.Net Foundation On .NET, 22 Sep 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Service principles and app registration

Description

In this episode, Christos chats with Matthijs Hoekstra from the Identity team to get a better understanding of how Service principles and app registrations work in Azure AD

[01:50] - What is an Azure AD App?
[03:57] - Creating an Azure AD App
[07:16] - Brief overview of authentication
[10:55] - Authentication for Native APPS
[13:13] - What are Service Principals?
[17:58] - Add applications from the gallery
[20:40] - Secrets and certificates
[21:23] - Configuring security tokens
[25:38] - Query applications In Microsoft Graph

What is application management?
https://docs.microsoft.com/azure/active-directory/manage-apps/what-is-application-management?WT.mc_id=ondotnet-c9-cephilli

Add an application to your Azure Active Directory (Azure AD) tenant
https://docs.microsoft.com/azure/active-directory/manage-apps/add-application-portal?WT.mc_id=ondotnet-c9-cephilli

Application management best practices
https://docs.microsoft.com/azure/active-directory/manage-apps/application-management-fundamentals?WT.mc_id=ondotnet-c9-cephilli

#azure #security #ActiveDirectory #dotnet

A

Hey everyone on another episode of on.net, we have the the kickoff of the microsoft identity series, and today I have mathias extra with me today to talk about app registrations and service principles join.

A

A

Welcome to another show on on.net today I have mathias extra with me to talk about service principles and app registration. This is part of our series on identity for developers, microsoft, identity for developers and we're starting with some of the basics, because I think, having a good foundation around what opportunization service principles are is very important as you embark into your journey so mathias uh thanks for coming. How are you I'm good.

B

Thanks for having me it's, uh it's been a while I've seen you so.

A

It's been a while for everyone, it's been about five months since I had any human contact outside my family. So let's not go there.

B

So yeah thanks for having me, so we want to talk about today.

A

Well, I did say operation service principles because getting your head around it, it's always tricky like. When do we use what what is is which right? So what? What is an operation? How does a service principle hang behind that? If I'm creating an application, what should they care as a developer about and then um how we use them.

B

Yeah, it's it's a good topic um so um and it's a lot it's a it's a source of confusion as well. Right, I don't understand what the difference is between ad registration service principle. I know this enterprise app staying, so where do I do what and all that stuff? So um let me explain a bit of the how I like to think about these. These these topics and yeah feel free to ask me any any questions and we can dive into it. So I did have bring my simple powerpoint deck.

B

I've been using in the past just to get you an idea of what we are doing here so.

A

Love me some powerpoint. I know right so.

B

The first thing is that, since we are talking about oidc and all modern authentication with the microsoft identity platform, but it's the same concept for any identity platform you will use. Is you have to tell the system about your application? It has to know what kind of authentication experience it has to offer the users. So the first thing you have to do after you decide which idp you're going to use. So, let's assume as much as any platform, you have to tell the system about your application.

B

That's what we do when we start doing an application registration. It's.

A

B

Than telling the system about the existence of your app and how to tweet uh users or applications coming in and doing authentication right and in our platform- uh and that's that's gonna, be the same. If you want to build a facebook application, you have to register it with facebook, same with google and all the other idps, so that that's a basic concept which everybody has to do.

B

There's stuff. We do as microsoft to to enrich that experience for the users, but in in the basic stuff it still register your app so you're going to tell us about your application, the name it can have a logo, and we have to configure some authorization and and security pieces and we're going to talk you through that as well. But the end result is going to be one app requisition and that will be an application object. These are like azure, active directory terms. We use right. You will find client id app id application id.

B

That's just the same thing for an application: application registration yeah. So if, let's just start with that, I will cover service principles a little bit later. So if you go to the portal, which I.

A

B

A

Azure id portal inside azure right yeah, you.

B

Go to portal.azure.com and then you go to the the most important page in the in the portal which actually directory- and I happen to be a global admin. uh But you go to ad registrations here.

A

Yeah, you don't you, don't have to be a global admin to create app registration.

B

No, no, you have to be an app administrator, there's different roles which you can assign to. So you have to do this application registration and, if you're a developer uh um either you have your own ad environment where you can play in desk. That's what I did. This is one of the uh the m365 developer programs I created once for you, but otherwise you're gonna be best friends with one of your administrators to help you out.

B

This is actually also a reason or a source of confusion, because the app folks know they need to set up and then what kind of configuration they need to do. The admins might not always understand what they're trying to do so you actually have to start working together to make sure you do it in a proper way. It's like.

A

I think I think these days, there's also a way to programmatically create app registration. Is that correct.

B

Yeah, I will get to that, so anything I'm going to do now is going to be able you're gonna be able to do it through an api. Stealing your thunder sorry! Now, that's fine! That's fine! So, and especially uh when you start doing automation, devops script, so yeah, let me just show you through what an app registration actually is and then how you, as an administrator, can can control. Who can do one right so great? The first step is when you click a new application is give the name dot. Map.

A

And unique to the tenant itself right and anything that describes the app, so it doesn't have to be globally unique or whatever right.

B

It's just a name in the sense right, so uh you can do whatever you want here. um The first choice you're gonna make is: is this application just available for my own company? It's like.

A

B

Inside of my tenant or directory tenant and active directory is all the same term. For for the same thing, I can create a application which is available for multiple tenants, like offices, a multi-tenant application, we'll cover a little bit about that later. But and you can choose like well, I, like any account to be able to sign into my application all the different tenants, but also personal accounts, which I typically use for for skype and xbox.

B

A

B

I leave this one for for default now, just create this application, and here you will see the application or client id if you build an application or you're down with the sample or whatnot. This is the first thing: it's asking you to copy and paste inside of your configuration.

B

Your app id directory or tenant id might be useful as well, but the app id is actually the most important piece from from from from this page and here and if you are building, I don't know whatever java application et cetera, it asks sometimes for endpoints, like my token point or the resistance, you can get it from this as well, because it's going to be unique for your tenant right, but I do branding. So I get a name I can do.

A

B

Logo, home page uri, et cetera, et cetera, I can oh well. I can talk about publisher verification in a bit. Authentication is where you define your security right so think about this. I'm gonna send you as a user. If I sign in so the new way of authentication right, the application is not responsible for signing you anymore. We don't have a login name. We don't have a password with a submit button.

B

We just tell you, oh I don't know who you are you go to the idp in this case, azure active directory figured out with that idp who you are once it's done. Just give me back my id token. I need right, that's how modern application work and you're probably going to cover that in another session about tokens. Yes, but the one thing we do, if we actually sign you in is we send you to idp with your client id? So, as your academy knows, oh, this is about this application. This is about on.net application.

B

Once we figured out the cbdu, I do a sign in maybe I have to do. Multi-Factor authentication, it's gonna check. If my device is compliant, you know all that all that stuff we can do on applications from administrator site. Then we're gonna get sent you back to the so-called reply. Uri right and since the tokens are kind of important, we don't want people to send be sent back to any random uri and people. Stealing tokens right needs to be just for the ones you control.

B

You have to tell us which uris those are so, for example, say I create a web application. I gonna tell you what.

B

Https.Com page yeah, what you could do is like my domain as your websites.net.

B

Yes, we do https yeah.

A

What we don't want.

B

To do is wildcards wildcards, because let me show what it is. If I would log in to a website, I'm gonna take project central because they integrated with our environment.

A

B

Look at the uri yes saying: client id is cbh5 liblar. So it's telling us this is the application and there's a redirect uri as well right.

A

What if I just change.

B

This redirect uri to myevilwebsite.com yep. We don't want aed to return any sensitive information like tokens to that website. So it happens. If you do, you have registration, you're, gonna tell the system, you can only send information back to this or these uris right. So what we do first is if you start doing this like we're going to check if these uris are actually in that list, I just shown to make sure we can actually turn that information to a trusted environment.

B

Awesome. That also means that if you would allow wild cards hey, maybe I probably don't own all the websites under azurewebsites.net. You.

A

Don't no not yet.

B

So this is insecure, so we removed the capability. This is going to be your website and if I add this, I can configure this and I can have multiple ones typically, like I don't know.

A

Yeah, you have a test, one, you have a qa, one can have a production one and then it allows you to test. I think it's only ac, I think localhost is the only one that allows you http. Am I correct correct yeah.

B

We uh we require https now, and this will be the same. So if you do native apps, it's a bit different right. So let's just do an android app. You have to do your package phone.contoso app and your hash. I don't know I mean right out of my head what it tells this is on mobile. What we do we spin up a web view. You do your system browser, but we have to know when you're when you're done. So when the redirect goes back to this uh to this unique web address, we know it's done.

B

It closes the web view and it can pick up the id token from the from the return address right and advance you in.

A

So native is done.

B

A bit differently, but we still have to tell the system about what to watch for when when this other stuff is happening, but web is simple: it's just a redirect et cetera. So we we support single page apps like javascript, etc. So that's dbs.

A

And if I in fact recently announced the amsoil js 2.0 right.

B

And it's also so here's where the confusion start typically for developers. How do I know what configuration I need to make, what I need to do etcetera, etcetera, so I always recommend just forget about doing this for now. The first thing I do is I go to the quick starts.

A

So we're gonna help you.

B

Go through uh this works, so you know what I'm I'm gonna build a web application and it's gonna be a well we're gonna. Do let's do java. I don't know you know. You know everything about java. Now.

A

I know everything.

B

A

Because I have already four hours of java.

B

Exactly so, it tells you what to do, but it can actually change so you can download the sample, but you can also change the converge. I can make the congregation for you click on this button. It will tell you not I'm going to add these redirect uris yeah and create a client secret. I did make.

A

B

I'm done and I download the code sample um and I can run the sample anyway and right now go back to authentication.

B

You will see it added these configuration steps for me, so I don't have to think about it anyway.

A

Very nice there you go quick start.

B

I'll go back. I come back to this one. The quick starts is a really good way to start and get your app to run sure. So how? How does this relate to service principles or enterprise apps.

A

Correct so right now we have a one-to-one mapping between my app or the app that you just created and the app registration am I correct yeah you.

B

Just create an app registration, tell the system about your app and how people can actually sign into your app. That's it right. Typically, an administrator needs something to configure security. Conditional access policies uh require mfa.

B

Things like that, and especially if the application is going to be available for all the organizations they want to have their own way of configuring that right so they're just right. They don't want the developer to decide who can access the app they want, an administrator in their own environment, to do that yep. So we need something for that and that's called a enterprise app or a service principle.

B

Those are the same things. So whenever you hear server principle or you can, oh, you see enterprise apps, it's exactly the same thing right and how I like to explain is like the app registration is that the definition for your class and a service principle is the instantiation of that class. I.

A

Use the same metaphor: it's exactly like for people that use development or development. I think it makes sense when you define it like this, so.

B

If we have a single tenant application, what happens is that once you use the app or if the administrator sets it up, it creates a single service principle which points back to the application registration. So it knows about your application registration, but it can store information like security settings policies, etc.

A

So in a single tenant, app as soon as I create my operating system also creates a service principle behind the scenes, but I don't have to worry about that right. Yeah, typically.

B

It does it for you automatically, um but the second choice was multi-tenant. I want to be, but I want this application to be available for all the different azure x directories. So what we do? We still have a single app registration, but we're going to create a service principle in all the directories, they're all pointing back to that one single app registration in the home directory, but the service principles will be unique per.

A

Directory ah and then you apply your settings on the service principle itself,.

B

A

Your company right so springs.

B

The permissions is gonna, be different per customer right. The the policies might be different as well, so.

A

This is typically.

B

How multi-tenancy uh works right and the good thing is an administrator- can control all these, so they.

A

B

Who can create applications they control? Who can create enterprise, apps or search principles right? So, if you go to the enterprise apps, please um I probably have. Let me just do the new one on here's. Here's, my ad, I just created ah there, you go. Here's where I sign uses, for example, right.

B

Okay, only crystal scan, I can use this app. I can actually define um oh it's it's an a it's enabled, but also I can only use this app if I'm assigned to the app it's not just available for everybody, it might be invisible or invisible.

B

So, for example, I want to show it on my my apps application that those kind of settings are done on the enterprise app or service principle. Sweet.

A

Is this also where we define roles or are there all defined inside the upper registration? Only good question.

B

No so app roles and and user roles are configured on the application side, but I was trying uses two roles on on this page. So, for example, let me see if I got my an example and that's probably salesforce. That's always a good example.

A

And salesforce is a good example of a multi-talented app right, see.

B

I got roles assigned a chatter, free user or system administrator, yep yep lovely. So that's that's! That's where you do the assignment uh um so going back to so this is an administrative page. You, as a developer, will probably never use this space, but you have to be aware that the administrator is going to use this page to set up things about your application like who can use the application yeah. Maybe there's some provisioning. You have to do like in the in the case of salesforce, I'm automatically provisioning users salesforce.

B

If I assign them to to my application here in um in azure active directory right. What I also can do is from an administrator. So this is maybe not that they're not relevant for developers, but I can choose to add an application for my users from a gallery.

B

So I'm now going to create a service principle manually. So there's two ways to get in: oh there's a few ways to get a search principle in your environment, an api you're going to create it right from online or an app to the ui, like I'm doing now, or a user just using the application for the first time, and if they have the permissions they bring in the service principle automatically as well right.

B

But here I can just add a any application, uh um I'll just filter on open id connect. Because that's what I like! Okay, I have no clue what kind of applications these are. So I'm just clicking randomly right, there's always a risk. When very I just add this uh uh app to my environment. We will create another principle. I go to the uh to the app as an administrator and I can assign the users and the first thing when you use a sign in, they will see the application on the my apps page.

A

B

So interesting to know still the most important page for me as a developer.

A

B

The application page- yes, because this is where I do all my registrations- uh this works my own that demo I can follow.

A

B

So another one, um I don't know if you saw that when I did the.

A

Authentication, they got the.

B

Go away where's my.

A

Was that branding it's running.

B

Purification, so one of the things we see is that people start like the name. You mentioned it already yeah. You can create an on.net application too.

B

How do I know it's coming from the right one from the right person.

A

My own sales force and become a millionaire right. Everybody will be using my app subscribing there.

B

You go. That's it going back to the signing page for project central. You can see this the name and the little check marks next to it. ah If I click on it, show you this app, the publisher is actually verified.

B

That's that piece of ui you saw on the screen.

A

And there's a process right you had submit for for being approved as a as a trusted vendor or whatever.

B

Yeah, the good thing is we already do that because we have the microsoft part network. If you just.

A

B

A

B

That's the easy one to do so. This actually helps your users trust your app more.

A

Yes, so my dreams of becoming a millionaire through uh salesforce uh are not going to happen right.

B

So we talked a little bit authentication. This is the place.

A

B

You can create secrets and certificates, uh um and you know how secrets work right to create one on video and then the secret anymore. I always ask developers which one do you choose here one year, two years or never expires.

A

Everybody goes for never, of course, so don't.

B

A

My app to stop working randomly because I I forgot that I had a one-year expiration policy.

B

Right but- and it always happens that the day before it works and a day a day during your presentation, it just fails right.

A

Or when you go holiday and then people have to figure out why the application stopped working while you're away.

B

Right so please please use certificates. uh Another one you can do here on appreciation is change. The way how your tokens look like. That's also something a developer has to do. I can, for example, say well.

B

I got my id tokens they're fairly small, but I like my email, my given name- and I don't know whatever here the tenant country- I don't know- I just make something up so now, when I do this, I'm sure if people sign in these claims will be part of the id though, but that's something a developer can do as well. Very.

A

Nice are you going to talk about the limits as well? If I remember correctly, you were testing some limits. The other day, you know.

B

I'm trying to so b2c is actually an and a functionality which we now have in external identities is where you can call a rest api during sign in and transform information from the rest api inside of your tokens and trying to find how big those tokens can get before the the the application stops working. So yeah we'll see how far we can go.

A

But it's important for people to know that there are some limitations with the groups and roles and how much information you bring down with the tokens so always be aware of that. You can customize them, but there is a limitation right. Yeah.

B

For example, I can ask to well I'm on security groups or directory roles or all the groups, or only the groups assigned to the application be part of the id token. So I can use that information to make authorization decisions. This is also where, as an application developer, you specify what kind of permissions you're going to use. So, for example, if this application is going to call microsoft graph, which you should because it's a great api.

A

B

You can ask, well you know what this api of this application is going to use know just what's gonna make up something and what's a good one,.

A

B

Calendar yeah: what happens here now is that once people sign in remember this screen, it's gonna actually tell you what permissions it needs right. Administrator can consent for you or use a user can if you have the permissions.

B

But if you do this in your in your app registration, you can actually ask an administrator to consent all these permissions, so the users don't have to do it, but.

A

We can only do that if.

B

You as a developer, specify whatever permissions your app can at one time start using.

A

Yeah also important here to clarify that some of the permissions may require admin consent.

B

Oh yeah, so was it oh.

A

You could request access to specific data, but sometimes it becomes um necessary for the it admin or the the azure id admin to come and uh authorize your consent to these, because it gives you access to a lot of information that we need to make sure they usually have so for us. Working with the max of tenant becomes really hard to uh to test some of this functionality because uh yeah we don't you're not allowed to have access to everybody's email.

B

A global admin, so typically the all permissions are admin consent. uh The interesting thing is that this this is, this model is changing where administrators of the portal or of the the directory can actually override these settings. So they say no. What I don't care that user read is not acting consentable. I will never allow any user to be able to consent for it themselves. That's something I always have to approve gotcha cool by defining this here, you're going to tell the administrator by the way these are the application permissions.

B

That is, our application need, so they can consent or not, if you're going to build apis. That's what you're going to configure here as well. So there's a lot of oh and there's void. There's a rules ui now as well cool what.

A

Yeah nice you're dropping. Oh that's.

B

Pretty administrative, so yeah and we have the manifest. So if you're, uh if you want to change things which are not available through the ui, uh you can do it here or you can use the api. So this this is just the raw format of everything we just did to the to the ui.

A

I think this effort to surface as much functionality as possible from the manifest into the ui, so you don't have to come and mess with the actual json data there. But.

B

I have an api, so if you like the ultimate thing, so we have a this- is the graph explorer. um So we have a graph api where you can retrieve all the applications or you can just retrieve a specific one, a specific one like all the properties, there's always the one-on-one. So let me just run the query: you can create applications, you can update applications, you can retrieve a list of owners, etc. So if you want, for example, automate in devops your build of your application, you can create it.

B

You can switch when you apply your eyes, you can start testing yeah and then remove it again after the build is correct, um so those things are available to the ui and the same is for the for the service principles. I don't know if they have here. I don't.

A

See them here now yeah, I think they're not part of the template, but you can always do the manual calls from the api.

B

So in in- and I think, there's two features- we don't support for the apis, yet the the claims transformation.

B

So I showed you how you can change the id token registration right. That was the token configuration yeah. You can also do something on the enterprise app or the service principle, where you can do, for example, transformations whenever we had one example where the customer had always the format employee id at domain name, and they want to have the employee id as a token as a name. Inside of the token, so they created a custom transformation.

B

That's done on the service principle because, let's be honest as an app developer, I have no clue what the setup is from any of my customers, so they the the customer themselves. They can on the service principle with the bioshell script or the api on the the browser. Scriptory uh create the transformation so anytime, a user signs into that app that that employee id would be stripped off of the email address and put in the. In the token, as a claim as well.

A

Nice so much information today, honestly.

B

I'm learning new stuff.

A

Again, after after using it day in day out, there's always something that I learned with regards to operating stations and service principles.

B

A

B

Again, just see the app registration as the definition of your app that the class definition in a sense and the service principles are the instantiation of that class.

B

Our customers and administrators can use to to modify some of the settings they are which are unique to their uh environment.

A

Cool there you have it: people up registrations, your class definition, service principles, your instances and you're down there simple. So for for singleton apps, you don't really have to care about service principles as much and then for multi-tenant apps. It becomes a little more important because uh you know the the it admins will be dealing with the service principles. But from your perspective, when it comes to developing against these especially.net, we we saw the the quick starts there.

A

That was fantastic because you can actually configure the app then download the sample code that allows you to uh kick start your project very quickly or see how it's set up and then move the code along.

B

Yeah and the last tip the.

A

Integration assistant.

B

um If you do an app registration, you got your application running. This actually will help you test. If your settings are correctly done so say: well, I'm going to build a single page, app and a web app all right, apis evaluate- and it will tell you, oh by the way, there's there's some action required here. Oh this.

A

One's complete blah.

B

Blah to make sure that your settings are correct because, let's be honest as.

A

An administrator as developer.

B

I just want to get this thing over with especially security. I always make the joke it's like spinach. You know it's good for you, but nobody likes it.

B

Let's get past this and get back to my app because that's the thing I like, but make sure you you either an administrator or you're a developer check those different settings. It will actually help you how you can develop test release.

B

It's like a really good checklist for you, and especially since it knows it's a single page, app and a web app. If you add more of a mobile app, it will add the list of things you have to check. uh It has links to the documentation. So this is like this is like everything I talked about. All the best tracks you will ever hear in any session will be listed in this single uh page for you as an administrator or developer.

A

Nice, you know what I haven't even touched: that part of the blade anymore like.

B

Yeah, I'm not gonna use your apps man.

A

I always troublesome the hard way in production. You know I pushed everything in production and I tried troublesome see what happened. I know that was like compressed information, so much stuff there, uh so much goodness around azure id and app registrations and service principles uh mathias. I want to thank you for coming the show and helping us navigate through the the maze that it is microsoft, identity and I hope everyone that watches the show gets a better idea.

A

If you have questions reach out to us, either matthias or me on twitter, we're always there to ask answer questions. So. Thank you. Thanks.

A

A