• May 10, 2020

VIDEO – AngularJS SPA and WebAPI SQL database secured with Azure AD – MS FLOW EMAIL(Part 3 of 3)

Continuing series with more detail on security.   Add MS Flow to read REST API data with Azure AD token.     MS Flow acts as HTTP client same as end user web browser.   MS Flow can execute HTTP POST pair to first download Access Token and then retrieve HTTP JSON data with Azure AD “Bearer” token.   Chrome F12 and Postman are essential tools for mapping out HTTP POST format with headers, body, and expected JSON reply schema.

When complete, we have daily MS Flow scheduled email which downloads JSON from WebAPI via secure AzureAD token.  Great way to protect API endpoints and provide rich email features.  Cheers.  

This post is part of series with three posts:

• VIDEO – AngularJS SPA and WebAPI SQL database secured with Azure AD – SETUP (Part 1 of 3)
• VIDEO – AngularJS SPA and WebAPI SQL database secured with Azure AD – SECURITY GROUP (Part 2 of 3)
• VIDEO – AngularJS SPA and WebAPI SQL database secured with Azure AD – MS FLOW EMAIL (Part 2 of 3)

Code

HTTP POST

https://login.microsoftonline.com/spjeff.onmicrosoft.com/oauth2/token

grant_type=client_credentials
&client_id=APP_ID_HERE
&client_secret=APP_SECRET_HERE
&resource=APP_ID_HERE

Video

Screenshots

References

• https://github.com/spjeff/spjeff-active-directory-angularjs-singlepageapp-master/
• https://laurakokkarinen.com/calling-microsoft-graph-from-microsoft-flow-and-other-daemon-apps-with-delegated-permissions/
• https://us.flow.microsoft.com/

• May 10, 2020
• No Comments
• Uncategorized

• May 10, 2020

VIDEO – AngularJS SPA and WebAPI SQL database secured with Azure AD – SECURITY GROUP (Part 2 of 3)

Continuing series with more detail on security.   Add C# code to detect Azure AD group membership.   When REST API call for data is made to WebAPI HTTPS endpoint we already validate Azure AD authentication token (user part of AAD).

Building upon this, we can add AAD Security Group membership detection for business logic “If user is member of HELLOWORLD group then provide data.  Otherwise access denied.”

For that, we translate the AAD Security Group into GUID number by locating the group at https://portal.azure.com.   Steps cover how to update AAD token, C# dot net code for WebAPI endpoint, and verify secrurity with Postman.  Cheers.  

This post is part of series with three posts:

• VIDEO – AngularJS SPA and WebAPI SQL database secured with Azure AD – SETUP (Part 1 of 3)
• VIDEO – AngularJS SPA and WebAPI SQL database secured with Azure AD – SECURITY GROUP (Part 2 of 3)
• VIDEO – AngularJS SPA and WebAPI SQL database secured with Azure AD – MS FLOW EMAIL(Part 3 of 3)

HTTP API Test Responses

• https://localhost:44326/api/Test/GetData
• “ACCESS DENIED, NOT MEMBER OF GROUP”
• “REAL DATA HERE”

API Permission Grants

• GroupMember.Read.All
• User.Read

Video

Screenshots

References

• https://github.com/spjeff/spjeff-active-directory-angularjs-singlepageapp-master/
• https://stackoverflow.com/questions/35087307/efficiently-check-role-claim
• https://stackoverflow.com/questions/6096299/extension-methods-must-be-defined-in-a-non-generic-static-class

• May 10, 2020
• No Comments
• Uncategorized