active-directory-aspnetcore-webapp-openidconnect-v2

---

languages:

• csharp
• powershell
• html page_type: sample description: "Learn how to add sign-in users to your web app, and how to call web APIs, either from Microsoft or your own." products:
• azure
• microsoft-entra-id
• dotnet
• azure-storage
• aspnet
• ms-graph urlFragment: enable-webapp-signin

---

Tutorial - Enable your Web Apps to sign-in users and call APIs with the Microsoft identity platform for developers

About this tutorial

Scope of this tutorial

In this tutorial, you will learn, incrementally, how to add sign-in users to your Web App, and how to call Web APIs, both Microsoft APIs or your own APIs. Finally, you'll learn best practices and how to deploy your app to Azure

Note

We recommend that you right click on the picture above and open it in a new tab, or a new window. You'll see a clickable image:

• clicking on a metro/railway station will get you directly to the README.md for the corresponding part of the tutorial (some are still in progress)
• clicking on some of the connectors between stations will get you to an incremental README.md showing how to get from one part of the tutorial to the next (that's for instance the case for the Sign-in ... stations)

Details of the chapters

1. In the first chapter you learn how to add signing-in users to your Web App with the Microsoft identity platform for developers (formerly Microsoft Entra ID v2.0). You'll learn how to use the Microsoft.Identity.Web to secure your Web App with the Microsoft Identity Platform.

   Depending on your business needs, the platform offers you flexibility in terms of what type of users (sign in audience) can sign-in to your application:

   1. If you are a Line of Business (LOB) developer, you'd probably want to only sign-in users in your organization with their work or school accounts.
   2. If you are an ISV building a software-as-a-service (SaaS) application, you'd want to sign-in users in any Microsoft Entra tenant.
   3. If you are an an ISV building a software-as-a-service (SaaS) application who wish to sign-in users from both Microsoft Entra tenants and Microsoft consumer Accounts (MSA) you'll want to sign-in users with their work and school accounts or Microsoft personal accounts.
   4. If your application needs to sign-in users in Microsoft Entra tenants in national and sovereign clouds.
   5. If your application wants to connect with your customers, or with small business partners, you can have your application sign-in users with their social identities using Microsoft Azure Active Directory B2C.
   6. Finally, you'll want to let users sign-out from your application, or globally from their browser session.

2. If your Web app only needs to sign-in users, in that case you have all you need from the options provided above, but if your app needs to call APIs that you've developed yourselves or popular Microsoft APIs like Microsoft Graph, then the following chapters will help extend your work so far to also call these Web APIs.

   Learn how to update your Web app to call Microsoft Graph:

   1. We'd use the the Microsoft.Identity.Web library again to extend the web app to sign-in users and also call Microsoft Graph
   2. In this chapter we'd explain the token cache and how customize the token cache serialization with different technologies depending on your needs (in-memory cache, Session token cache, SQL Server Cache, Redis Cache)
   3. Learn how to secure a multi-tenant SaaS application
   4. Learn how to call Microsoft Graph in national and sovereign clouds.
   5. Learn how to authenticate users on both the frontend and backend side simultaneously using the Hybrid SPA code flow and call Microsoft Graph.
   6. Learn how to authenticate users on the backend side and share the authentication state with the frontend side using the Backend for Frontend proxy architecture and call Microsoft Graph.

3. Your Web App might also want to call other Web APIs than Microsoft Graph.

   Learn how to call popular Azure APIs. This also explains how to handle conditional access, incremental consent and claims challenge:

   1. The Azure Storage API. This is the opportunity to learn about incremental consent, and conditional access, and how to process them.
   2. The Azure Service Management API. This is the opportunity to learn about admin consent.

   Note that that chapter, as compared to the others, requires you to have an Azure Subscription

4. If you wish to secure a Web API of your own, and call it from your clients (Web apps, desktop apps).

   • Learn how to secure your own Web API and update your Web App to call your own web API
   • Learn how to update your B2C Web App to call you own B2C web API
   • Learn how to secure a multi-tenant SaaS application with its own Web API

5. Once you know how to sign-in users and call Web APIs from your Web App, you might want to restrict part of the application depending on the user having a role in the application or belonging to a group. So far you've learnt how to add and process authentication. Now learn how to add authorization to your Web application, and driving business logic according to roles and group assignments.

   1. based on their application roles
   2. based on their belonging to Microsoft Entra groups

6. If you want to deploy your complete app to Azure. Learn how to do that, along with best practices to ensure security:

   1. Changing the app registration to add more ReplyUris.
   2. Using certificates instead of client secrets.
   3. Use Managed identities to get these certificates from KeyVault

Daemon apps - Out of scope

This tutorial only covers the case the Web App calls a Web API on behalf of a user. If you are interested in Web Apps calling Web APIs with their own identity (daemon Web Apps), please see Build a daemon Web App with Microsoft Identity platform for developers

How to run this sample

Pre-requisites

• Install .NET Core for Windows by following the instructions at dot.net/core, which will include Visual Studio.
• a Microsoft Entra tenant. For more information on how to get a Microsoft Entra tenant, see How to get a Microsoft Entra tenant
• A user account in your Microsoft Entra tenant, or a Microsoft personal account

Step 1: Clone or download this repository

From your shell or command line:

git clone https://github.com/Azure-Samples/microsoft-identity-platform-aspnetcore-webapp-tutorial

:warning: Given that the name of the sample is quite long, and so are the names of the referenced packages, you might want to clone it in a folder close to the root of your hard drive, to avoid file size limitations on Windows.

• We recommend that you start from chapter 1. WebApp signs-in users with Microsoft identity (OIDC) where you will learn how to sign-in users within your own organization
• It's however possible to start at any chapter of the tutorial as the full code is provided in each folder.

Community Help and Support

Use Stack Overflow to get support from the community. Ask your questions on Stack Overflow first and browse existing issues to see if someone has asked your question before. Make sure that your questions or comments are tagged with [msal dotnet].

If you find a bug in the sample, please raise the issue on GitHub Issues.

To provide a recommendation, visit the following User Voice page.

Consider taking a moment to share your experience with us.

Contributing

If you'd like to contribute to this sample, see CONTRIBUTING.MD.

This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/