Move off of adal #396
Move off of adal #396
Conversation
| services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme) | ||
| .AddMicrosoftIdentityWebApp(Configuration) | ||
| .EnableTokenAcquisitionToCallDownstreamApi(new[] { "https://graph.windows.net/.default" }) | ||
| // .AddMicrosoftGraph(Configuration.GetSection("DownstreamApi")) |
There was a problem hiding this comment.
Why not use .AddMicrosofGraph? it enables you to inject the Graph service client in the controllers / pages
There was a problem hiding this comment.
We need graph to operate both as the app and as the user based on the context. We basically just call the graph directly as it's
easier:https://github.com/dotnet/SignService/blob/924022b27795340a93a40f53c37dd80dc6ef0133/src/SignService/Services/IGraphHttpService.cs
https://github.com/dotnet/SignService/blob/924022b27795340a93a40f53c37dd80dc6ef0133/src/SignService/Services/GraphHttpService.cs
Happy to use GraphClient if it can meet our needs and doesn't make things more complicated :)
src/SignService/appsettings.json
Outdated
| "VaultId": "https://vault.azure.net", | ||
| "AzureRM": "https://management.core.windows.net/" | ||
| "GraphId": "https://graph.windows.net/.default", | ||
| "VaultId": "https://vault.azure.net/.default", |
There was a problem hiding this comment.
FYI, in case you only want to read certificate, instead of getting to KeyVault yourself you can:
- use the certificate description in the appsettings.json. See https://github.com/AzureAD/microsoft-identity-web/wiki/Certificates
- if you need finer control, use the DefaultCertificateLoader class which also uses MSI. https://github.com/AzureAD/microsoft-identity-web/wiki/asp-net#help-loading-certificates
But I see here you also create certs
There was a problem hiding this comment.
Correct, this service creates/manages certs in Key Vault.
|
|
||
| namespace SignService.Models |
There was a problem hiding this comment.
You don't need to do anything now for the token cache.
See https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-net-token-cache-serialization?tabs=aspnetcore
clairernovotny
force-pushed
the
move-off-of-adal
branch
from
8909638 to
7210fd3
Compare
clairernovotny
force-pushed
the
move-off-of-adal
branch
from
7210fd3 to
ef35769
Compare
Fixes #387