings": [
79-
{
80-
"key": "Enter the domain of your Azure AD tenant, e.g. 'contoso.onmicrosoft.com'",
81-
"value": "$tenantName"
2+
"Sample": {
3+
"Author": "derisen",
4+
"Title": "An Angular SPA using MSAL Angular to sign-in users with Azure Active Directory and call a protected .NET Core web API",
5+
"Level": 200,
6+
"Client": "Angular SPA",
7+
"Service": ".NET Core web API",
8+
"RepositoryUrl": "ms-identity-javascript-angular-tutorial",
9+
"Endpoint": "AAD v2.0",
10+
"Languages": [
11+
"TypeScript",
12+
"C#"
13+
],
14+
"Description": "An Angular SPA using MSAL Angular to sign-in users with Azure Active Directory and call a protected .NET Core web API",
15+
"Products": [
16+
"Angular",
17+
"ASP.NET Core"
18+
]
19+
},
20+
"AADApps": [
21+
{
22+
"Id": "service",
23+
"Name": "msal-dotnet-api",
24+
"Kind": "WebApi",
25+
"Audience": "AzureADMyOrg",
26+
"Sample": {
27+
"SampleSubPath": "3-Authorization-II\\1-call-api\\API",
28+
"ProjectDirectory": "\\1-call-api\\API"
8229
},
83-
{
84-
"key": "Enter the Client ID (aka 'Application ID')",
85-
"value": ".AppId"
86-
},
87-
{
88-
"key": "Enter the tenant ID",
89-
"value": "$tenantId"
30+
"Scopes": [
31+
"TodoList.Read",
32+
"TodoList.ReadWrite"
33+
],
34+
"AppRoles": [
35+
{
36+
"Types": [
37+
"Application"
38+
],
39+
"Name": "TodoList.Read.All",
40+
"Description": "Allow this application to read every users Todo list items"
41+
},
42+
{
43+
"Types": [
44+
"Application"
45+
],
46+
"Name": "TodoList.ReadWrite.All",
47+
"Description": "Allow this application to read and write every users Todo list items"
48+
}
49+
],
50+
"OptionalClaims": {
51+
"AccessTokenClaims": [
52+
"idtyp"
53+
]
9054
}
91-
]
92-
},
93-
{
94-
"App": "client",
95-
"SettingKind": "Replace",
96-
"SettingFile": "\\..\\SPA\\src\\app\\auth-config.ts",
97-
"Mappings": [
98-
{
99-
"key": "Enter_the_Application_Id_Here",
100-
"value": ".AppId"
101-
},
102-
{
103-
"key": "Enter_the_Tenant_Info_Here",
104-
"value": "$tenantId"
105-
},
106-
{
107-
"key": "Enter_the_Web_Api_Application_Id_Here",
108-
"value": "service.AppId"
109-
}
110-
]
111-
}
112-
]
113-
}
55+
},
56+
{
57+
"Id": "client",
58+
"Name": "msal-angular-spa",
59+
"Kind": "SinglePageApplication",
60+
"Audience": "AzureADMyOrg",
61+
"HomePage": "https://localhost:4200",
62+
"ReplyUrls": "http://localhost:4200",
63+
"Sample": {
64+
"SampleSubPath": "3-Authorization-II\\1-call-api\\SPA",
65+
"ProjectDirectory": "\\1-call-api\\SPA"
66+
},
67+
"RequiredResourcesAccess": [
68+
{
69+
"Resource": "service",
70+
"DelegatedPermissions": [
71+
"TodoList.Read",
72+
"TodoList.ReadWrite"
73+
]
74+
}
75+
]
76+
}
77+
],
78+
"CodeConfiguration": [
79+
{
80+
"App": "service",
81+
"SettingKind": "Replace",
82+
"SettingFile": "\\..\\API\\TodoListAPI\\appsettings.json",
83+
"Mappings": [
84+
{
85+
"key": "Enter the domain of your Azure AD tenant, e.g. 'contoso.onmicrosoft.com'",
86+
"value": "$tenantName"
87+
},
88+
{
89+
"key": "Enter the Client ID (aka 'Application ID')",
90+
"value": ".AppId"
91+
},
92+
{
93+
"key": "Enter the tenant ID",
94+
"value": "$tenantId"
95+
}
96+
]
97+
},
98+
{
99+
"App": "client",
100+
"SettingKind": "Replace",
101+
"SettingFile": "\\..\\SPA\\src\\app\\auth-config.ts",
102+
"Mappings": [
103+
{
104+
"key": "Enter_the_Application_Id_Here",
105+
"value": ".AppId"
106+
},
107+
{
108+
"key": "Enter_the_Tenant_Info_Here",
109+
"value": "$tenantId"
110+
},
111+
{
112+
"key": "Enter_the_Web_Api_Application_Id_Here",
113+
"value": "service.AppId"
114+
}
115+
]
116+
}
117+
]
118+
}

0 commit comments

Comments
 (0)