I am using Azure API management which has a link to a third party forum (Discourse). The default login system provided by the api management is been used for signing users up. I want to know if its possible to use single sign on for both api management and the forum so users don't have to make seperate accounts for them. Any guidance would be appreciated.
I am not sure about this but it seems that we can use AAD ( you won't need to create accounts if you already have them in your AAD ) to log in into API Management.
Related
I am building a Blazor Server web app that will have locked features only accessible via paid subscription (payment handled with stripe).
I am using Azure AD B2C for user management/authentication.
I also have an Android and iOS app built with Xamarin, from which users will be able to subscribe to the service (payment handled with Android/iOS built-in payment service), and therefore have full access to the web app.
What is the right approach to save the fact that a user has completed payment, and retrieve that data on future sign up ?
I read about custom attributes in Azure AD B2C, so maybe I should build the system on top of Azure AD B2C, but I am not sure it is the appropriate approach for this use case.
Thanks in advance
Yes, you could use a custom policy and custom attributes if you have a simple system where you just want to store a value and deny access during login if the value is not set.
For anything more complicated, rather store all the details in a DB and access it via a REST API.
Update
You can access the attribute direct from custom policies. You just read and write it like any other attribute.
If you want to use the Graph API, be aware the name is different.
I've spend quite a lot of time trying to find the best way to add authentication to our Azure static web app. Eventually we settled for the easiest solution. restricting all routes for the app and doing our authentication using role management in Azure.
So far we've invited a few users, but we want to invite multiple users to our web app at once. Possibly add each user to some sort of group and inviting the whole group at once? I couldn't find anything on the 'Role management' page. We have limited knowledge of Azure so far.
I was hoping, could anyone give me a lead on how these things usually work in Azure? I'm struggling at the moment to find the right documentation.
Please check the references below:
You can only add 25 invitees/users(individual) to have custom roles via invitation but unlimited users can be assigned roles with a serverless function. This allows you flexibility in how you want to manage roles and you're not restricted in the number of users who can have custom roles.
Bulk invitation is not yet possible for role management in azure static web app and is in recent feature request .You can check here
References:
Assign Azure Static Web Apps roles with Microsoft Graph | Microsoft
Docs
Authentication and authorization for Azure Static Web Apps |
Microsoft Docs
Note:Bulk invitation is possible in azure active directory where we
can fill in csv template and submit: Azure AD | Microsoft Docs
You can raise a support request for the same from overview page> under Support + troubleshooting>new support request
I've created a SPFX feature that needs to call an external API. The external API is part of a system that has its own authentication methods outside of SharePoint. Ideally I would like to send details about the current logged in SharePoint user to this API, validate them to ensure that the user is actually logged in in SharePoint, compare the SharePoint user with the external system's user (they'll have the same email addresses) and, once matched, run the external API's code with that user.
Is there any way to go about doing something like this? If not, what is the best way to handle this sort of problem? Do other Microsoft tools like Azure need to be used for this?
The supported way to authenticate SharePoint framework components to a custom API is by using Azure Active Directory (AAD) and OAuth.
You need to AAD-protect your API. You can configure it so it supports two authentication mechanisms: AAD and your current authentication method. For example, if a JWT token is present, you use AAD+OAuth, and if not you use your other authentication method.
The SPFx to API authentication mechanism is described in details in the page Connect to Azure AD-secured APIs in SharePoint Framework solutions.
In summary, you will need the following elements:
Register an application in Azure AD, which represents your API.
Use a server library to protect your API with that AAD application.
Configure your SPFx package so it has permissions to query your API.
Grant the permissions to your SPFx package in the SharePoint central administration.
Use the AadHttpClient in your web part to access your API.
I am currently developing a WebApi 2 service which is hosted in Azure. I now need to add Authentication and ideally Authorization to this service. I was expecting to be able to do this with Azure Active Directory but have a number of questions
Will my users have to login via the standard Azure sign in portal?
Will my users be forced to use specific email domains (ie microsoft) when creating an account?
Will I be able to programatically add a user into the directory along with Authorization info (aka rights management)?
Will I programatically be able to modify a users details such as forgotton password etc
Sorry for the general question, but I am stuck trying to find out if I am looking at the right technology to be able to meet these requirements. If not, would really appreciate any suggestions on what to use instead.
Will my users have to login via the standard Azure sign in portal?
Yes, but the branding of the portal can be changed in the basic and premium editions of Azure AD.
Will my users be forced to use specific email domains (ie microsoft) when creating an account?
No, you can register your own domain and associate it with a directory. Or you can sync on-premise accounts to an Azure AD directory and use those email addresses.
Will I be able to programatically add a user into the directory along with Authorization info (aka rights management)?
Yes, using the Graph API you can create and manage users. You can also assign them roles or make them part of a security group.
Will I programatically be able to modify a users details such as forgotton password etc
Yes, using the Graph API.
I've originally used Web API 2 with Individual Accounts so that users can create a new account by supplying a username/email and password which is stored in my DB.
I'm now looking to put this API into Azure API service and have looked at the documentation about authentication but this mostly talks about external authentication. Can we use Individual Accounts with Azure API or will I need to handle this myself within the actual API?
Also, with the third party authentication all the examples use a redirected website (FaceBook, Google) to get the user to log in. I want to call this from a mobile app so does it support extenal authentication using API calls or will I have to do that myself?
Thanks
The is no problem in using the security you originally used. The documentation you are looking at describes how to do claim based authentication, authentication with azure ad and internally secure your application with service principals. When using a mobile device, you can go with claims authentication. However you should first figure out what you really want to do.