yagopv/DurandalAuth — pull request #24 by gentledepp (2014-08-07 13:25:26+00:00)
Title: Added support for Azure Active Directory through OpenIdConnect

I followed the examples
https://github.com/AzureADSamples/WebApp-OpenIDConnect-DotNet
and
http://blogs.msdn.com/b/webdev/archive/2014/03/28/owin-security-components-in-asp-net-openid-connect.aspx
in order to add Azure Active Directory Authentication to my DurandalAuth site and thought this might be useful for somebody.

There was an issue with the loginProvider property you get in the AccountController.GetExternalLogin method.
The problem is, that, when using OpenIdConnect, the provider is no constant value for all AAD users, but a unique name for each tenant. So it is https://sts.windows.net/
See: http://msdn.microsoft.com/en-us/library/azure/dn195587.aspx

So I had to motify the AccountController, the appsecurity.js and the externalloginconfirmation.js a little.
* In the AccountController I needed to weaken the comparison between provider and externalLogin.LoginProvider.
// LX hat to do this hack for OWIN as the loginProvider is always a URL starting with https://sts.windows.net instead of OpenIdConnect!
if (provider == "OpenIdConnect" && !externalLogin.LoginProvider.StartsWith("https://sts.windows.net/")
|| (provider != "OpenIdConnect" && externalLogin.LoginProvider != provider))
{
Authentication.SignOut(DefaultAuthenticationTypes.ExternalCookie);
return new ChallengeResult(provider, this);
}
* In the appsecurity.js I needed to urlEncode the loginProvider

* and of course in the externalloginconfirmation.js I needed to urlDecode the loginProvider

Although I doubt that this is the optimal solution, at least it works.
I do not know how to get the name of the tenant by id to beautify the "manage account" view which otherwise shows the ugly link "https://sts.windows.net/"

To use it you simply need to follow the instructions of the first link to link your web-application to Azure Active Directory (I think it was step 2) and then set the properties in web config

Do you have any thoughts on that?

Also, please note that the OpenIdConnect library I use is still a prerelease and in order for it to work, I needed to add all the other OWIN dlls as prerelease as well!