Setting up Azure Active Directory Authentication on Azure Web API.

If we are using the Dynamics 365 in an Enterprise Level , System Integrations with Web APIs are a common scenario. This post will explain on how to set up Azure Active Directory Authentication on Web APIs

1. Register the Web API application in Azure Active directory ,  To do that  Navigate to Azure Portal and Click on 'Azure Active Directory'  -> 'App Registrations'  ->  'New Application registration'

2.  Provide any relevant name and 'Sign On Url' as your Web API Url postfixed by ".auth/login/aad/callback"

then click on create.

Ex: - http://<<your webapi Url >>/.auth/login/aad/callback ,  http://xxxxxx.azurewebsites.net/.auth/login/aad/callback

. 

3.  Once created , The Application Id highlighted below will be the 'Client id' that would be used in the next steps.

4.  From the Azure Portal - Navigate to your Web API that you have already created. Scroll down and click on  'Authentication/Authorization'

5.  Change the 'App Service Authentication' to On , 'Action to take when request is not authenticated' to 'Login with Azure Active directory' and Click on 'Azure Active Directory' Option.

3. In the next screen , Choose the 'Management Mode' as 'Advanced' and Enter the 'ClientId' that is generated from the Step 3 and  Issuer Url. 

Issuer Url Would be same across all your AAD applications and it would be specific to your Organization ,
Update the field with  Issuer URL for your Active Directory postfixed by  TenantId of your Active Directory. TenantId can be obtained by executing PowerShell command 'Get-AzureAccount' or by browsing to your directory from the management portal.

Ex:- login.contoso.net/ef55d177-2075-4dc9-99bf-83549fdc8c62

Your API would now prompt for AAD Authentication both from browser and when accessed via code.

Creating a Simple JavaScript application to use Dynamics CRM Online Web API

This post is in extension to the msdn blog that gives a walk through on Registering and configuring simple single page application with adal.js.

This referenced blog has been written with reference to old Azure portal ( manage.windowsazure.com ) and there has been a change on the Azure side ( portal.azure.com ). This post explains it with respect to the new azure portal.

Prerequisites

• Microsoft Dynamics CRM Online 2016 Update
• You must have a Microsoft Dynamics 365 (online) system user account with administrator role for the Microsoft Office 365.
• A Microsoft Azure subscription for application registration. A trial account will also work.
• Microsoft Visual Studio 2015

Sample Code

The sample code is available in the original blog as well as here ( with minor tweaks). Note that the clientid to be passed in the code will be the Application ID that you would get in the Registration processs below.

Register the application

1.  Sign in to Azure - https://ms.portal.azure.com , You must use an account in the same Office 365 subscription (tenant) as you intend to register the app with. You can also access the Microsoft Azure portal through the Office 365 admin center by expanding the ADMIN item in the left navigation pane and selecting Azure AD.

 

2. Click on New Application registration , Provide any Name , Choose the Application Type as Web App/Web API and Sign-on URL that later translates to Home Page Url also called as Redirect Url is the URL which the user should be redirected to after they sign in and this field can be changed at later point of time.

3. Once created, Click on Manifest and change the property from false to true "oauth2AllowImplicitFlow": true and Save the Manifest file , Else it would throw the error as below

"adal error occurred: aadsts70005: response_type 'token' is not enabled for the application"

4. Add permissions to the Dynamics CRM Online Web API as below, Else it would throw the below error.

"ADAL error occurred: AADSTS65001: The user or administrator has not consented to use the application with ID 'ce2b1c70-06e3-430f-8672-41ef6d03da2d' named 'CRMJavascript'. Send an interactive authorization request for this user and resource. Trace ID: 7b81cedf-dec2-4e68-a91f-ecdb192a0800 Correlation ID: a559a661-4909-4c2f-a629-5edef06e3df8 Timestamp: 2018-02-07 02:41:21Z"

Below screen gives is the information on Grant Permissions screen.