O365 Login Problem #7091

2 Answer(s)

• 

  1

  simplexsrl created 5 years ago

  After some tries and research in ANZ code, I found a solution.

  Edit appsettings.json as follow:

  "WsFederation": {
        "IsEnabled": "true",
        "Authority": "https://sts.windows.net/{azureTenantId}/",
        "ClientId": "<GET IT FROM AZURE PORTAL>",
        "Tenant": "<GET IT FROM AZURE PORTAL>",
        "MetaDataAddress": "https://login.microsoftonline.com/{azureTenantId}/federationmetadata/2007-06/federationmetadata.xml"
      },
  

  What is missing in your docs (and in Azure's docs too :D) is Authority property. It is not clear what is used for and where retrieve it! I found it debugging step-by-step your code and auth communication flow!

  Last, you have to modify your Federation Metadata Manifest - from Azure Portal - to include the email claim otherwise ANZ auth flow can't recognize user info and goes in exception!

  To do that, simply edit optionalClaims JSON property as follow:

  "optionalClaims": {
      "idToken": [
          {
              "name": "email",
              "source": null,
              "essential": true,
              "additionalProperties": []
          }
      ],
      "accessToken": [
          {
              "name": "email",
              "source": null,
              "essential": true,
              "additionalProperties": []
          }
      ],
      "saml2Token": []
      },
  

  With this modifcations, authentication flow success and user were created in ANZ! But ... there is alway a last issue ... user was created with a strange username, due to the fact that somewere in the code something failed. But this is not an issue at all, because you (admin) have to login to ANZ for activate this newly user, so at same time, you can simply change its username!

  JUST A LITTLE SUGGESTION to improve the usability. Bypass CheckSelfRegistrationIsEnabled(); inside UserRegistrationManager.RegisterAsync if user comefrom an External Provider. In this way you can disable users self-registration via login page to ensure application access only to a domain's users ... like an intranet!

  I did that adding an optional boolean argument to that method, that is used to conditionally call CheckSelfRegistrationIsEnabled, but I'm sure that you can do it better ... in a more fashioned way :D

  Save Cancel
• 

  0

  ismcagdas created 5 years ago

  Support Team

  Thanks @simplexsrl for your valuable comments, we are trying to improve AspNet Zero's documentation and we will consider your suggestions.

  Save Cancel