Application Registration
To register your application, go to the Application Registration Portal (https://apps.dev.microsoft.com/). Elect to sign in with your company credentials.
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph01.png)
You will be redirected to the company’s authentication page
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph02.png)
If ADSF finds a valid token for you, you will be directed to the application registration portal. Otherwise you’ll get the same logon page you see for many other MS cloud-hosted apps. Once you have authenticated, click “Add an app” in the upper right-hand corner of the page.
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph03-1024x233.png)
Provide a descriptive name for the application and click “Create”
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph04.png)
Click “Generate New Password” to generate a new application secret. Copy it into a temporary document. Copy the “Application Id” into the same temporary document.
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph05-1024x527.png)
Click “Add Platform” and select “Web”
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph06-1024x485.png)
Enter the appropriate redirect/logout URLs (this will be application specific – in the pre-built examples, the post-authentication redirect URL is http://localhost:5000/login/authorized
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph07.png)
Delegated permissions impersonate the signed in user, application permissions use the application’s credentials to perform actions. I use delegated permissions, although there are use cases where application permissions would be appropriate (batch jobs, for instance).
Add any permissions your app requires – for simple authentication, the default delegated permission “User.Read” is sufficient. If you want to perform additional actions – write files, send mail, etc – then you will need to click “Add” and select the extra permissions.
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph08.png)
Profile information does not need to be entered, but I have entered the “Home page URL” for all of my applications so I am confident that I know which registered app corresponds with which deployed application (i.e. eighteen months from now, I can still figure out site is using the registered “ADSF Graph Sample” app and don’t accidentally delete it when it is still in use).
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph09.png)
Click Save. You can return to your “My Applications” listing to verify the app was created successfully.
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph10-1024x244.png)
Application Implementation:
To use an example app from Microsoft’s repository, clone it.
git clone https://github.com/microsoftgraph/python-sample-auth.git
Edit the config.py file and update the “CLIENT_ID” variable with your Application Id and update the “CLIENT_SECRET” variable with your Application Secret password. (As they note, in a production implementation you would hash this out and store it somewhere else, not just drop it in clear text in your code … also if you publish a screen shot of your app ID & secret somewhere, generate a new password or delete the app registration and create a new one. Which is to say, do not retype the info in my example, I’ve already deleted the registration used herein.)
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph11.png)
Install the prerequisites using “pip install -r requirements.txt”
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph12.png)
Then run the application – in the authentication example, there are multiple web applications that use different interfaces. I am running “python sample_flask.py”
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph13.png)
Once it is running, access your site at http://localhost:5000
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph14.png)
The initial page will load; click on “Connect”
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph15.png)
Enter your company user ID and click “Next”
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph01.png)
This will redirect to the company’s sign-on page. For in-domain computers or computers that have already authenticated to ADSF, you won’t have to enter credentials. Otherwise, you’ll be asked to logon (and possibly perform the two-factor authentication verification).
Voila, the user is authenticated and you’ve got access to some basic directory info about the individual.
![](https://lisa.rushworth.us/wp-content/uploads/2018/09/MSGraph16-1024x379.png)
|