Download as POTX, PPTX
Uploaded byEric Shupps
Mastering Modern Authentication and Authorization for SharePoint and Office Applications
The document outlines various authentication and authorization methods utilized in Microsoft Azure and SharePoint services, including single sign-on (SSO), OAuth, and permissions management. It details deployment across multi-tenant applications, management of access tokens, and specifics on requesting and granting permissions. Additionally, it provides references and links to further resources for implementing these systems.
More Related Content
Similar to Mastering Modern Authentication and Authorization for SharePoint and Office Applications
![[Shupps] Introduction to Azure Web Applications for Office and SharePoint Dev...](https://cdn.slidesharecdn.com/ss_thumbnails/adfcuh8osf2qrrkkg2ys-signature-d4523b3bf020616e67040d2a940ba8bf9aeab187b20da49956548f98de22ea12-poli-180606121949-thumbnail.jpg?width=640&height=640&fit=bounds)
Mastering Modern Authentication and Authorization for SharePoint and Office Applications
- 3. Eric Shupps Office Servers& Services MVP @eshupps sharepointcowboy slideshare.net/eshupps linkedin.com/in/eshupps github.com/eshupps
- 4.
- 5.
- 6.
- 7. User authentication on-premisesand in the cloud Managing identities across different application types Obtaining, storing and processing authorization tokens Traversing applications within a single tenant context Deploying applications to multiple tenants Supporting mobile devices and apps
- 8.
- 9. Wide range ofsupported authentication types Distributed identity management Instance-based consent framework Multiple contexts
- 10. Inherits authentication typefrom parent Centralized identity management (out of scope) Instance-based consent framework Inherited context
- 11. Single sign onacross all cloud applications Centralized API-accessible identity management User or tenant consent framework (with optional group assignment) Explicit context per endpoint
- 13.
- 14. Open standard forapp integration and authorization Authentication independent Token-based scheme for enforcement of explicit trust relationships Permission scopes (grants) define access boundaries Explicit or inherited authorization context
- 15. Authorization Endpoint Application Registration User/Admin Consent AuthorizationCode Access Token Refresh Token User App Provider User requests access App requests Request Token Provider returns Request Token App builds auth link w/ Request Token User requests URL + Request Token Provider returns access token User requests URL + Access Token App validates access token Access token validated User granted access 1 2 3 Reference: https://oauth.net/2/
- 16. Authorization Exchange authorization codes for accesstokens Refresh tokens enable long-lived sessions Designed for native clients and server- side API’s Client Credential Requires app authorization consent from administrator Shared secrets or certificates used to request tokens Designed for service apps and server-to- server scenarios Implicit Retrieve access tokens directly from single endpoint No refresh tokens (local session management only) Designed for SPA's (requires manifest modification)
- 17. Use authorization/request tokensto obtain short-lived access tokens Include access tokens in resource calls Store refresh tokens to obtain new access tokens upon expiration Track tokens by tenant (multi-tenant), app or user Force token expiration to prompt authentication Utilize client secret only in confidential client apps
- 18. Property Policy StringAffects Default Minimum Maximum Access Token Lifetime AccessTokenLifetime Access tokens, ID tokens, SAML 2 tokens 1 hour 10 minutes 1 day Refresh Token Max Inactive Time MaxInactiveTime Refresh tokens 90 days 10 minutes 90 days Single-Factor Refresh Token Max Age MaxAgeSingleFactor Refresh tokens (for any users) Until revoked 10 minutes Until revoked Multi-Factor Refresh Token Max Age MaxAgeMultiFactor Refresh tokens (for any users) Until revoked 10 minutes Until revoked Single-Factor Session Token Max Age MaxAgeSessionSingle Factor Session tokens (persistent and non- persistent) Until revoked 10 minutes Until revoked Multi-Factor Session Token Max Age MaxAgeSessionMulti Factor Session tokens (persistent and non- persistent) Until revoked 10 minutes Until revoked Reference: http://bit.ly/2IUuJNo
- 20. ADAL.js* AadHttpClient & MSGraphClient Manage permissionsin Azure portal via SharePoint Online Client Extensibility app Include scope requests in manifest Tenant-wide admin consent Manageable via O365 admin center BEWARE THE SINGLETON! https://docs.microsoft.com/en-us/sharepoint/dev/spfx/use-aadhttpclient Reference: http://bit.ly/2wTQok5
- 21. Register app inAzure Configure redirect URI Configure manifest with oauth2AllowImplicitFlow = true Assign permission grant Use ADAL.js for authorization Leverage the Authenticator for SSO across applications Reference: http://bit.ly/2rTEzW1
- 23.
- 24. Scope URI AvailableRights http://sharepoint/content/tenant Read, Write, Manage, FullControl http://sharepoint/content/sitecollection Read, Write, Manage, FullControl http://sharepoint/content/sitecollection/web Read, Write, Manage, FullControl http://sharepoint/content/sitecollection/web/l ist Read, Write, Manage, FullControl http://sharepoint/bcs/connection Read http://sharepoint/search QueryAsUserIgnoreAppPrincipal http://sharepoint/social/tenant Read, Write, Manage, FullControl http://sharepoint/social/core Read, Write, Manage, FullControl http://sharepoint/social/microfeed Read, Write, Manage, FullControl http://sharepoint/taxonomy Read,Write Reference: http://bit.ly/2wW4lOr
- 26. Graph Azure AD TENANT SCOPED DOESNOT Reference: http://bit.ly/2IUcqId PS C:> Enable-SPOTenantServicePrincipal
- 27. Types Application Delegated Administrative Level Minimum: “Signin and read user profile” Beware permission level restrictions for consent Resources Exchange Yammer Azure AD SharePoint Online Power BI Azure Management O365 Management Skype Reference: http://bit.ly/2rV8FII
- 29.