How to authenticate users of your apps with the Microsoft identity platform

Matthijs Hoekstra explains the basics of modern authentication with the Microsoft identity platform using several demo application scenarios including JavaScript, .NET Core, and .NET Core console apps.


Quickstarts (note: the guide content and code may be updated from what appears in the video.)


Timestamps:

Basics of modern authentication - 0:29
DEMO: configure a JavaScript app using a quick start guide - 6:40
Useful ID token resources- 11:41
Redirect URIs - 12:43
DEMO: ASP .NET Core app configuration - 14:41
Our “golden rules” for handling tokens - 16:26
What about background applications? - 23:47
DEMO: .NET Core console (daemon) app authentication - 25:47
Who guarantees security? - 27:39

[samjohnson]

Well presented! Thanks for the information and I look forward to watching more of your videos.

[musings]

How do you refresh the token? If you use angular for front end.. you can not really store refresh token on backend.

[grahamwilton]

Excellent workshop - on the use of localhost redirect URL Matthijs says "I've done a terrible thing, first of all it is not https and its a URI anybody could actually host". But isn't localhost required so that devs can do their dev work on their laptops or build servers? If so should they be doing something different in the way they develop apps?

[gwmagnify]

I have never seen a guide or tutorial from Microsoft that goes through AADB2C, one SPA, that uses one WebAPI that uses Identity and Auth Code Flow with PKCE. The tutorials all refer to a previous tutorial, and the tutorial that configures the app, always use implicit flow, or Auth Code Flow without PKCE. Do you know if this is not correct?

[pauliusvasiliauskas]

Would be nice to have a guide hot to set up custom claims in access token, by adding information from graph api like directory.department, directory.jobtite

[rparavindra]

How to use impersonation in EWS mail box authentication. Please share sample code using azure

[huizhao]

How to deal with multiple redirecturls? Say we have localhost, dev url, qa etc.