无法设置“preAuthorizedApplications"通过 Azure Powershell 在新应用注册模块中的对象 [英] Cannot set "preAuthorizedApplications" object in new App registrations module through Azure Powershell

问题描述

短场景:多租户前端 javascript (React.JS) Web 应用程序从浏览器调用多租户 ASP.NET Core 2.2 WebAPI.

身份验证:

1. 当用户登录时(基于用户的原始 Azure Active Directory)，前端应用程序中的 ADAL.js 负责从 AzureAD1 或 AzureAD2 或 AzureAD3... 获取令牌.

2. 用户同意也委托给 WebAPI 的前端 Web 应用程序(范围:登录并阅读用户配置文件).(意味着用户也不需要同意 WebAPI)

3. 前端Web App使用承载令牌调用We​​bAPI获取资源.

问题:我必须自动部署新环境.并相应地设置清单文件(这是一个 SaaS 解决方案)

1. 在清单文件中，我需要为客户端应用程序公开 WebAPI()

如何使用 Azure PowerShell 将此preAuthorizedApplications"部分添加到清单文件中?为什么门户里有，PS里还没有?通常情况下是相反的......

08-05-2019 根据答案更新:

我通过服务主体获取访问令牌:

$adTokenUrl = "https://login.microsoftonline.com/$TenantId/oauth2/token"$resource = "https://graph.windows.net/"$身体=@{grant_type = "client_credentials"client_id = "$ServicePrincipalId"client_secret = "$ServicePrincipalKey"资源 = "$资源"}$response = Invoke-RestMethod -Method 'Post' -Uri $adTokenUrl -ContentType "application/x-www-form-urlencoded" -Body $body$token = $response.access_token

根据文档:.

Short Scenrario: A muti tenant front end javascript (React.JS) Web Application calls a multi tenant ASP.NET Core 2.2 WebAPI from the browser.

Authentication:

1. ADAL.js in the front end app takes care of getting a token from either AzureAD1 or AzureAD2 or AzureAD3... when the User signs-in (based on the User's original Azure Active Directory).

2. The User gives consent to the front end Web App (scope: Sign in and read user profile) which is delegated to the WebAPI too. (meaning the user does not need to consent to the WebAPI as well)

3. The front end Web App calls the WebAPI with the bearer token to get the resources.

Problem: I must automate the deployment of a new environment. And set the manifest file accordingly (It's a SaaS solution)

1. In the manifest file I need to expose the WebAPI for the client application (https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-expose-web-apis#expose-a-new-scope-through-the-ui)
2. Setting "knownClientApplications" is not enough (due to previously described delegation)
3. The new v2 endpoint (https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview) has a new App Registration feature. The old one is called "Legacy" now and will be deprecated starting May 2019.
4. In the Azure Portal need to expose the API and add the front end WebApp as an "Authorized cient applications".

This step will add a new object in the manifest file:

"preAuthorizedApplications": [
        {
            "appId": "guid",
            "permissionIds": [
                "guid"
            ]
        }
    ],

5. But it's still not available throuh PowerShell! (https://docs.microsoft.com/en-us/powershell/module/azuread/set-azureadapplication?view=azureadps-2.0)

How can I add this "preAuthorizedApplications" section into the manifest file using Azure PowerShell? Why is it available in the portal but not in PS yet? It's the other way around usually...

08-05-2019 Update based on the answer:

I am getting the access token via a Service Principal:

$adTokenUrl = "https://login.microsoftonline.com/$TenantId/oauth2/token"
$resource = "https://graph.windows.net/"

$body = @{
    grant_type    = "client_credentials"
    client_id     = "$ServicePrincipalId"
    client_secret = "$ServicePrincipalKey"
    resource      = "$resource"
}

$response = Invoke-RestMethod -Method 'Post' -Uri $adTokenUrl -ContentType "application/x-www-form-urlencoded" -Body $body
$token = $response.access_token

According to the docs: https://docs.microsoft.com/en-us/graph/api/application-update?view=graph-rest-beta&tabs=cs

The Service Principal should have at least Application.ReadWrite.OwnedBy, and most Application.ReadWrite.All privileges.

Should I ask our AAD admin to grant the below rights to the Service Principal?

08-05-2019 Update 2: Service Principal has been granted with ALL of the highlighted rights above.

Attempt 1:

Step 1: getting an access_token via the Service Principal (Owner of the Api app to be updated)

$adTokenUrl = "https://login.microsoftonline.com/$(TenantId)/oauth2/token"
$resource = "https://graph.microsoft.com/"

$body = @{
    grant_type    = "client_credentials"
    client_id     = "$(ServicePrincipalId)"
    client_secret = "$(ServicePrincipalKey)"
    resource      = "$resource"
}

$response = Invoke-RestMethod -Method 'Post' -Uri $adTokenUrl -ContentType "application/x-www-form-urlencoded" -Body $body
$token = $response.access_token

Step 2: using this access_token, building up my PATCH request as per Md Farid Uddin Kiron's suggestion, and

Result: The remote server returned an error: (403) Forbidden.

09-05-2019 Update 3: After some kind and detailed explanation and guidance, I got this to work and getting HTTP 204 for my Postman request. Only thing left is to integrate this steps into my pipeline.

See accepted answer. It works. If someone has the same issue, please read the other answer from Md Farid Uddin Kiron.

解决方案

If you want to avoid calling directly the graph API (maybe you are in an azure pipeline using a Service Connection and don't have access to the credentials) you can do this :

$AppName = << WebApp >>
$preAuthorizedApplicationsAppId = <<GUID>>

# Get the application and delegated permission to pre-authorize
$appRegistration = Get-AzureADMSApplication -Filter "displayName eq '$AppName'"
$oauth2Permission = $appRegistration.Api.OAuth2PermissionScopes | Where-Object {$_.Value -eq $AppName -and $_.Type -eq 'Admin'}

# Build a PreAuthorizedApplication object
$preAuthorizedApplication = New-Object 'Microsoft.Open.MSGraph.Model.PreAuthorizedApplication'
$preAuthorizedApplication.AppId = $preAuthorizedApplicationsAppId
$preAuthorizedApplication.DelegatedPermissionIds = @($oauth2Permission.Id)

$appRegistration.Api.PreAuthorizedApplications = New-Object 'System.Collections.Generic.List[Microsoft.Open.MSGraph.Model.PreAuthorizedApplication]'
$appRegistration.Api.PreAuthorizedApplications.Add($preAuthorizedApplication)

# Update the Application object
Set-AzureADMSApplication -ObjectId $appRegistration.Id -Api $appRegistration.Api

This answer comes from this GitHub issue.

这篇关于无法设置“preAuthorizedApplications"通过 Azure Powershell 在新应用注册模块中的对象的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！