Skip to content

Commit 5604661

Browse files
huypubhuypub
authored
Merge pull request #83285 from MicrosoftDocs/master
7/25 AM Publish
2 parents bafb70a + 0f8f65a commit 5604661

File tree

79 files changed

+830
-168
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+830
-168
lines changed

‎articles/active-directory-domain-services/active-directory-ds-getting-started-password-sync-synced-tenant.md

+4-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ The steps involved are different for cloud-only user accounts vs user accounts t
3737
A synced Azure AD tenant is set to synchronize with your organization's on-premises directory using Azure AD Connect. By default, Azure AD Connect does not synchronize NTLM and Kerberos credential hashes to Azure AD. To use Azure AD Domain Services, you need to configure Azure AD Connect to synchronize credential hashes required for NTLM and Kerberos authentication. The following steps enable synchronization of the required credential hashes from your on-premises directory to your Azure AD tenant.
3838

3939
> [!NOTE]
40-
> **If your organization has user accounts that are synchronized from your on-premises directory, you must enable synchronization of NTLM and Kerberos hashes in order to use the managed domain.** A synced user account is an account that was created in your on-premises directory and is synchronized to your Azure AD tenant using Azure AD Connect.
40+
> **If your organization has user accounts that are synchronized from your on-premises directory, you must enable synchronization of NTLM and Kerberos hashes in order to use the managed domain.** A synced user account is an account that was created in your on-premises directory and is synchronized to your Azure AD tenant using Azure AD Connect. The password hash sync is a different process from user/object sync. You need to disable/enable password hash sync to get full password sync, then you will see the batch password hash updates in the application event log.
4141
>
4242
>
4343
@@ -74,6 +74,9 @@ Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConn
7474

7575
Depending on the size of your directory (number of users, groups etc.), synchronization of credential hashes to Azure AD takes time. The passwords will be usable on the Azure AD Domain Services managed domain shortly after the credential hashes have synchronized to Azure AD.
7676

77+
> [!NOTE]
78+
> **Password hash sync** is a different process from user/object sync. You need to disable/enable password hash sync to get full password sync, then you will see the batch password hash updates in the application event log.
79+
7780
## Related Content
7881
* [Enable password synchronization to AAD Domain Services for a cloud-only Azure AD directory](active-directory-ds-getting-started-password-sync.md)
7982
* [Manage an Azure AD Domain Services domain](manage-domain.md)

‎articles/active-directory/develop/authentication-flows-app-scenarios.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ms.devlang: na
1414
ms.topic: quickstart
1515
ms.tgt_pltfrm: na
1616
ms.workload: identity
17-
ms.date: 07/19/2019
17+
ms.date: 07/25/2019
1818
ms.author: jmprieur
1919
ms.custom: aaddev
2020
#Customer intent: As an application developer, I want to learn about authentication flows and application scenarios so I can create applications protected by the Microsoft identity platform.
@@ -194,5 +194,7 @@ Not every application type is available on every platform. You can also use vari
194194
| [Daemon app](scenario-daemon-overview.md) <br/> [![Daemon app](media/scenarios/daemon-app.svg)](scenario-daemon-overview.md) | ![.NET](media/sample-v2-code/logo_NET.png) MSAL.NET ![.NET Core](media/sample-v2-code/logo_NETcore.png)MSAL.NET ![MSAL Java](media/sample-v2-code/logo_java.png) msal4j ![MSAL Python](media/sample-v2-code/logo_python.png) MSAL Python| ![.NET Core](media/sample-v2-code/logo_NETcore.png) MSAL.NET ![MSAL Java](media/sample-v2-code/logo_java.png) msal4j ![MSAL Python](media/sample-v2-code/logo_python.png) MSAL Python| ![.NET Core](media/sample-v2-code/logo_NETcore.png)MSAL.NET ![MSAL Java](media/sample-v2-code/logo_java.png) msal4j ![MSAL Python](media/sample-v2-code/logo_python.png) MSAL Python
195195
| [Web API that calls web APIs](scenario-web-api-call-api-overview.md) <br/> [![Web API that calls web APIs](media/scenarios/web-api.svg)](scenario-web-api-call-api-overview.md) | ![.NET](media/sample-v2-code/logo_NET.png) <br/> ASP.NET + MSAL.NET ![.NET Core](media/sample-v2-code/logo_NETcore.png) <br/> ASP.NET Core + MSAL.NET| ![.NET Core](media/sample-v2-code/logo_NETcore.png) <br/> ASP.NET Core + MSAL.NET| ![.NET Core](media/sample-v2-code/logo_NETcore.png)<br/> ASP.NET Core + MSAL.NET
196196

197+
See also [Microsoft-supported libraries by OS / language](reference-v2-libraries.md#microsoft-supported-libraries-by-os--language)
198+
197199
## Next steps
198200
Learn more about [authentication basics](authentication-scenarios.md) and [access tokens](access-tokens.md).

‎articles/active-directory/develop/reference-v2-libraries.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ms.devlang: na
1414
ms.topic: article
1515
ms.tgt_pltfrm: na
1616
ms.workload: identity
17-
ms.date: 07/19/2019
17+
ms.date: 07/25/2019
1818
ms.author: negoe
1919
ms.reviewer: jmprieur, saeeda
2020
ms.custom: aaddev
@@ -85,6 +85,8 @@ In term of supported operating systems vs languages, the mapping is the followin
8585
| ![Python](media/sample-v2-code/logo_python.png) Python | MSAL Python | MSAL Python | MSAL Python |
8686
| ![Node.Js](media/sample-v2-code/logo_nodejs.png) Node.JS | Passport.node | Passport.node | Passport.node |
8787

88+
See also [Scenarios by supported platforms and languages](authentication-flows-app-scenarios.md#scenarios-and-supported-platforms-and-languages)
89+
8890
## Compatible client libraries
8991

9092
| Platform | Library name | Tested version | Source code | Sample |

‎articles/active-directory/develop/scenario-web-app-call-api-app-configuration.md

+7-2
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,12 @@ The comments in the code below will help you understand some tricky aspects of w
9696
};
9797
```
9898

99-
In ASP.NET Core, building the confidential client application uses information that is in the HttpContext. This `HttpContext` knows about the URL for the Web App, and the signed-in user (in a `ClaimsPrincipal`). It also uses the ASP.NET Core configuration, which has an "AzureAD" section, and which is bound to the `_applicationOptions` data structure of type [AzureAdOptions](https://github.com/aspnet/AspNetCore/blob/master/src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADOptions.cs). This type is defined in ASP.NET Core `Authentication.AzureAD.UI`. Finally the application needs to maintain token caches.
99+
In ASP.NET Core, building the confidential client application uses information that is in the HttpContext. This `HttpContext` knows about the URL for the Web App, and the signed-in user (in a `ClaimsPrincipal`).
100+
101+
It also uses the ASP.NET Core configuration, which has an "AzureAD" section, and which is bound both to:
102+
103+
- the `_applicationOptions` data structure of type [ConfidentialClientApplicationOptions](https://docs.microsoft.com/dotnet/api/microsoft.identity.client.confidentialclientapplicationoptions?view=azure-dotnet)
104+
- the `azureAdOptions` instance of type [AzureAdOptions](https://github.com/aspnet/AspNetCore/blob/master/src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADOptions.cs) defined in ASP.NET Core `Authentication.AzureAD.UI`. Finally the application needs to maintain token caches.
100105
101106
```CSharp
102107
/// <summary>
@@ -113,7 +118,7 @@ private IConfidentialClientApplication BuildConfidentialClientApplication(HttpCo
113118
string currentUri = UriHelper.BuildAbsolute(request.Scheme, request.Host, request.PathBase, _applicationOptions.CallbackPath ?? string.Empty);
114119

115120
// Updates the authority from the instance (including national clouds) and the tenant
116-
string authority = $"{_applicationOptions.Instance}{_applicationOptions.TenantId}/";
121+
string authority = $"{azureAdOptions.Instance}{azureAdOptions.TenantId}/";
117122

118123
// Instantiates the application based on the application options (including the client secret)
119124
var app = ConfidentialClientApplicationBuilder.CreateWithApplicationOptions(_applicationOptions)

‎articles/active-directory/manage-apps/use-scim-to-provision-users-and-groups.md

+6-5
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ Applications that support the SCIM profile described in this article can be conn
7171
*Figure 3: Configuring provisioning in the Azure portal*
7272

7373
1. In the **Tenant URL** field, enter the URL of the application's SCIM endpoint. Example: https://api.contoso.com/scim/v2/
74-
1. If the SCIM endpoint requires an OAuth bearer token from an issuer other than Azure AD, then copy the required OAuth bearer token into the optional **Secret Token** field.
74+
1. If the SCIM endpoint requires an OAuth bearer token from an issuer other than Azure AD, then copy the required OAuth bearer token into the optional **Secret Token** field. If this field is left blank, Azure AD includes an OAuth bearer token issued from Azure AD with each request. Apps that use Azure AD as an identity provider can validate this Azure AD-issued token.
7575
1. Select **Test Connection** to have Azure Active Directory attempt to connect to the SCIM endpoint. If the attempt fails, error information is displayed.
7676

7777
> [!NOTE]
@@ -675,8 +675,9 @@ The easiest way to implement a SCIM endpoint that can accept provisioning reques
675675
1. Enter a name for your application, and select **Add** to create an app object. The application object created is intended to represent the target app you would be provisioning to and implementing single sign-on for, and not just the SCIM endpoint.
676676
1. In the app management screen, select **Provisioning** in the left panel.
677677
1. In the **Provisioning Mode** menu, select **Automatic**.
678-
1. In the **Tenant URL** field, enter the internet-exposed URL and port of your SCIM endpoint. The entry is something like http://testmachine.contoso.com:9000 or http://\<ip-address>:9000/, where \<ip-address> is the internet exposed IP address.
679-
1. If the SCIM endpoint requires an OAuth bearer token from an issuer other than Azure AD, then copy the required OAuth bearer token into the optional **Secret Token** field.
678+
1. In the **Tenant URL** field, enter the internet-exposed URL and port of your SCIM endpoint. The entry is something like http://testmachine.contoso.com:9000 or http://\<ip-address>:9000/, where \<ip-address> is the internet exposed IP address.
679+
680+
1. If the SCIM endpoint requires an OAuth bearer token from an issuer other than Azure AD, then copy the required OAuth bearer token into the optional **Secret Token** field. If this field is left blank, Azure AD includes an OAuth bearer token issued from Azure AD with each request. Apps that use Azure AD as an identity provider can validate this Azure AD-issued token.
680681
1. Select **Test Connection** to have Azure Active Directory attempt to connect to the SCIM endpoint. If the attempt fails, error information is displayed.
681682

682683
> [!NOTE]
@@ -830,7 +831,7 @@ To host the service within Internet Information Services, a developer would buil
830831

831832
### Handling endpoint authentication
832833

833-
Requests from Azure Active Directory include an OAuth 2.0 bearer token. Any service receiving the request should authenticate the issuer as being Azure Active Directory for the expected Azure Active Directory tenant, for access to the Azure Active Directory Graph web service. In the token, the issuer is identified by an iss claim, like "iss":"https://sts.windows.net/cbb1a5ac-f33b-45fa-9bf5-f37db0fed422/". In this example, the base address of the claim value, https://sts.windows.net, identifies Azure Active Directory as the issuer, while the relative address segment, cbb1a5ac-f33b-45fa-9bf5-f37db0fed422, is a unique identifier of the Azure Active Directory tenant for which the token was issued. If the token was issued for accessing the Azure Active Directory Graph web service, then the identifier of that service, 00000002-0000-0000-c000-000000000000, should be in the value of the token’s aud claim. Each of the applications that are registered in a single tenant may receive the same `iss` claim with SCIM requests.
834+
Requests from Azure Active Directory include an OAuth 2.0 bearer token. Any service receiving the request should authenticate the issuer as being Azure Active Directory for the expected Azure Active Directory tenant, for access to the Azure Active Directory Graph web service. In the token, the issuer is identified by an iss claim, like "iss":"https://sts.windows.net/cbb1a5ac-f33b-45fa-9bf5-f37db0fed422/". In this example, the base address of the claim value, https://sts.windows.net, identifies Azure Active Directory as the issuer, while the relative address segment, cbb1a5ac-f33b-45fa-9bf5-f37db0fed422, is a unique identifier of the Azure Active Directory tenant for which the token was issued. The audience for the token will be the application template id for the app in the gallery. The application template id for all custom apps is 8adf8e6e-67b2-4cf2-a259-e3dc5476c621. The application template id for each app in the gallery varies. Please contact ProvisioningFeedback@microsoft.com for questions on the application template id for a gallery application. Each of the applications registered in a single tenant may receive the same `iss` claim with SCIM requests.
834835

835836
Developers using the CLI libraries provided by Microsoft for building a SCIM service can authenticate requests from Azure Active Directory using the Microsoft.Owin.Security.ActiveDirectory package by following these steps:
836837

@@ -868,7 +869,7 @@ Developers using the CLI libraries provided by Microsoft for building a SCIM ser
868869
SystemIdentityModel.Tokens.TokenValidationParameters tokenValidationParameters =
869870
new TokenValidationParameters()
870871
{
871-
ValidAudience = "00000002-0000-0000-c000-000000000000"
872+
ValidAudience = "8adf8e6e-67b2-4cf2-a259-e3dc5476c621"
872873
};
873874

874875
// WindowsAzureActiveDirectoryBearerAuthenticationOptions is defined in

0 commit comments

Comments
 (0)