1. AZURE AD Haishi DX, 2016

2. Agenda Basic concepts Exercise 1: Creating a new Azure AD tenant and a new user Exercise 2: Enable web app Azure AD authentication

3. BASIC CONCEPTS

4. Check-in at airport DMV 32A

5. Claim-based authentication DMV 32A User Service Provider Broker Identity Provider Security Token Name: Haishi Seat: 32A

6. user identity provider (Azure AD) relying party (service) request access please authenticate with a trusted IP authenticate… security token request access with token verify token grant access 1 2 3 4 6 7 5 Azure AD workflow (ws-Federation)

7. oAuth 2.0

8. EXERCISE 1 Creating a new Azure AD tenant and a new user

9. Steps 1. Login to classic Azure portal (https://manage.windowsazure.com).https://manage.windowsazure.com 2. NEW > APP SERVICES > ACTIVE DIRECTORY > DIRECTORY > CUSTOM CREATE 3. Enter NAME, DOMAIN NAME, COUNTRY OR REGION, and check the This is a B2C directory checkbox. 4. Once the directory is created, click on the USERS tab, and then click on the ADD USER icon in the task bar. 5. Follow the wizard to create a new user in your organization. At the last screen, click on the create button to generate a password. Make sure the password is copied before discarding the dialog. 6. Click on the ADD USER icon again and create a global administrator.

10. EXERCISE 2 Enable web app Azure AD authentication

11. Steps 1. Launch Visual Studio 2015. 2. Create a new ASP.NET Web Application. 3. On the creation wizard, click on the Change Authentication button. Leave the Host in the cloud checkbox checked. 4. On Change Authentication dialog, select the Work and School Accounts option. 5. Enter your Azure AD’s domain name, and check the Read directory data checkbox. Click OK to continue. 6. You’ll be prompted to log in. Log in using your MSA account. 7. Click the OK button to create the project.

12. Steps (cont.) 8. On Create App Service dialog, enter name, subscription, resource group (new or use existing one), App Service plan (new or use existing one), and then click on the Create button to continue. 9. Wait till the project is created. 10. Right-click the project and select the Publish… menu.

13. Steps 11. On Publish Web dialog, make sure the Enable Organizational Authentication checkbox is checked, and your domain name is entered, and then click on the Publish button to continue. 12. Once the website launches, click on the Accept button. 13. Click on the Sign Out button. 14. Start a new browser in private mode.

14. Steps 15. Navigate to the website again. 16. Sign in using one of the new user accounts from your Azure AD tenant. 17. You’ll be prompted to change the temporary password. Enter a new password. 18. Click on the Accept button. 19. [Optional] Observe how the.pubxml file is updated. 20. [Optional] Observe how Azure AD configuration is updated.