Hello forums! Looking for some help/advice for the following situation: I have an existing web app that we will be adding Azure AD sign in for. The application is multi-tenanted and users currently sign on using our username and password system. The tenants we have may be using an Azure global account or an Azure Germany account. Since Microsoft Azure services for Azure AD are not dependent on a specific region I didn't think this would be an issue (see security + identity section here).
To begin with I have been looking over the documentation and following the Azure samples for multi-tenanted web apps here. The sample app is the base of my initial trial to see how all of this works and how it can then be put into our own system.
So, my sample Azure app is registered on the global version of Azure. The sign up process is successful for a test tenant on the global site. The problem comes from the Germany test tenant.
When the app directs the user to the Germany login endpoint they are prompted for consent as expected. The application sitting in the global Azure is then also copied into the Germany tenant's Enterprise Application area (you can see it click on it to see the information and publisher - which actually says "Foreign Cloud Applications"). So that seems to have worked out ok also.
But, the original Azure sample makes use of the Graphs API to retrieve the tenant ID for onboarding. Because this has a different endpoint in Azure Germany and Azure Global I assume it uses region specific feature. Attempts to use AcquireTokenByAuthorizationCode as the sample does give the following error: AADSTS70002: Error validating credentials. AADSTS50012: Invalid client secret is provided.
The code from the sample app:
// ---If the response is indeed from a request we generated
// ------get a token for the Graph, that will provide us with information abut the caller
ClientCredential credential = new ClientCredential( context.IdaClientID, context.Password );
AuthenticationContext authContext = new AuthenticationContext( context.IdaAzureActiveDirectoryInstance );
AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode( code, new Uri( Request.Url.GetLeftPart( UriPartial.Path ) ), credential );
In the mean time I have been getting around this by replacing that part of the sample with an authentication challenge request on the owin context.
HttpContext.GetOwinContext( ).Authentication.Challenge( new AuthenticationProperties {
RedirectUri = "/OnBoarding/Step2?state=" + myTenant.IssValue }, "AzureAD" );This passes and gives me access to a ClaimsPrinciple from which the tenant ID can be found and link the Azure tenant to the local DB tenant. But since all the samples I have seen get the token for the Graph API I wasn't entirely sure that the work around was ok...
If the application has no intention of using the Graph API does it matter? Or does the whole situation really require an app registration in the Global site for tenants residing on global and one in the Germany site for those tenants?
