Azure Active Directory Library For Android

Azure Active Directory Library for Android

We have finally announced the Azure Active Directory(AAD) features at Build conference. It was exciting to hear about AAD at Keynotes.

This is not an official blog post, but I will show some details about the Android Library and app setup.  You can easily libraries access from https://github.com/MSOpenTech/azure-activedirectory-library-for-android and https://github.com/MSOpenTech/azure-activedirectory-library-for-ios

Prerequisites for Android development:

Install Git source control

Install Android SDK: https://developer.android.com/sdk/index.html?hl=sk

Make sure you can run some samples under the sdk/samples

Update SDKs and install SDK 15-19

It supports maven based installation, but you need to setup maven sdk deployer to actually do anything with latest Android SDKs since maven repos don't have the latest Android SDKs. You could skip Maven based installation and pull the dependent libraries directly. You could put them under the adal/libs folder.

• Android-Support-v4: Fix project properties and it will be added
• gson library: https://code.google.com/p/google-gson/downloads/list

If you insist to setup maven environment, I will quickly walk through the details for your environment setup.

Install Maven 3.1.1: http://maven.apache.org/download.cgi

Maven helps to manage dependencies and build your project. Our sample app will be compiled with Eclipse ADT, so i am not forcing you to make maven based app.

You need to put the latest android SDKs into local maven repo. You could use these commands to install SDK19 and support library:

git clone https://github.com/mosabua/maven-android-sdk-deployer.git
cd maven-android-sdk-deployer\platforms\android-19
mvn clean install
cd ..\..\extras\compatibility-v4
mvn clean install

You can clone and install from cmd line:

git clone https://github.com/MSOpenTech/azure-activedirectory-library-for-android.git
cd azure-activedirectory-library-for-android
mvn clean install

How to Add Android Library to your Project

1. Add reference to your project as Android library. Please check here:http://developer.android.com/tools/projects/projects-eclipse.html
2. Add project dependency for debugging in your project settings
3. Update your project's AndroidManifest.xml file to include the authentication activity:

  <uses-permission android:name="android.permission.INTERNET" />
  <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
  <application
        android:allowBackup="true"
        android:debuggable="true"
        android:icon="@drawable/ic_launcher"
        android:label="@string/app_name"
        android:theme="@style/AppTheme" >

        <activity
            android:name="com.microsoft.adal.AuthenticationActivity"
            android:label="@string/title_login_hello_app" >
        </activity>
  ....
  <application/>

Setup Native Client App at Azure Active Directory

1.  Register your WEBAPI service app at Azure Active Directory(AAD),https://manage.windowsazure.com
1. You need APP ID URI parameter to get token
2. Register your client native app at AAD
1. You need clientId and redirectUri parameters
2. Select webapis in the list and give permission to previously registered(Step5) WebAPI

Go to Azure portal:

Create Directory entry if you don't have at Azure portal

 Click Active Directory to Create an App:

Add an explication that you are developing

Follow the wizard to setup the app.

Define Native Client app to create Android app entry

Redirect Uri needs to be unique. It is better to link to your domain. If you don't have, you can use your azure active directory address like "yourtenant.onmicrosoft.com".

Define unique RedirecUri entry

Configure the entry for permissions

Update your app for App settings

• Resource is required, Clientid is required. PromptBehavior helps to ask for credentials to skip cache and cookie. Callback ill be called after authorization code is exchanged for a token. It will have an object of AuthenticationResult, which has accesstoken, date expired, and idtoken info.
1. You can always call acquireToken to handle caching, token refresh and credential prompt if required. Your callback implementation should handle the user cancellation for AuthenticationActivity. ADAL will return a cancellation error, if user cancels the credential entry.

• Authority Url and ADFS

  ADFS is not recognized as production STS, so you need to turn of instance discovery and pass false for validation at AuthenticationContext constructor.
  Authority url needs to be in the form of STS instance and tenant name: https://login.windows.net/yourtenant.onmicrosoft.com

Usage of AuthenticationContext

1. Create an instance of AuthenticationContext at your main Activity. You can look at sample projects that is used for testing.

  mContext = new AuthenticationContext(MainActivity.this, authority, true); // This will use SharedPreferences as default cache

mContext is a field in your activity. Copy this code block to handle the end of AuthenticationActivity after user enters credentials and receives authorization code:

 @Override
 protected void onActivityResult(int requestCode, int resultCode, Intent data) {
     super.onActivityResult(requestCode, resultCode, data);
     if (mContext != null) {
         mContext.onActivityResult(requestCode, resultCode, data);
     }
 }

To ask for a token, you need to define a callback:

private AuthenticationCallback<AuthenticationResult> callback = new AuthenticationCallback<AuthenticationResult>() {

        @Override
        public void onError(Exception exc) {
            if (exc instanceof AuthenticationException) {
                textViewStatus.setText("Cancelled");
                Log.d(TAG, "Cancelled");
            } else {
                textViewStatus.setText("Authentication error:" + exc.getMessage());
                Log.d(TAG, "Authentication error:" + exc.getMessage());
            }
        }

        @Override
        public void onSuccess(AuthenticationResult result) {
            mResult = result;

            if (result == null || result.getAccessToken() == null
                    || result.getAccessToken().isEmpty()) {
                textViewStatus.setText("Token is empty");
                Log.d(TAG, "Token is empty");
            } else {
                // request is successful
                Log.d(TAG, "Status:" + result.getStatus() + " Expired:"
                        + result.getExpiresOn().toString());
                textViewStatus.setText(PASSED);
            }
        }
    };

Ask for a token:

 mContext.acquireToken(MainActivity.this, resource, clientId, redirect, userid, PromptBehavior.Auto, "",
                callback);

• Querying cache items

  ADAL provides Default cache in SharedPrefrecens with some simple cache query fucntions. You can get the current cache from AuthenticationContext with:

   ITokenCacheStore cache = mContext.getCache();
  

  You can also provide your cache implementation, if you want to customize it.

  mContext = new AuthenticationContext(MainActivity.this, authority, true, yourCache);
  

  Logger

  ADAL provides simple callback logger. You can set your callback for logging.

  Logger.getInstance().setExternalLogger(new ILogger() {
      @Override
      public void Log(String tag, String message, String additionalMessage, LogLevel level, ADALError errorCode) {
      ...
      }
  }
  // you can manage min log level as well
  Logger.getInstance().setLogLevel(Logger.LogLevel.Verbose);

Multi Resource Refresh Token

You may have several Web API services that you use in your app. When you get a token for resource1, you could use refresh token from resource1 to get access token for resource2. This will work if you use same authority, clientid and userid in the second call. Internal cache will help to reuse multi resource refresh tokens.

mContext.acquireToken(MainActivity.this, resource1, clientId, redirect, userid, PromptBehavior.Auto, "",
                callback);

mContext.acquireToken(MainActivity.this, resource2, clientId, redirect, userid, PromptBehavior.Auto, "",
                callback);

Second call here will not display prompt screen. It will only send refresh token web request.

Happy coding!
------------------------The END------------------------

WebAPI project secured by Windows Azure Active Directory in Visual Studio 2013

I really liked the recent Azure Active Directory(AAD) integration on Visual Studio 2013. It enables to add AAD authentication to your projects. Vittorio talked about that in his post. I tried that and added some screenshots for you to show the process for WebAPI publishing at Azure Websites.

First step is to get Visual Studio 2013: You can follow the links at http://www.microsoft.com/visualstudio/eng/downloads to get the initial version. I am assuming you want to create a webapi project for your mobile platform.

Figure: Add project

After clicking ok button, you will see new button there in the web projects. When you click "change authentication" button, you can set the organizational account at active directory that you created at Azure AD. It is very easy to add Azure Active Directory, if you have azure subscriptions. You can look at this tutorial to see about adding Active Directory at Azure.

Figure: Project list

Once you clicked the "change authentication" button, you need to enter your admin user at Azure Active Directory(AAD). This is not your live account. It needs to be your admin user at AAD. If everything looks good, Visual Studio 2013 will create your WebAPI project and add entries to Web.config file. It is using Owin, so you will see related references added to your project. You will also see startup file inside App_Start folder.

Figure: Login screen to enter AAD admin user credentials

Figure: Startup file for configuration

You can publish this project to Azure Website easily. You can use default ValuesController to test the process and later add your implementation for different controllers. Default endpoint will ask for token at "/api/values/". If you remove "authorize" attribute form controller, it will not check Tokens in the request. With simple authorize attribute, you will have all the logic to check tokens inside the coming requests.

To create Azure website, you can go to Azure portal and click wizard to create the website:

Figure: Azure website

After your website is created, you can get the publish profile as shown below:

Figure: you can click link to get the profile

You can publish the webAPI project by right clicking the publish button at your project You need to set correct publish settings, if you don't want your config to be changed at publication. 

Figure: Publish settings

You deployed a sample app to your Azure Active Directory and it is ready to be used by your AAD users. You will see one entry in the Azure Active Directory for your app. ClientID, ClientSecret and RedirectUri and permissions are important things to configure for your app. I will talk about those configuration in next posts and how to use WebAPI in different platforms. Stay tune!

Metaprogramming in Ruby

Ruby is a dynamically typed language. You can define methods and classes at run time. Ruby has several metaprogramming styles.

One way is to use "define_method":

#defining new class
c = Class.new
c.class_eval do
    define_method :hi do
        puts "hello say hi"
    end

    define_method :get_price  do |productname, location|
      puts "4$ for product #{productname} #{location}"
    end

    #method with default location
    define_method :get_price_2  do |productname, defaultlocation="rr"|
      puts "4$ for product #{productname} #{defaultlocation}"
    end


end

c.new.hi
c.new.get_price("bike","charlotte")
c.new.get_price_2("bike" )
c.new.get_price_2("bike","not rr" )

Prints:
hello say hi
4$ for product bike charlotte
4$ for product bike rr
4$ for product bike not rr

Inside this code block, we are creating a new class with three methods. First method is not taking any parameter. Second method is  taking two parameters. Third method is taking two parameters and last parameter is with the default value.

Another method for metaprogramming is using eval keyword. You can compile any string into a code. That is scary and somewhat crazy to me. It might be good for Artificial Intelligence projects, but not much useful for production application that you need to maintain and troubleshoot.

class MyClass
   eval %{def hi
              puts "Eval code string at runtime hello world"
          end
        }

end

d = MyClass.new
d.hi

Prints:

Eval code string at runtime hello world

This code block is taking a string and running that. You can do similar code eval syntax in javascript and php as well.

You can also define classes inside the loop and use that class outside or inside the loop.

2.times do
  class Classtimes
    puts "hello world from Class time objectid #{self.object_id} classid #{self.class.object_id} "
  end
  class Classtime2
    def printit
      puts "hello world from Classtime2 printit objectid #{self.object_id} classid #{self.class.object_id} "
    end
  end
  Classtime2.new.printit
end

Inside this code block, first class uses same object to print. Second class will create new objects for each iteration, but class will be defined once. Here is the output:

hey world from Class time objectid 18939288 classid 15445296 
hey world from Classtime2 printit objectid 18939156 classid 18939192 
hey world from Class time objectid 18939288 classid 15445296 
hey world from Classtime2 printit objectid 18938988 classid 18939192 

If you define the same class again outside of this loop, you may be wondering about the outcome. Ruby lets you extend the class,so it will use the same class to add method. It is similar to using partial keyword in C#, but you can have dynamic extensions with Ruby.

#right after 2.times block code
class Classtime2
  def printitagain
    puts "hey world from Classtime2 printitagain objectid #{self.object_id} classid #{self.class.object_id} "
  end
end
Classtime2.new.printitagain

Output:
hey world from Classtime2 printitagain objectid 18938904 classid 18939192

puts "you can look at instance methods and variables easily"
p MyClass.new.instance_variables
p MyClass.instance_methods(false)
p Classtime2.instance_methods(false)

Output:
you can look at instance methods and variables easily
[]
[:hi]
[:printit, :printitagain]






TODO for this subject:
Module extension
class << self
extending methods for single object