Authenticate with Windows Azure Active Directory directly without opening a web browser

Question

I called this question and this MSDN post , but could not fix the problem.

The following code demonstrates how to perform WAAD authentication using a web browser:

AuthenticationContext auth = new AuthenticationContext("https://login.windows.net/" + myDomain); AuthenticationResult result = auth.AcquireToken(resource, clientID, resourceAppIDURI); 

This opens the browser, and the user is prompted for details.

However, I have a GUI client that can independently accept the username / password / domain. Thus, we intend to collect details from the GUI client and directly provide the WAAD server and receive user authentication.

How to do it?

Just by looking at AcquireToken() overloads, I got some hints (this might also be wrong):

 AuthenticationResult AcquireToken (string resource, Credential credential); 

and

 AuthenticationResult AcquireToken (string authorizationCode, string redirectUri, ClientCredential credential); 

But I don't understand how to create a class ClientCredential (a subclass of Credential ). It is important to note that this class belongs to the namespace Microsoft.WindowsAzure.ActiveDirectory.Authentication .
The following are its constructors:

 ClientCredential(string clientId, SecureString secureClientSecret); ClientCredential(string clientId, string clientSecret); 

Searching the Internet, I could not get many answers, I got this link . But again, the SecureString part is a mystery to me. How can a username / password / domain be transferred using SecureString ?

Answer 1

An older version of AAL supported this. However, it was removed about 2–3 months ago (as was the sample showing it). Now user authentication can only be achieved through the browser authentication window.

I'm not 100% sure, but I think the motivation is to create a standard / sequential login (for end users). If you are using a Windows 8 application, this WebAuthenticationBroker tool handles this, and users will find out about it for all Windows 8 applications. If you are a web application, then the AzureAD login page is presented and recognizable.

Answer 2

The ClientCredential AcquireToken overload that you found is to use the client ID and secret key for authentication (so that clients cannot share their name and password).

Create a "web application" in WAAD and the application will be provided with the client id. This is the first parameter in your ClientCredential() constructor.

To get the second parameter, add the key to your WAAD web application.

You might want to upgrade to the latest version of AAL, now called ADAL. NuGet Link

Answer 3

Take a look at the following link:

Using ADAL.NET to authenticate users through Username / Password