[New Hack] - 062 Entra ID B2B

062-EntraIDB2B/.wordlist.txt

@@ -0,0 +1,20 @@
+Entra
+EntraIDB
+EntraIDB2B
+EasyAuth
+PKCI
+OpenID
+ServiceNow
+PIM
+authr
+idp
+Authenticator
+Passcode
+aud
+yourtenantname
+EasyAuth
+microsoftonline
+Bappaditya
+Banerjee
+McCollum
+natively

062-EntraIDB2B/Coach/README.md

@@ -0,0 +1,66 @@
+# What The Hack - EntraIDB2B - Coach Guide
+
+## Introduction
+
+Welcome to the coach's guide for the EntraIDB2B What The Hack. Here you will find links to specific guidance for coaches for each of the challenges.
+
+
+## Coach's Guides
+
+- Challenge 00: **[Prerequisites - Ready, Set, GO!](./Solution-00.md)**
+     - Create an Azure AD tenant
+     - Azure AD single tenant setup
+- Challenge 01: **[Register new application](./Solution-01.md)**
+     - Register a new application in an Azure AD tenant
+     - Understand the concepts of multi-tenant apps, service principals, authentication vs authorization, security tokens
+- Challenge 02: **[Test the sign-in](./Solution-02.md)**
+	 - Supported account types set to "Accounts in this organizational directory only (single-tenant)" with redirect link to authr.biz
+     - Use an authr.biz link to test the sign in
+- Challenge 03: **[Invite a guest user](./Solution-03.md)**
+     - B2B set up / invite a new guest user
+     - Use an authr.biz link to test the sign in for the guest user / test sign in using the app set up
+- Challenge 04: **[Integrate Azure AD authentication into an Azure App Service (EasyAuth)](./Solution-04.md)**
+	 - Integrate Azure AD authentication into an Azure App Service (EasyAuth)
+- Challenge 05: **[Integrate Azure AD authentication into an application](./Solution-05.md)**
+	 - Integrate Azure AD authentication into an application
+        - ASP.Net (Authorization Code Flow)
+        - SPA (Angular) (PKCI)  
+        - Desktop application (Client Credential Flow)
+- Challenge 06: **[Deploy to Azure](./Solution-06.md)**
+	 - Deploy to Azure
+     - Publish the Web App to the web site update its app registration redirect URIs to include the App Service URL(s)
+     - Managed identity
+
+## Coach Prerequisites
+
+This hack has pre-reqs that a coach is responsible for understanding and/or setting up BEFORE hosting an event. Please review the [What The Hack Hosting Guide](https://aka.ms/wthhost) for information on how to host a hack event.
+
+The guide covers the common preparation steps a coach needs to do before any What The Hack event, including how to properly configure Microsoft Teams.
+
+### Student Resources
+
+Before the hack, it is the Coach's responsibility to download and package up the contents of the `/Student/Resources` folder of this hack into a "Resources.zip" file. The coach should then provide a copy of the Resources.zip file to all students at the start of the hack.
+
+Always refer students to the [What The Hack website](https://aka.ms/wth) for the student guide: [https://aka.ms/wth](https://aka.ms/wth)
+
+**NOTE:** Students should **not** be given a link to the What The Hack repo before or during a hack. The student guide does **NOT** have any links to the Coach's guide or the What The Hack repo on GitHub.
+
+
+## Azure Requirements
+
+This hack requires students to have access to an Azure subscription where they can create and consume Azure resources. These Azure requirements should be shared with a stakeholder in the organization that will be providing the Azure subscription(s) that will be used by the students.
+
+
+
+## Repository Contents
+
+_The default files & folders are listed below. You may add to this if you want to specify what is in additional sub-folders you may add._
+
+- `./Coach`
+  - Coach's Guide and related files
+- `./Coach/Solutions`
+  - Solution files with completed example answers to a challenge
+- `./Student`
+  - Student's Challenge Guide
+- `./Student/Resources`
+  - Resource files, sample code, scripts, etc meant to be provided to students. (Must be packaged up by the coach and provided to students at start of event)

062-EntraIDB2B/Coach/Solution-00.md

@@ -0,0 +1,22 @@
+# Challenge 00 - Prerequisites - Ready, Set, GO! - Coach's Guide 
+
+**[Home](./README.md)** - [Next Solution >](./Solution-01.md)
+
+## Notes & Guidance
+
+Login to portal.azure.com using your microsoft account and in the Microsoft tenant.
+
+Create a new tenant 
+
+Select the checkbox beside the newly created tenant and hit the Switch button.
+
+You should be switched to the newly created tenant.
+
+When you create a new Entra ID tenant, you become the first user of that tenant. As the first user, you're automatically assigned the Global Administrator role. 
+
+
+Create another new user by navigating Users page and add Global Administrator role with it.
+
+  - Create an authenticator entry for the newly created user
+
+

062-EntraIDB2B/Coach/Solution-01.md

@@ -0,0 +1,14 @@
+# Challenge 01 - register-app - Coach's Guide 
+
+[< Previous Solution](./Solution-00.md) - **[Home](./README.md)** - [Next Solution >](./Solution-02.md)
+
+## Notes & Guidance
+
+
+Register the app in the newly created tenant by navigating App Registration.
+
+Select Accounts in this organizational directory only( Single Tenant)
+
+Enter https://authr.biz/ as the Redirect URIs.
+
+Select the Access Token and ID Token checkbox in the Authentication tab

062-EntraIDB2B/Coach/Solution-02.md

@@ -0,0 +1,26 @@
+# Challenge 02 - Sign Me In! - Coach's Guide 
+
+[< Previous Solution](./Solution-01.md) - **[Home](./README.md)** - [Next Solution >](./Solution-03.md)
+
+## Notes & Guidance
+
+Open the [authr](https://authr.biz/?requesttype=OpenIdConnect&scope=openid+profile&responsetype=id_token&responsemode=form_post&additionalparameters=prompt%3dlogin&importtype=AzureAD&tenant=microsoft.onmicrosoft.com&clientid=your-client-id) link.
+
+Make sure to change the tenant=microsoft.onmicrosoft.com in the query parameter to your newly created tenant. It should be tenant=yourtenantname.onmicrosoft.com
+
+Verify that Authorization Endpoint and Token Endpoint reflects the change.
+
+Copy the Client ID from the Azure Portal by navigation Entra ID - App Registration - Overview - Application (client) ID.
+
+No need to put the Client Secret in the form.
+
+Verify Additional Parameters textbox, should be populated as prompt=login.
+
+Everything else should remain as default.
+
+Login using newly created user in your new tenant.
+
+Verify the claims in the JWT. Check the "aud", "iss", "idp" claims specifically.
+
+
+

062-EntraIDB2B/Coach/Solution-03.md

@@ -0,0 +1,37 @@
+# Challenge 03 - <Title of Challenge> - Coach's Guide 
+
+[< Previous Solution](./Solution-02.md) - **[Home](./README.md)** - [Next Solution >](./Solution-04.md)
+
+## Notes & Guidance
+
+Create a new guest user in your Entra ID tenant by clicking Invite guest user in User screen.
+
+Use your personal email address while creating the guest user. You should get an invitation email from Microsoft.
+
+You can put a personal message while inviting the user.
+
+You can accept the invitation by opening your email and click the Accept Invitation button. 
+
+Open the [authr](https://authr.biz/?requesttype=OpenIdConnect&scope=openid+profile&responsetype=id_token&responsemode=form_post&additionalparameters=prompt%3dlogin&importtype=AzureAD&tenant=microsoft.onmicrosoft.com&clientid=your-client-id) link.
+
+Make sure to change the tenant=microsoft.onmicrosoft.com in the query parameter to your newly created tenant. It should be tenant=yourtenantname.onmicrosoft.com
+
+Verify that Authorization Endpoint and Token Endpoint reflects the change.
+
+Copy the Client ID from the Azure Portal by navigation Entra ID - App Registration - Overview - Application (client) ID.
+
+Sign In using your personal email address. An One Time Passcode should be sent to your personal email address.
+
+Once you enter the Passcode, you might be asked to create the account in Authenticator app. Go ahead and do that.
+
+Once you sign in, you should see the ID Token in the authr.biz site.
+
+Check the "idp" claim. It should be "mail". Check the "iss" claim, it is still your tenant. So, for B2B user, Identity provider is the third party provider based on the email address you provide but the token would be generated by your Entra ID Tenant.
+
+Enable guest self-service sign up via user flows by navigating External Identities - External collaboration settings.
+
+Create the sign-up user flow for the B2B user.
+
+Navigate to the user flow, you can add external identity providers, custom user attribute etc. 
+
+You could associate your application with the user flow to show to the users.

062-EntraIDB2B/Coach/Solution-04.md

@@ -0,0 +1,31 @@
+# Challenge 04 - <Title of Challenge> - Coach's Guide 
+
+[< Previous Solution](./Solution-03.md) - **[Home](./README.md)** - [Next Solution >](./Solution-05.md)
+
+## Notes & Guidance
+
+For this tutorial, you need a web app deployed to App Service. You can use an existing web app, or you can follow one of the quickstart to create and publish a new web app to App Service.
+
+  - [ASP.Net Core](https://learn.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?pivots=development-environment-vs&tabs=net70)
+  - [Node.js](https://learn.microsoft.com/en-us/azure/app-service/quickstart-nodejs?pivots=development-environment-vscode&tabs=windows)
+  - [Java](https://learn.microsoft.com/en-us/azure/app-service/quickstart-java?pivots=platform-linux-development-environment-maven&tabs=javase)
+
+Create the Web app in the Microsoft tenant using your microsoft account. Please note that you will not be able to create the web app in your newly created Entra ID tenant as there is no subscription associated with it.
+
+Whether you use an existing web app or create a new one, take note of the following:
+
+ - Web app name.
+ - Resource group that the web app is deployed to.
+
+Enable authentication and authorization for your web app by navigating Authentication - Add Identity Provider. Select Microsoft as the identity provider.
+
+In the App registration type, select "Provide the details of an existing app registration".
+
+ - Copy and paste the Client Id from the registered app in your challenge#1.
+ - Create a client secret for your app by navigating App registration - Certificates & secrets. Copy the value of secret and put in the previous screen
+ - Issuer URL should https://login.microsoftonline.com/tenant-id
+
+
+Add the redirect URL in your app registration as https://web-app-name.azurewebsites.net/.auth/login/aad/callback.
+
+Sign In with the web app with your user or guest user.

062-EntraIDB2B/Coach/Solution-05.md

@@ -0,0 +1,19 @@
+# Challenge 05 - Integrate your application with Entra ID - Coach's Guide 
+
+[< Previous Solution](./Solution-04.md) - **[Home](./README.md)** - [Next Solution >](./Solution-06.md)
+
+## Notes & Guidance
+
+Follow the Quickstart tutorial.
+
+You can skip the register the application section and re-use the app registered in the previous challenge in your tenant.
+
+For ASP.NET Core, [Download](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/archive/aspnetcore3-1-callsgraph.zip) the ASP.NET Core Project and COnfigure your ASP.NET Core Project. 
+
+For ASP.NET, [Download](https://github.com/AzureADQuickStarts/AppModelv2-WebApp-OpenIDConnect-DotNet/archive/master.zip) the ASP.NET project and Configure your ASP.NET Project.
+
+For Single Page Application, Follow the Tutorials for any of the Javascript framework such as Angular, React etc.
+
+Build and tun the application.
+
+Sign In with the users you created in previous challenge.

062-EntraIDB2B/Coach/Solution-06.md

@@ -0,0 +1,19 @@
+# Challenge 06 - Deploy your app to Azure!! - Coach's Guide 
+
+[< Previous Solution](./Solution-05.md) - **[Home](./README.md)**
+
+## Notes & Guidance
+
+Follow the QuickStart for the deployment of your app.
+
+QuickStart are available for ASP.NET and other languages.
+
+For Angular or any other SPA app, build your angular app, create an azure app service, configure the app service. Under the "Settings" section, click on "Configuration". Here, you need to set the Node.js version to match your Angular app's requirements. Select the "General Settings" tab and choose the desired Node.js version.
+
+Deploy your angular app using Azure CLI or Azure Portal.
+
+If you have a desktop application that you want to deploy, Azure App Service is not the appropriate service for that purpose.
+
+Add the app service Url as the redirect Url in the registered app in your tenant as part of previous challenge.
+
+Sign In with the users you created in previous challenge.