Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to authenticate Azure Service Management Requests via AAD

I've tried 3 ways with no result:

  1. According to this article https://msdn.microsoft.com/en-us/library/azure/ee460782.aspx I've registered new web application in AAD with permissions to Access Azure Service Management API (steps 1-9) and written the recommended two lines of code to acquire the token:
    var context = new AuthenticationContext($"https://login.windows.net/{tenantId}");
    var result = context.AcquireToken("https://management.core.windows.net/", clientId, new Uri(redirectUri));

, but it fails with the exception:

Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException was unhandled
Message: An unhandled exception of type 'Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException' occurred in Microsoft.IdentityModel.Clients.ActiveDirectory.dll
Additional information: AADSTS90014: The request body must contain the following parameter: 'client_secret or client_assertion'.
Trace ID: aa2d6962-5aea-4f8e-bed4-9e83c7631887
Correlation ID: f7f1a61e-1720-4243-96fa-cff182150931
  1. Also I've tried:
    var context = new AuthenticationContext($"https://login.windows.net/{tenantId}");
    var result = context.AcquireToken("https://management.core.windows.net/", new ClientCredential(clientId, clientSecret));

where clientSecret is secret app key of my application. This version returns a token, but requests with this token returns 403 Forbidden:The server failed to authenticate the request. Verify that the certificate is valid and is associated with this subscription.

  1. The last, I've found http://blogs.msdn.com/b/cloud_solution_architect/archive/2015/03/02/authenticating-azure-service-management-api-with-azure-ad-user-credentials.aspx, which recommends:
    var context = new AuthenticationContext(string.Format("https://login.windows.net/{0}", tenantId));

    // TODO: Replace with your Azure AD user credentials (i.e. [email protected])
    string user = "{YOUR-USERID]";
    string pwd = "{YOUR-USER-PASSWORD}";
    var userCred = new UserCredential(user, pwd);

    AuthenticationResult result =
    await context.AcquireTokenAsync("https://management.core.windows.net/", clientId, userCred);

but it also fails with the same exception as in the first case...

Could you please assist me?

like image 968
Vlad Bilyk Avatar asked Oct 23 '15 15:10

Vlad Bilyk


People also ask

What authentication protocols does aad support?

Active Directory authentication is a process that supports two standards: Kerberos and Lightweight Directory Access Protocol (LDAP).

How do I authenticate Azure App Service?

In Resource groups, find and select your resource group. In Overview, select your app's management page. On your app's left menu, select Authentication, and then click Add identity provider. In the Add an identity provider page, select Microsoft as the Identity provider to sign in Microsoft and Azure AD identities.

How Azure AD works as an authentication system?

Azure AD Multi-Factor Authentication works by requiring two or more of the following authentication methods: Something you know, typically a password. Something you have, such as a trusted device that is not easily duplicated, like a phone or hardware key. Something you are - biometrics like a fingerprint or face scan.


1 Answers

You should change the "Application Type" to "NATIVE CLIENT APPLICATION" while creating the application in the Azure portal.

like image 113
kerem Avatar answered Sep 28 '22 04:09

kerem