We have a web service that needs to indentify a user accross his devices, wp8, and win8.
On the phone side we have UserExtendedProperties.GetValue("ANID2"), which get's the anonymous microsoft id.
On Windows8 there's OnlineIdAuthenticator.AuthenticateUserAsync with UserIdentity.SafeCustomerId and other properties, though none of them look like the ANID2.
The OnlineIdAuthenticator api exists on phone, but throws NotImplementedException.
Is there any way to get a common user identifier on win8 and wp8?
Thanks
The best way I know (it's apparently the recommended way too) is to use Azure Mobile Services (http://www.windowsazure.com/en-us/home/scenarios/mobile-services/). There is a free plan that you can use.
With Mobile Services you can use the MobileServiceClient (http://msdn.microsoft.com/en-us/library/microsoft.windowsazure.mobileservices.mobileserviceclient.aspx) to get a unique ID for each user (based on the MS account).
This code gets the user ID:
MobileServiceClient client = new MobileServiceClient(serviceUri);
MobileServiceUser user = await client.LoginAsync(MobileServiceAuthenticationProvider.MicrosoftAccount);
/* The user ID contains the provider name and the ID seperated by a colon */
var userId = user.UserId.Split(':').Last();
You can find some more information here: http://msdn.microsoft.com/en-us/library/jj863454.aspx
and the SDK here: http://www.windowsazure.com/en-us/develop/mobile/developer-tools/
Related
I'm testing Azure Graph API.
and I'm trying to find an API that allows me to retrieve only users that are assigned to a specific app I created.
In app registration page, I gave a user.read.all permission, but the get user API gives me all users that are in the AD and not only that are assigned to the app I created. Should I change the permissions? or to access an another API?
Does anybody know what to do?
Thanks
Additionally, This object id should be based on service principal and not the application registration here.
You can retrieve the object Id from Azure AD->Enterprise Applications->Your app->object ID.
You need to have at least Application.Read.All and Directory.AccessAsUser.All for delegated permissions or Application.Read.All for application permission based on user or application context.
For specific details, you can add $select parameter to show only the displayName of the users assigned to the app.
https://graph.microsoft.com/v1.0/servicePrincipals/{object Id}/appRoleAssignedTo?$select=principalDisplayName
As a workaround you can use the below graph API to get the list of users.
https://graph.microsoft.com/v1.0/servicePrincipals/{ObjectID}/appRoleAssignedTo
Note: The above graph API gives the Object Types User and Service
Principle as well
As discussed in the MS Q &A Platform This endpoint currently does not support filters based on appRoleId. In fact, except that the id parameter can be filtered, the three parameters appRoleId, principalId, and resourceId do not support filtering. Similar issues have been raised before.
I have read the documentation on Microsoft.com and have only got answers about giving Applications authorization to talk to eachother but not how to implement a permission system on each different application that I have.
I basically want to know what the best practices are to implement Authorization on my .Net API and Angular Client.
I would use Azure AD to redirect external and internal users to the Microsoft Sign-In Page, I am missing a fine grained Permission system to authorise users to access different Resources on the API or on the Angular Web Application.
Wo I have to set up a DB for my API with permissions?
How do I add new users to my DB after registering them to my AD?
Im really confused here, so my questions aren´t really as clear as I wish I could write them.
Compiling comments to a proper answer:
Per-user permissions are limited to appRoles, roles that you can give in Azure AD to users. You can also use security groups to achieve a similar thing if you want. But anything finer-grained has to be implemented on the app side.
For identifying users you can use one of two claims in the user Id token / access token. oid or sub. The oid is the unique immutable object id in Azure AD. The sub claim is a unique immutable id within your app. So every app gets the same oid, but a different sub for the same user. The oid claim is also used when calling e.g. MS Graph API to identify the user.
In flutter, the local_auth plugin provides a way to authenticate users using biometrics. But it only returns a Future<bool> response:
var localAuth = LocalAuthentication();
bool didAuthenticate =
await localAuth.authenticateWithBiometrics(
localizedReason: 'Please authenticate to show account balance');
I wonder if there is any way to retrieve some unique ID to know which user has logged into the system.
EDIT: In android, after authentication it returns a BiometricPrompt.AuthenticationResult object which contain a MAC id. I am looking for something like that in flutter.
I don't know how you are implementing the unique with biometric. But here is the plugin which is a unique id provider based on a device.
https://pub.dartlang.org/packages/unique_id
Have a look
Very lightweight plugin, single line code for getting the unique id
What is the best practice in azure mobile services to use different authentication providers (Facebook, Google, Windows e.t.c.) and understand that this three logins belong to the same user.
Out of the box if a user1 choose to use Facebook for authentication on his mobile phone and add some information to the app, and later he (user1) try to login with Google on his tablet, he will not see his information. Because they are two different users with different tokens. And I want to take some additional information from authentication providers (email) and has my own user table which contains email and other profile info shared for user no matter what provider he uses. How could I achieve it?
P.S. I use .NET as a backend and Windows Phone as a client
There isn't an out-of-the-box solution here. You would probably be best served by using a lookup table which maps a static user ID that you define to different identity provider IDs. Then, everywhere that you take a dependency on the user ID, you would do a lookup to match the current user identity to your static identifier. Your user ID is what gets stored everywhere else in the database.
The important detail here is that a Mobile Services token maps to a single provider identity. If you look at the user ID, it is actually provider:providerID. So we need to obtain two tokens and validate both together in order to associate two IDs.
On the client, you would have to manually prompt the user to link accounts. You would stash the current token in memory during this process, log in with the new provider, then call and API on the backend which does the association.
string existingToken = App.MobileService.CurrentUser.MobileServiceAuthenticationToken;
App.MobileService.Logout(); // allows login with new provider
await App.MobileService.LoginAsync("google");
await App.MobileService.InvokeApiAsync("associateToken", existingToken);
On the server, you need to be able to validate existingToken (the new one being implicitly validated by restricting the API to AuthorizationLevel.User)
Within that API, you can validate the token using:
IServiceTokenHandler handler = this.Request.GetConfiguration().DependencyResolver.GetServiceTokenHandler()
ClaimsPrincipal claimsPrincipal;
bool didValidate = handler.TryValidateLoginToken(existingToken, ConfigurationManager.AppSettings["MS_MasterKey"], claimsPrincipal);
You should probably also look up the user ID in your lookup table to avoid conflicts.
So overall that's a rough sketch of a possible solution. Unfortunately there isn't anything more turnkey.
I created rules for "name" and "emailaddress" claims in appfabriclabs' ACS for Windows Live, Facebook, Google and Yahoo... however on the Relying Party side, WIF doesn't seem to see them... I see nameidentifier and identityprovider but nothing else.
is there something else I need in ACS to make this work? how can I check that the claims are actually in there?
* Update *
Apparently, only Windows Live is failing; the other providers return me the claims I configured. Also, the claim for e-mail address (for example) I configured manually since ACS didn't have it... I entered the type as http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress and indicated it as a passthrough... does Windows Live not provide e-mail addresses?
* Update II *
well... as per this article I can't just configure it; I'm going to have to do some other voodoo to get at it... but there must be some way to get more than the /nameidentifier/ because when I log into websites using Windows Live ID I'm shown as being logged in as "ekkis" - anyone know how this is done?
Unfortunately, unless you are developing an app inside MSFT, LiveID can only supply a nameidentitifier. This is by design. if you want to use LiveID and need an e-mail, you need to ask the user for it and then correlate nameidentifier <-> e-mail yourself.