You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Supported account types / Who can use this application or access this API?: select `Accounts in this organizational directory only (Default Directory only - Single tenant)`
@@ -36,7 +36,7 @@
36
36
37
37
2. Retrieve Tenant and Client information.
38
38
39
-
In **Azure Active Directory** / **App Registration**, select **ODM Application** and click **Overview**:
39
+
In **Microsoft Entra Id** / **Manage** / **App Registration**, select **ODM Application** and click **Overview**:
40
40
41
41
* Application (client) ID: **Client ID**. It will be referenced as `CLIENT_ID` in the next steps.
42
42
* Directory (tenant) ID: **Your Tenant ID**. It will be referenced as `TENANT_ID` in the next steps.
@@ -45,7 +45,7 @@
45
45
46
46
3. Generate an OpenID client secret.
47
47
48
-
In **Azure Active Directory** / **App registrations**, select **ODM Application**:
* From the Overview page, click on the link Client credentials: **Add a certificate or secret** or on the **Manage / Certificates & secrets** tab
51
51
* Click + New Client Secret
@@ -58,24 +58,24 @@
58
58
59
59
4. Add Claims.
60
60
61
-
In **Azure Active Directory** / **App registrations**, select **ODM Application**, and in **Manage / Token Configuration**:
61
+
In **Microsoft Entra Id** / **Manage** / **App registrations**, select **ODM Application**, and in **Manage / Token Configuration**:
62
62
63
-
* Add Optional Email ID Claim
63
+
* Add Optional **email** ID Claim
64
64
* Click +Add optional claim
65
65
* Select ID
66
-
* Check Email
67
-
* Click Add
68
-
69
-
* Add Optional Email Access Claim
70
-
* Click +Add optional claim
71
-
* Select Access
72
-
* Check Email
66
+
* Check **email**
73
67
* Click Add
74
68
75
69
* Turn on Microsoft Graph email permission
76
70
* Check Turn on the Microsoft Graph email permission
77
71
* Click Add
78
72
73
+
* Add Optional **email** Access Claim
74
+
* Click +Add optional claim
75
+
* Select Access
76
+
* Check **email**
77
+
* Click Add
78
+
79
79
* Add Group Claim
80
80
* Click +Add groups claim
81
81
* Check Security Groups
@@ -85,19 +85,19 @@
85
85
86
86
To allow ODM rest-api to use the password flow with email as user identifier and the client-credentials flow with client_id as user identifier, we need to create a new claim named "identity" that will take the relevant value according to the flow:
87
87
88
-
In **Azure Active Directory** / **Enterprise applications**, select **ODM Application**, and in **Manage / Single sign-on**:
88
+
In **Microsoft Entra Id** / **Manage** / **Enterprise applications**, select **ODM Application**, and in **Manage / Single sign-on**:
89
89
90
90
* Click Edit in the "Attributes & Claims" section
91
91
* Click + Add new claim
92
-
* Name: identity
92
+
* Name: **identity**
93
93
* Fill 2 Claim conditions in the exact following order:
94
94
1. User Type: Any / Scoped Groups: 0 / Source: Attribute / Value: <CLIENT_ID>
95
95
2. User Type: Members / Scoped Groups: 0 / Source: Attribute / Value: user.mail
96
96
* Click Save
97
97
98
98
6. API Permissions.
99
99
100
-
In **Azure Active Directory** / **App Registration**, select **ODM Application**, and then click **API Permissions**.
100
+
In **Microsoft Entra Id** / **Manage** / **App Registration**, select **ODM Application**, and then click **API Permissions**.
101
101
102
102
* Click Grant Admin Consent for Default Directory
103
103
@@ -109,14 +109,21 @@
109
109
110
110
7. Manifest change.
111
111
112
-
In **Azure Active Directory** / **App Registration**, select **ODM Application**, and then click **Manifest**.
112
+
In **Microsoft Entra Id** / **Manage** / **App Registration**, select **ODM Application**, and then click **Manifest**.
113
+
114
+
The Manifest feature (a JSON representation of an app registration) is currently in transition.
115
+
[**AAD Graph app manifest**](https://learn.microsoft.com/en-us/entra/identity-platform/azure-active-directory-graph-app-manifest-deprecation) will be deprecated soon and not editable anymore starting 12/2/2024. It will be replaced by the **Microsoft Graph App Manifest**
113
116
114
117
As explained in [accessTokenAcceptedVersion attribute explanation](https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-app-manifest#accesstokenacceptedversion-attribute), change the value to 2.
115
118
116
119
ODM OpenID Liberty configuration needs version 2.0 for the issuerIdentifier. See the [openIdWebSecurity.xml](templates/openIdWebSecurity.xml) file.
117
120
118
121
It is also necessary to set **acceptMappedClaims** to true to manage claims. Without this setting, you get the exception **AADSTS50146: This application is required to be configured with an application-specific signing key. It is either not configured with one, or the key has expired or is not yet valid.** when requesting a token.
119
122
123
+
With **Microsoft Graph App Manifest**:
124
+
***acceptMappedClaims** is relocated as a property of the **api** attribute
125
+
***accessTokenAcceptedVersion** is relocated as a property of the **api** attribute and renamed **requestedAccessTokenVersion**
Deploy the **Loan Validation Service** production_deployment ruleapps using the **production deployment** deployment configuration in the Deployments>Configurations tab.
0 commit comments