Microsoft 365 Community Identity platform, 6 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Staying Up to Date with Authentication for JavaScript Applications – March 2023

Description

This month’s in-depth topic: Staying Up to Date with Authentication for JavaScript Applications. Learn how your JavaScript web applications can benefit from leveraging the latest Microsoft Authentication Libraries (MSAL) features covering security, resiliency, and usability. as they are released. If your application is still on ADAL, migrating to MSAL will enable pro-active token refreshing, extended outage resiliency, and improved OIDC-compliant flows moving from implicit flow to auth code token.

Microsoft Presenters: Emily Lauber – Product Manager and Doğan Erişen - Software Engineer.

This call was hosted by Nandeesh Swami (Microsoft) | @Nandeesh_Swami on March 16, 2023. Questions addressed live and in chat throughout the call.

Agenda
00:00 – Intro - Nandeesh Swami (Microsoft) | @Nandeesh_Swami
01:04 – Topic – Staying up to date with authentication for JavaScript applications – Emily Lauber (Microsoft)
10:26 – Demo – Migrating your solutions from ADAL.js to MSAL - Doğan Erişen - (Microsoft)
35:24 – Q & A related to demo
51:49 – Closing

Learn more
• See the full blog post for this call in the Microsoft 365 platform community blog - https://aka.ms/community/blog
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 Platform Community - http://aka.ms/community/home
• Mark your calendar for next call on April 20th at 9:00am PT. Download the recurrent invite for this call | https://aka.ms/IDDevCommunityCalendar

A

A

We're going to have an eventful one hour, I promise you that all right first things. First uh we're gonna record this call, as you can see, we're gonna put this recording and our YouTube channel, which is you know, put up there in the slides, which is AK dot, Ms, slash, M365, PNP, slash videos, I'm also going to put the link in the chat window shortly.

A

You can follow us on Twitter at Microsoft, 365, Dev or Azure ready, or you can also follow me on LinkedIn at nandi Swami, to get updates about what's happening on the public, Community call and all the other events that we do throughout the year right. This call is hosted every third Thursday of the month, just like this time, we'll again have we're already planning on the next call.

A

So you will have something interesting to hear, so uh we will have a survey that will be shared at the end of the hour and we'd love to get your feedback on. How are we doing with this calls perfect all right, Emily, take it away.

B

Wonderful, thank you so much for that uh introduction. So my name is Emily. I am a product manager. That's focused on our Microsoft authentication, libraries for the JavaScript ecosystem. So what are we going to talk about today? uh He, as he said, we have a jam-packed hour few. What we are focusing on today is msl.js um I shorthand it to I'm still Jess. That's the Microsoft authentication libraries for JavaScript we're going to talk about what that is what you can use msl.js for.

B

um If you have been working in the Microsoft ecosystem for long. You may also be familiar with the acronym adol we're going to talk about what has changed between adol and amso. We're going to talk about why you should be staying up to date on your latest Absol version and then dogen will also be walking through a sample migration. We do have a q a at the end. In the meantime, though, if, throughout this presentation you have questions, please put those questions in chat and we will try to address them as they come up.

B

So to start, the Microsoft authentication library for JavaScript I use this as an umbrella term. Msl.Js. Technically, under msl.js in this JavaScript ecosystem, we have a number of different uh packages within it that you could be using. So you may also hear the term MSL browser and cell JavaScript also include stem cell node also includes M cell angular and also includes MSO react in a broader umbrella term, though what is msl.js? What is this umbrella Library? So, as I called out, this includes various JavaScript Frameworks such as angular react node.

B

um This is a SDK uh software development kit that is developed by Microsoft. We have full-time Microsoft employees such as myself and others on the development team that are focused on this full-time. This is what I show up to work and I'm excited to work on, but this is also an open source SDK. We do welcome contributions, I have a link to the side, and we can also put a link in the chat to the contributions guide. You can see all of the code that we have there. We welcome contributions.

B

We will review every PR that comes in from the community. It doesn't necessarily mean that every PR is guaranteed to be included, because this is such a large library and that is used in lots of places. That's actually the next bullet point there. This is a SDK, that's used internally by Microsoft, so your favorite Microsoft products such as you know, office.com or outlook on the web use msl.js, but this also is a library that is open, source and available for the community to be used externally as well.

B

The other note about msl.js is that we, as I called out. We have employees that are constantly working on this, so we do release the first Monday of the month. There are some nuances there like. If Monday happens to be a company holiday, we may release that Tuesday or may release the following Monday, but every month you should be expecting a new mcljs release.

B

This slide is showing here what, uh when I, say, msl.js and I reference that we have different packages underneath there. This is the package structure that we mean. So this is the MSL browser which is our vanilla, JavaScript implementation. We have our angular. We have our react that pull from the Samsung browser and then as I, call that we also have MSL node M cell node is a library that works with public and confidential clients. You can see this little box around the Samsung browser. Angular react their goal.

B

There is for single page applications, which then leads us into our next. What can you use I'm, so js4? The bulk of the library, is focused on our single page application use cases. It does work for other web applications. It does work for as I called out, node uses confidential client applications.

B

You may see this for your your confidential clients for your Damien's or Damon's, and then, if those are the applications that you can use msl.js for what, if it's a Microsoft authentication Library, what identity providers is it best for authentication and that's the Microsoft identity providers, so the Microsoft ident providers do include Azure ad, so Azure active directory. You may hear me shorthand that to aad these are our work or school accounts, our Enterprise accounts.

B

We also do have the Microsoft consumer identities. These are the the personal accounts you may hear me refer to those as our MSA and then this also, this Library does work with our b2c, our business to Consumer offering and then, if you have been working in this ecosystem, a lot as I mentioned you may be familiar with adol uh adol is our previous iteration of the library, so adol was originally released in 2015., this was focused uh just on our Enterprise flows.

B

um It only uses implicit flow. It points to some of our version. One of our server endpoints adol, is a library that is currently in maintenance, with an end-of-life plan for June 2023, and what we mean by end of life is that this will stop getting security updates. This is a library that we really want people moving off of and we want you moving off of that to Adam cell. So this is our M cell. Is our Microsoft authentication libraries? This is our modern authentication Library. This is the focus of the team is really improving.

B

um So if you are an application that is still on adol, you might be asking why am I being pressured to move to amso? What is so great about MSL? Why does everyone keep talking about it? Some of the benefits of msel is that there is proactive token refresh. This uh enables fewer authentication prompts to the user. This also improves the resiliency of the application. uh One great benefit of Absol, if you're very familiar with the oidc flows, is that this uses our off code flow with Pixie.

B

This is a improved flow compared to the implicit flow one benefit, also if I'm so as I called out previously. What you can use M cell for is that this is one SDK for the Enterprise consumer and b2c uh identity providers. Authentication flows that you may be using MSL also enables the conditional access policies and the continuous access evaluation uh events that you might be leveraging as a customer.

B

That's using Azure ID if you are a an IT admin, and you want to enable these types of policies and sells the library to use to enable these types of policies.

B

One other important question here about. Why should you say up to date on our MSL versions, so on this slide, I'm talking about M cell right now as they exists? Why you should be moving to it away from agon one important note about MSL, as I said we release every month, so we are constantly working on improving this library, and so it is very important for you as a JavaScript application developer.

B

uh You, as someone that cares about staying up to date with authentication, should be looking at updating your MSL libraries to stay on the most up-to-date version, some things that are coming in the future. Thanks to these Microsoft authentication, libraries, if what I said previously, what exists now in the library was not enough to to tempt you to do this migration, uh one important factor is: we are constantly innovating on this. Some exciting innovations that are coming soon is this this proof of possession.

B

um It's our token protection, our native operating systems. We are constantly improving the maintenance of the library as well, so we're updating our ecmascript to 2020 I know just based on the GitHub issues that I get that's a hot topic for people sweating to make sure you're on the latest JavaScript ecosystem.

B

This also includes staying up to date is dropping support for some of the deprecated items that exist. Internet Explorer is a long time favorite of many of us, but it is deprecated. We are no longer supporting Internet Explorer as a company and then also as a library there's also some improvements that come out um our cash and other General performance improvements, a fun thing about dropping our Internet Explorer support, so that this means it's going to be a slightly smaller Library. It loads a little easier inside of your application.

B

So there are both exciting big feature releases that happen with our our monthly releases and also just minor improvements that day-to-day can make your life easier as a developer by staying up to date on the latest MSL versions.

B

I just very quickly, ran through. Why msl.js is what I spend my time working on? Why it's a thing that you might be interested in what it is, what you can use it for why you should be using Amazon sort of adol why you should be staying up to date on the latest versions, start moving into some of the samples and some of the code that the demo code that dogan's going to walk through.

C

I'll go ahead and share my screen, then all right so hello, everyone, I'm dorgan, I'm, a engineer with the developer guidance team and what I want to talk about in the rest of our time is to discuss some of the main aspects that you need to be aware of when you're migrating to the latest version of amsal jsv2 at the moment, especially from adol to msol.

C

Specifically, we will talk about how to migrate a single page application, but pretty much everything we will cover here to discuss here applies in a similar manner to migrating from adol nodes to MSL node. If you're in that particular situation, foreign to take a general overview of what we are going through when we are migrating, our apps is uh the one. uh The main aspect of difference is how you're going to um configure your application, uh how the configuration differs between adol and msol.

C

These are mainly about the authority differences, the endpoints that your apps are using to sign in users and obtain tokens.

C

Then we'll talk about differences about the redirect URI types, the different types of redirect Uris msol versus adol uses we'll touch upon on how API permissions differs. How obtaining an access token differs between adol versus m cell I will mention the supported account types that you can work with um cell and then we'll get into the differences between the public API surface of adult versus m cell.

C

We'll talk about the name and uh signature changes between the methods we'll talk about using promises instead of callbacks using accounts instead of users and how error handling differs between Adel and M cell and along the way. We will touch upon how the token caching and renewable Behavior works with msol, as opposed to data.

C

So I'll stop sharing my slides here and I'll. Take you to the uh demo app we have today.

C

So it's a very simple one and I'll go ahead and make sure that my server is running so uh I have a simple HTML page here and which Imports the adult package from a Content delivery. Network and then I have some Dom elements on my UI, which has with some Behavior attached to them. I have a sign in button a sign out button, a get token button and a section for displaying the username I'm serving this page through a simple express.js server, which serves the adol, uh endpoints and loads.

C

My index HTML file and then for my authentication and UI logic. I have a alt, JS file that contains that logic. Here there you could see that I have a very simple uh method function here: that updates the UI provided a user object obtained from Adel, and then I have a section here that configures my adol authentication context object, which is the object that exposes the uh login and acquire token methods from adol.

C

I have a um this application: a single page application on Azure ID. If we look at how this is represented on Azure ID, as I said, it's a single page app of interest to us, our Adel app is using the V1 endpoints, because this is uh what the default endpoint for adult is on authentication blade. We could see that we have a redirect URI configured with localhost 3000, slash adal and it is of type web and a little bit below.

C

We could see that since aw.js is using implicit flow, we have checked the implicit flow boxes and then, back to my code, on-site instantiate, the authentication context, object. I have some logic here for handling the authentication flow.

C

So if I briefly take a look at what this app does.

C

uh I have a very simple UI, just a simple login button, and if I go ahead and click this, it will take me to Azure. Id I'll select an account here and then it will display my username if I click get token it'll get me an Access token.

C

You can crack open this on jot MS.

C

It's a token for Microsoft graph with the scope user reads: it's a version one token, and it has a validity for about one hour and then I have a logout button that if I click will log me out of azure ID.

C

So that's pretty much. What it does it's a very simple app and what I want to cover is that what you need to go through to migrate this from adol to Absol?

C

So to do that, you can follow pretty much uh our migration guide on the Microsoft documentation. It touches upon all the aspects that you need to go through to migrate. This app.

C

We could start with the prerequisites you can see here that if you're going to use msl.js V2, you need to set your redirect URI to type single page application which Associates the behaviors to use authorization code flow when we are signing in users with Pixi. That is proof key for code exchange, which is a mechanism that prevents your authorization code to be used by other actors.

C

So we might as well go ahead and start doing that. So in my app registration, I'll add a new platform. I'll choose a single page application and then I'm going to use the I'm going to try to use the same, redirect URI, and then you will get an error here. If you try to use the very same, redirect URI, because Azure ID won't be able to distinguish whether it should use the web Behavior or the single page application behavior when responding to this URI.

C

So we need something different here: uh I'm going to go ahead and use MSL instead,.

C

All right now, I have this URI and I don't have to uncheck these boxes. uh Msol is smart enough to let Azure radio know that I want to use the authorization code flow.

C

I'll just have to copy this guy here and then I go back to my code.

C

And there first I want to send this endpoint from my server. So maybe let's go ahead and do that first.

C

Just restart my servers.

C

And then I can go to my index.html file where I'm loading the Adel package. If I keep following the guide, The Next Step would be to install or import msol I'm using a Content delivery, Network. So I'll do the same. This one is slightly outdated, so I'm just going to follow this link to get the latest version.

C

And we can just go ahead and copy this guy and let's comment out this section and add msl.js here, the current version is 2.34.

C

And now I have that I can go to my ALT JS file and update the MSL. The application configuration there so I need to eventually update this UI function because uh with msl.js you now work with accounts instead of users and a user can have more than one account if you're like me, you have dozens of accounts and with msl.js you can support all of them in the same application.

C

You can manage multiple accounts in this very same app, so we're going to come back to this I'm moving to adult configuration here, and that is what we're gonna get rid of. So if I follow the guide a little bit more further down.

C

Now I need to instantiate the main msol application object and I can go ahead and do that.

C

And let's comment out this part and now I need an M cell config object here, so maybe I can get rid of this guy.

C

And instead Define uh Amazon config.

C

Let's also copy paste, this part actually oops.

C

So at the minimum, I need a client, ID and I'll go and copy paste this, since my application is single, tenant I also need to specify the tenant. We don't have the tenants uh property name anymore, so we will use Authority instead, which is a combination of the instance and the tenants.

C

Hopefully this is correct and we will also assign our new redirect URI and that'll be localhost 3000 Amazon foreign.

C

Tication configuration if we don't specify any cache location by default. It will use the session storage, but let's go ahead and be explicit about it and then I have some login configuration here. So I'm gonna get rid of this as well, and I'll use the login configuration for msl.js a little bit more down. I could find that. Let's use this.

C

And that pretty much covers everything I want to cover here now, for instance, if I want to declare my application to be capable of handling continuous access, evaluation events or similar I can go ahead and use more configuration options. I could follow the full list of available options on msl.js repo, so, for instance, let's declare our app to be capable of cea.

C

And that pretty much covers our M cell configuration now I can use this instance to update my authentication logic.

C

So, let's start with the simple ones: I'm going to go back to the guide and see what's the next step, I need to do so. I need to now switch the MSL API. Some of the method names are changed. The method signatures are changed, but uh pretty much I can find everything I need here, I'm going to get rid of the login and logout methods first and use either pop-up or the redirect flow.

C

Let's have actually a small variable here to.

C

Decide if we should use pop-up or redirect so I'll start with the simple ones.

C

There we go and if so now, I don't have any intellisense support. So I want to take care of this. That's actually.

C

Install the package itself browser.

C

Right and then, let's start this.

C

And I want vs codes to give me some intellisense support, so just for the moment, I'll have this here and then later on. We will uncomment this section as well, because we are importing himself from a Content delivery Network.

C

Now, if you go down there and update our sign in methods we're going to use a login popup, this accepts a request: object where you can Define, for instance the Scopes. You want the user to consent to so that is another change. When you move from a dial to msol Adel had the concept of resource msol has still has the concept of resource, but you will now require obtain access tokens for a given scope, so we could just Define that so let's say, if previously we were acquiring a token for graph, the dot microsoft.com.

C

This could now be a user reads from the graph.microsoft.com resource or just by shorthand it could be user reads, and this returns a promise. So I can get that promise here and use this to update my UI.

C

So let's do this: let's console log, this actually yeah pretty smart and let's also actually do what. Let's set the um active accounts.

C

As the account that we obtain after sign in and I'm gonna take this line here.

C

Right and if we're not using pop-up, we can use the redirect API and once redirect happens. Of course, what happens is that your application, navigates away from your app and uh the user, is taken to Azure ID, where they enter their credentials or if they have an active session with Azure ID. They might just uh sign in without any prompts and then they'll be back to your application, uh and it will be a new instance to your app, and so we need to handle that redirect response. So let's go ahead and do that as well.

C

I'm going to comment out this section and if you look at a guide here, we could see that we now, instead of using handle window callback, we should use the handle, redirect promise API so I'm going to go ahead and do that.

C

C

Let's also put that oops.

C

And if you have a response, so This Promise will resolve with either a response if your application is actually returning from the uh redirect from Azure ID or it will result to null if it doesn't return from Azure ID. So we'll check for the response here.

C

Now we could do the pretty much the same, and if it is not from coming back from Azure ID I could perhaps check for the uh any available accounts in the application. Cache.

C

Let's, instead use get all accounts and then let's take the first one and use it to update our UI.

C

All right, if you have any errors, let's just console log them for the moment.

C

All right so that covers the styling function, pretty much. Let's go ahead and do the same for sign outs for sign outs for logout I'm, going to use either logout, pop-up or logout redirect. Let's use both.

C

Okay, if you're using pop-up, let's do that.

C

There we go, and else.

C

Okay and then, if you have yep and that pretty much covers the logout now we could go ahead and give a try to this, but I need to update my um I need to update my uh update UI function. So we don't have users anymore. We have the account object, so I'll replace that.

C

And the account object will have the username so I'll just use to display that now, let's give this a try.

C

Back to my app I'll, replace this and oops. Of course we want to get rid of this because we can't use it here.

C

And then I'll load my page again and then you can see that MSL starts logging, some stuff we'll go ahead and click our login button.

C

This will take me away and then, since I already had an active session with Azure ID I, just signed in without any prompts and I could see my username displayed on here. Let's also test the log out, and that seems to be working as well.

C

Actually I just logged that from the wrong account, but there we go okay, so that covers logging in and logging out and now I want to go update our get token function.

C

All right, so, let's comment out this section so if you're using acquire token API previously, that is now renamed to acquire token silent and it requires an account object as a request parameter.

C

So let's go ahead and do that.

C

C

So if you don't know what scope you're going to use in you're going to use when you're migrating from the V1 endpoint to V2 uh for the moments, you could just use a DOT default scope. This is a shorthand for saying that get me a token for whatever permissions I have defined on my app registration, but I'm just going to go ahead and use the user reads. I also need to supply an account object, and let's get this here.

C

I should be able to get the active account that I have set previously.

C

And I'm not getting intellisense so I want to put this guy back.

C

All right so I'll take this guy here.

C

And that should be it, and if this succeeds, I want to get the response and use it to update my UI.

C

I also want to log console log the response- let's see what's there and then, if there are any errors, let's catch them most likely, you might get the interaction required errors, for instance, if you're asking an access token for Scopes that the user has not consented before. That is what you will get. uh Let's check for this error.

C

And if that's the case, depending on whether we are using the pop-up or the redirect experience, we could we should cover this with either an interactive token request.

C

Using pop-up or uh using the redirect API.

C

Okay, so that pretty much covers it again, I'll get rid of my uh require statements here.

C

And let's give this a try again, let's refresh this page and try to get the token and there we go so instead of just the raw access token as it was in Adolf, we'll get a full response from msol that has lots of useful information about when this token expires. It'll also contain an account object, based on the set of tokens that MSL just acquired.

C

It will also contain an ID token claims that uh you can use to update your UI it'll contain some information about what this token contains as permission and some other useful data as well, so that pretty much covers every important aspect you need to touch upon when you're migrating your app from adol to msol.

C

Now, one difference that MSL has over adol is that, as I mentioned, it's using the authorization code flow to obtain access tokens and its cached schema is different, and now the cache includes a refresh token that comes with this grant type and that refresh token can be used to renew your access tokens.

C

They're either expired access tokens or access tokens that are close to expired can be renewed with the refresh token, and if your refresh token is also expired, msol will attempt to silently renew that um refresh token using the silent, iframes, hidden iframes and, if you're, using a browser that blocks third-party cookies. That will not work out, because the cookie for Azure ID is considered the third particle key relative to that Hidden Eye frame, and in that case your users will see a prompt, an interactive token acquisition prompt.

C

But, unlike adol, this longer happened in every 24 hours. Instead of approximately every hour.

C

And that's pretty much it I can go back to my slides now and uh as you guys, if you have any questions, I have some useful links at the end of my slide. So let me know.

A

All right, I guess there are a couple of questions in the chat. Let's get to them. What is the best way to call a self-service, password change policy after user has logged in I use, login redirect and password reset policy URL and then after password after that, password has changed successfully.

A

Then I get two Intel accounts, one with okay uh gopal. Do you wanna, come off View and ask your query: did you have anything to say there.

C

Oh yeah, that's pretty much a configuration you should make on Azure ID um this. With respect to um your M cell codes. uh There will be much change, as the name implies. It's a self-service password reset and it's supposed to uh I'm, assuming it's supposed to happen uh without any code changes to your application, at least that's how it works in b2c. At the moment,.

A

Okay, uh we see David has put in uh three or four uh comments in there uh David happy to talk to you. Can you uh come off mute.

D

A

Sure right great, uh what are your questions? I see that you wanted to talk, yeah yeah.

D

um The angular stuff seems to be covered quite well, and the uh Blazer stuff seems to be covered quite well in these tutorials, but I feel that the react stuff is lacking a little bit more in your GitHub tutorials and obviously there's a lot it's fragmented, so it's sometimes hard to to find them.

D

Maybe I've missed some of that, but again, uh Brooke, Allen and Cole have been doing a lot of talks about the back end for front-end stuff, the iframes that are going to be a problem when browsers have all these blocked by 2024 I assume it is at the moment so uh yeah I'd love to know more. What's the plan to deal with the iframe being blocked, you just said it was 24 hours, which obviously helps because then we can. We can do other smart things to handle that that's really good I, never realized.

D

It was 24 hours now so that that makes things a little bit better, but uh really I'm. Looking for more uh tutorial, there's a lot of pressure to use react, but then we're getting a lot of pressure to move away to something else completely, because we're not finding good tutorials to know that we're doing the right, secure thing with react. uh You've done a video.

D

Incorrectly, but um you've done a video of maybe eight months ago now similar react thing that you've done just know. It was fantastic, really good, and that was a separate app that you could I think it was possibly to call the graph- and that was really good, really helpful. But again I'd like to see something like that: Colin, your own ASP web API, uh both integrated so that the tokens stays on the back end, but also what you've done as well. The two separate apps where uh we can get.

D

We can call that and use the token that you just have I think that's a little bit easier. I've already got that working. It's more just it'd, be good to see something to know that what I'm doing secure, because that's what's most important to my boss, I know that was a lot. Sorry I know worse, no.

C

A

um I'll start with it yeah. Why don't uh yeah I just put in the link uh that the video that he was uh referring to, but then yeah uh you can address it and then I'll, probably I had some proposals but go ahead. Yeah start sure. um I'll.

C

Start with the iframe question, um our third party cookies question, so uh so what happens today is that yeah, as I said, if the third party cookies are blocked, uh you'll they're, under Azure amps I won't be able to refresh the refresh token, uh silently in a hidden, iframe and uh you'll get a sort of a um prompt. But if you already have an active session with Azure ID, that prompt will be just a flickering and so the the user experience, although less than ideal, uh won't be uh damage. Much and Emily.

C

Is there anything about the iframes or desired third-party cookies that you want to add? On top of that,.

B

Yeah so I'll just add: uh you talked about what the current experience is um fully in agreement there when we are looking ahead, so we do know that most browsers uh I think Chrome is one that is going next in 2024, looking at blocking third-party cookies by default. We are monitoring this uh as of right. Now we we go with the approach that token sent to make sure to have a fallback mechanism.

B

If we can't silently renew that mechanism to do some sort of interaction required, we are watching and seeing what the browsers are doing in different spaces. What standards are they coming up with? um What different apis? Are they looking at I?

B

Don't have anything right now to share because it's a constantly evolving space as browsers get there so another reason to stay up to date on your latest M cell uh versions, because it will be these future versions whenever the the browsers and we figure out what is best for us as a library to respond to that you'll see those changes on the latest stem cell versions.

D

But that's great thanks and I appreciate that, but I've done some tests, then on Brave and Safari and it just wasn't working for me. I asked on stack Overflow and the suggestion was to uh stop blocking third-party cookies in the browsers. I can't get my users to do that across the board. So maybe I'd done something wrong. So again, there's swears, there's maybe a need for a more complete tutorials, but it just broke on Brave and Safari all together. For me,.

B

That's um good feedback about um breaking all together, because what what we would expect is that there is interaction required, so you may have a user prompt. um We would not think that it would break entirely, but that is great feedback that we might need to add more to our tutorials, to explain that for.

D

Those scenarios there was plenty going on in the console, but unless I just fully refresh the browser, it wasn't going anywhere. So the user wouldn't really know what was going on. But again that might be on Me Maybe. The the codes that are done wasn't correct.

C

Please reach out to us on GitHub repo. If there are any issues there, we could definitely help you out. We could take a look. um I would also get back to your other question about um the more react work. uh You mentioned that there's much talk about the keeping tokens out of the browser with Spurs uh you're, referring to the the backend for front-end pattern. uh We will have a sample on that um shortly uh that we will outline that Technique. We also have some other Alternatives there.

C

um One is the hybrid Spa code flow that uh essentially allows you to obtain tokens both in the front end and the back end, and so that you can obtain more sensitive, high privilege tokens in your secure backend instead of the front-end side. That is another alternative and, of course, the assembly said that when the token binding work uh comes out, that will be the definitive solution to tokens in the browser. The security concerns about having tokens in the browser.

D

um Ecstatic to hear the back end for front end. Examples coming uh I'd love to see how you're going to alert us to that, because I really need it. The the hybrid tutorial you're talking about uh I, followed that and I'm sure that I think when you go to the link. It says it's react uh with the hybrid that you're talking about with them, and you actually go to the tutorial I think it's actually a desktop application. It takes you to uh rather than uh react. Api tutorial.

C

Shouldn't be so maybe there was a mistake: uh I'll get you the right link for that. uh It's probably fantastic again,.

D

Really appreciate this.

A

D

A

Thank you Dogan. We we see, Savas has us hand up, go ahead. Savas.

E

Yep, thank you guys, thanks Dawn uh great presentation, so I have one question actually about the um methods that are in the Amazon Library I'm. In the background of this question, is we have a real time application, which is constantly talking with a power bi report to see the location of the trucks or whatsoever? Let's say, let's assume that's the case and in this scenario I mean the background of this question is actually from the software development point of view.

E

So do I need to keep the track of the access token like when it was issued, because I know it will be expiring after let's say 90 minutes or is there a method which I could just enroll I mean so that it notifies me and I receive a new access token before it expires.

C

Yeah, um so that's one thing that MSL uh is very uh cares. A lot about is that you don't have to deal with the uh managing the token lifetimes. That's a important point for the for this SDK, and, ideally, everything should be MSR should handle renewable, the tokens, uh caching and renewal of tokens.

C

That means is that you only use the um the only the recommended pattern that we recommend is that um you always attempt to try to get a token silently using the car token silent method, and if that fails, for some reason will try to. If that token is expired, or if it is close to expired, Amazon will try to renew it using the refresh token, if refresh tokens expired, MSA will try to renew it using the hidden iframes.

C

If none of these works, it will throw out an error saying that interaction is required and then you're supposed to handle that with one of the interactive apis either the pop-up or the redirect one but yeah. Eventually, the goal of the SDK is that this uh process of token renewal should be abstracted completely away.

E

Thanks everyone, so basically I should follow the pattern on the docs. Microsoft.Com always acquire uh token silent and if it fails, go with the pop-up or redirect and that's it and drone deals with the timing and so on. Yep. Thank you true, yeah, correct.

A

uh I see Daniel your hand is up, go ahead.

F

We have the account actively set up like. Why do we need the user need to choose the account when they log out, and how do we avoid that situation?.

C

Oh, you can you, can uh you what you can do? Is there you can pass an account object to the msos logout API? That is not guaranteed 100 work. You could also what uh additionally, what you could do is that you could opt into the optional uh ID token claim called login hint, and once you have this claim in your ID token, you can pass it to the uh the logout apis and it's supposed to sign your ads from that specific account that you have just given the login hint for so.

F

Basically, the.

C

C

Hint pretty much the same yeah uh it's kind of, but you have to opt in uh for that claim on the app registration right. Okay,.

A

Any other questions, folks, it will come off mute I, see there are a couple of questions which Emily has handled. Okay, there's one question: does Azure open AI deliver code base based on your Azure ID configuration, especially with ms365, developer environment.

A

Can you uh can you please expand a little on this.

G

Yes, okay, I think well before we before you respond to that question. Can I get help on the previous question of mine. If there is, there are similar samples, uh tutorials or C sharp an instrument in same code behind apis.

A

I think we have many right dog on.

G

Service has been released. We generally fall if, within my given environment of azure ad configuration across multiple products or applications that I have in in my solution can I create a boilerplate code that will act as a SSO integration layer using the fundamentals you're teaching, where I don't have to spin My Cycles, but either open AI can spit out that code.

C

I haven't tried it, but that sounds.

G

C

G

Can definitely because, eventually, it's becoming the same rut right, we're repeating through all of us, are repeating on the call.

B

G

We're here which, which you have demonstrated to us like what's the point in us, enlisting our Cycles in nuts error instead of focusing on our business intellect implementation.

C

True, no, that's something good to try. I haven't, did it, but I will give it a try I'll, give it the Adel code and ask it for to give me back the M cell codes that could be interesting. I've seen some um libraries are now making use of open AI uh the chat GPT to in their documentation, and it seems to come up with some excellent results, uh but we don't have anything similar at the moment.

G

My specific question is not just about conversion here. My question is more about even using himself right: I configure a developer environment, 365 environment, I, get 25 cameras um and I want to set up sign in for them to get my MVP going.

A

From scratch, no I think that's a that's a good point. Right I mean we have some similar discussions uh behind the card is nothing uh nothing that we can share yet, uh but uh that's a very good uh thought process and we are thinking in in the same directions. I cannot really say we have we'll have the exact same solution, but uh there have been discussions Emily. You are saying something.

B

I was just gonna say what you were saying of. This is a really interesting idea. I, don't think uh I'm less familiar with our Azure open AI, but we can take a look into it and see and.

G

I'm happy to partner with you offline, uh if you guys are interested because yeah number one is I, also have a not totally sideline, but Microsoft 365 developer question in into domain creation, which is kind of screwed up from last couple months. So if there's anybody from um that side and gave me some Cycles on guideline, that will be great.

A

G

Sure sounds good um yeah.

A

Just ping me I will probably Loop you in with some of our 365 folks, Microsoft 365 folks.

G

Okay, but yeah, open, AI capabilities will be great.

A

Okay, yeah: we take that feedback and I think we have had multiple discussions. We will probably have something to share I, don't know if it's going to be through open, AI or bot, but then uh the whole idea about okay. Why do I need this library and all that yeah? That's that's a good point. Then yeah I will we'll take that into consideration. Yeah.

F

G

Just uh you know put more color on that. um You know. Print on that part is if it is going to be a paid service. I might also get the most back for the buck right. Yeah.

A

Perfect all right any other questions. Folks, okay, uh sounds good. uh We have couple of blogs there. Where we'll have these videos released I put in both the blogs there. One is our uh you know: the blog Microsoft identity platform, Community call where we put in all our blogs uh and videos for the community call also a new blog and try identity, developer blog. Where we'll have the separate section for this. This call as well as some more interesting stuff that we are doing on the developers. uh You know scenarios for identity integration.

A

Will they put in that blog bookmark them uh here are some references that Dougan has put up in his slide. uh We will be sharing this slide in the blog, so you will be able to get to all of these links. Perfect uh anything. You wanted to add your token.

C

uh No I think we're in a good spot um yeah. We will share those links. uh I try to outline the most important parts that you might uh or the struggles that you might have when you're moving from Adel to MSL and as I said yeah, we discussed JS, but uh we also have some migration guide on uh adult node as well.

A

Perfect, the next call is happening on the third Thursday of the month. We will have something interesting to share. We are thinking about doing something on the graph side, which feels it is exciting to everyone. Looking forward to seeing you all on that call thanks a lot have a great one, bye-bye bye, everyone.

F