Azure Active Directory Token URL Path? - azure

Question

I have a Single Page Application that communicates with a Web API that I am attempting to secure using Azure Active Directory. I've done this before using a local SQL database with local accounts and OAuth2 but I've never done it with Azure Active Directory.
I created a new MVC Web API project in Visual Studio 2017 and set the authentication part to "Cloud - Single Organization" and entered the corresponding domain. The API had me sign in during the creation process. The login information I provided was entered into the Web.Config file.
<appSettings>
<add key="ida:Tenant" value="domain.net" />
<add key="ida:Audience" value="domain.net/WebAPI" />
<add key="ida:ClientID" value="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" />
<add key="ida:Password" value="XXXXXXXXXXXXXXXXXXXXXXXXXXX" />
</appSettings>
Then in the new Startup.Auth.cs file I have the following:
public partial class Startup
{
// For more information on configuring authentication, please visit https://go.microsoft.com/fwlink/?LinkId=301864
public void ConfigureAuth(IAppBuilder app)
{
app.UseWindowsAzureActiveDirectoryBearerAuthentication(
new WindowsAzureActiveDirectoryBearerAuthenticationOptions
{
Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
TokenValidationParameters = new TokenValidationParameters {
ValidAudience = ConfigurationManager.AppSettings["ida:Audience"]
},
});
}
}
I don't see a path that I can call in there to initiate a login. In my original project it was the /Token path which is shown below from my original Startup.Auth.cs file.
PublicClientId = "self";
OAuthOptions = new OAuthAuthorizationServerOptions
{
TokenEndpointPath = new PathString("/Token"),
Provider = new ApplicationOAuthProvider(PublicClientId),
AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
AccessTokenExpireTimeSpan = TimeSpan.FromHours(12),
RefreshTokenProvider = new ApplicationRefreshTokenProvider(),
};
In my original project in order to initiate the login I would use /Token in an Ajax call and pass along the username and password.
$.ajax({
url: url.getURL() + '/token',
method: 'POST',
data: {
username: username,
password: password,
grant_type: 'password'
},
How do I initiate the login in the new Web API which is using Azure Active Directory? I don't see a /token path or anything similar in the Startup.Auth.cs file. Is this something I have to add or is the project setup to automatically use the login credentials I entered when the project was first created?

Answer 1

When tying a Web API into Azure Active Directory there is no "/token" URL to call to initiate a login. You have to direct the users to the following website:
http://login.microsoftonline.com/{domain}/oauth2/v2.0/authorize?client_id={client_id}&response_type=id_token&scope=openid&response_mode=fragment&state=12345&nonce=678910
Make sure you enter the actual domain and client_id variables for your app which are listed in Azure. Also, in Azure, make sure the Reply URLs are set. The API will redirect back to your site after the login is complete. This does work for localhost.