Windows Azure Active Directory Graph API Edward Wu Sr Program Manager Microsoft Corporation SIA322

Windows Azure Active Directory Graph API

Edward WuSr Program ManagerMicrosoft Corporation

SIA322

Windows Azure Active Directory Graph APIIntroduction

Goals Querying Directory Data Application Authentication/AuthorizationDemosRoadmap Summer/FallResources/Getting Started

Windows Azure Active Directory Graph API

Windows Azure Active Directory

Is here now – it is integrated with Office 365 and Windows Azure, available to all apps.Integrated modern identity management service for Office 365, Azure & 3rd party web applicationsSingle sign-on across Microsoft and 3rd party applications with increased security control

Graph APIAccess directory data with RESTful Graph APIIntegrates with consumer identity and social networks

Windows Azure Active Directory Graph APIGoals

Make it Easy for applications to integrate with the Azure Active Directory Lay the foundation for creation of higher-level capabilities: look ups, people pickers, security group membership, cross-company collaboration …Provide high usability and interoperability

Solution: new RESTful interface for Windows Azure ADSupport HTTP/REST-based protocol for accessing all directory information

Support HTTP response codes and Return directory objects in JSON/XML

Compatible with Odata V3 for more complex queries & metadata (www.odata.org)Leverage OAuth 2.0 for Authentication

Connecting to Windows Azure Active Directory

5

WindowsAzureActive

Directory

Directory SynchOn PremisesActive

Directory

PowerShell

Admin Portal

Multi Tenant EnvironmentDivided into Tenants

Typed objects Example: Users, Groups, Contacts, Roles, Licenses

RelationshipsMember/Member of, Manager/Direct reports

REST OAuth

New Applications

Applications

LDAPKerberos

REST Interface

Administration Scripting

,PowerShell

Windows Azure Active Directory Resourceshttps://directory.windows.net/Contoso.com/

TenantDetailsUsersGroupsContactsRolesSubscribed Skus

Extended Windows Azure AD for the cloud:Licensing, Provisioning, DirSynch status, Domain Status

REST interface for Directory AccessRequest URI structure

<Service root>/<resource path>[? Query string options]

https://directory.windows.net/contoso.com/Users?$filter=DisplayName eq ‘Adam Barr”

Navigating the URI structurehttps://directory.windows.net/$metadatahttps://directory.windows.net/contoso.com/https://directory.windows.net/contoso.com/TenantDetailshttps://directory.windows.net/contoso.com/Usershttps://directory.windows.net/contoso.com/Groupshttps://directory.windows.net/contoso.com/Roleshttps://directory.windows.net/contoso.com/Contactshttps://directory.windows.net/contoso.com/SubscribedSkusExample of filters

?$filter=City eq ‘Redmond‘?$filter=GivenName eq ‘Adam' and Surname eq ‘Barr‘?$filter=Surname ge ‘Jackson' and Surname le ‘Jz'

ResponseResponse body JSON or XMLHTTP Response Code

GET a User Object

Returned JSON user object"d": {"__metadata": {"id": "https://directoryppe.windows.net/PharmaSales.info/Users('User_d7aadc28-a2ea-4c0e-aabe-f13c675b3e9c')",

"uri": "https://directoryppe.windows.net/PharmaSales.info/Users('User_d7aadc28-a2ea-4c0e-aabe-f13c675b3e9c')","type": "Microsoft.Online.DirectoryApi.User"

},"Manager": {"__deferred": {"uri": "https://directoryppe.windows.net/PharmaSales.info/Users('User_d7aadc28-a2ea-4c0e-aabe-f13c675b3e9c')/Manager"}

},"DirectReports": {"__deferred": {"uri": "https://directoryppe.windows.net/PharmaSales.info/Users('User_d7aadc28-a2ea-4c0e-aabe-f13c675b3e9c')/DirectReports"}

},"MemberOf": {"__deferred": {"uri": "https://directoryppe.windows.net/PharmaSales.info/Users('User_d7aadc28-a2ea-4c0e-aabe-f13c675b3e9c')/MemberOf"}},

"ObjectId": "d7aadc28-a2ea-4c0e-aabe-f13c675b3e9c","ObjectReference": "User_d7aadc28-a2ea-4c0e-aabe-f13c675b3e9c","ObjectType": "User","AccountEnabled": true,"AssignedLicenses": {"__metadata": {"type": "Collection(Microsoft.Online.DirectoryApi.AssignedLicense)"},"results": [ ]},"AssignedPlans": {"__metadata": {"type": "Collection(Microsoft.Online.DirectoryApi.AssignedPlan)"},"results": [ ]},"City": "Redmond","Country": "US","Department": null,"DirSyncEnabled": null,"DisplayName": "Adam Barr","FacsimileTelephoneNumber": null,"GivenName": "Adam","JobTitle": null,"LastDirSyncTime": null,"Mail": null,"Mobile": null,"OtherMails": {"__metadata": {"type": "Collection(Edm.String)"},"results": [ ]}"PasswordPolicies": "None","PhysicalDeliveryOfficeName": null,"PostalCode": "98052","PreferredLanguage": null,"ProvisionedPlans": {"__metadata": {"type": "Collection(Microsoft.Online.DirectoryApi.ProvisionedPlan)"},"results": [ ]},"ProvisioningErrors": {"__metadata": {"type": "Collection(Microsoft.Online.DirectoryApi.ProvisioningError)"},"results": [ ]},"ProxyAddresses": {"__metadata": {"type": "Collection(Edm.String)"},"results": [ ]},"State": "WA","StreetAddress": "One Microsoft Way","Surname": "Barr","TelephoneNumber": "425-882-8080","UsageLocation": "US","UserPrincipalName": "Adam.Barr@PharmaSales.info"}}

Request: https://directoryppe.windows.net/PharmSales.info/Users(‘Adam.Barrr@PharmaSales.info’)

Referenced Links Users

Bob

Jill

Adam

/Manager

/DirectReports

https://Directory.windows.net/Contoso.com/Users(‘Bob@Contoso.com’)/Manager

https://Directory.windows.net/contoso.com/Users(‘Jill@Contoso.com')/MemberOf

https://Directory.windows.net/Contoso.com/Users(‘Adam@Contoso.com')/DirectReports

US Sales Team

Bob

Sue

Jim

/MemberOf

Referenced Links Groups

US Sales Team

https://directory.windows.net/contoso.com/Groups('Group_1a9f7ab7-4292-414e-ad33-11dc679f364c')/MemberOf

GlobalSales Team- US Sales- EuropeBob

Sue

Jill

Jim

https://directory.windows.net/contoso.com/Groups('Group_1a9f7ab7-4292-414e-ad33-11dc679f364c')/Members

Querying and Data management

Users are sorted by DisplayName, other entities are un-sortedOData Query Options

$filterLogical And operations, Eq, Ge, LePaging - $tophttp://www.odata.org

Authentication and Authorization for LOB Application

Directory

Application

Return token

Request JWT token(pass input claims)

REST Front EndValidates ACStoken

AuthorizationCheckHTTP Request

with JWT Token

Windows Azure Active Directory

OAuth Endpoint

Navigating the REST interface

Sample Application

Application Authentication and Authorization

1. Company Admin adds an Application Service Principal to his tenant and assigns a Role (Read and/or Write)

2. Developer configures the App to use Application Service Principal Id and App Secret (cert or symmetric key)

3. Developer Runs the App - REST Front End validates ACS

token and Authorizes the request

Paul Reid

Titus

Data security and governance for unstructured information

TITUS solutions protect information assetsPrevent data leaksRaise user security awarenessComply with regulations

Embeds classification metadata into unstructured information

EmailsOffice documentsOther file types

Military

Government

Healthcare

Transportation

Energy &

Utilities

Banking

Insurance

Telecom

Chemical & Petroleum

Retail

Over 300 Enterprise Customers

Across All Industries

2 Million TITUS Users

What the Graph API means to TITUS

18

TITUS believes Metadata is foundational to Information Protection.

More importantly TITUS brings context to the application and understanding of metadata.

The introduction of a REST based Graph API to Windows Azure AD provides;

Access to AD from off Premises.Easier federated access to all hosted Tenants.The Social Graph Aspect allows for “context” of the user attributes in relation to others;

This will facilitate stronger Information Protection through TITUS Products

TITUS Demonstration Scenario

Marcus has been traveling outside of the office for the past several weeks sending emails from the road.He needs to send an email to his engineering team members about their current Project.Since he has been traveling, he has not heard that Anna has been transferred into sales.His company has a policy that non-engineering staff can not receive emails about engineering projects

TITUS solution using Graph API

Windows Azure

AD

HTTP Request Get Group Members of EngineeringWith Token

EngineeringGroup

Derek

Ed

Derek

Ed Anna

Engineering

HTTP Response with Engineering Group Memberships

Michael Brengs

Optimal IDM

Michael BrengsDirector of Sales

Mike.Brengs@optimalidm.comCell +1-813-376-6020

http://www.optimalidm.com

Overview of Optimal IdM

Company Highlights Founded in 2005100% organically grownProfitable every quarter since inceptionNo debt or outside investmentHeadquartered in Tampa, Florida Global Presence (solutions on 5 continents)

Core Microsoft Identity & Access Partner Independent Software Vendor (ISV) and Consulting PartnerMember of the Security Partner Advisory Council (PAC)

Meet under NDA with Microsoft on quarterly basis

What is the Virtual Identity Server (VIS)?

VIS is a proxy server to LDAPProvides a real-time proxy of multiple LDAP serversApplications can now support multi-forest with no changes to application.Data is not stored in VIS; it is proxiedAdditional security and control Additional functionality – data transformationAdapters (VISA’s) – to data sources

LDAP Virtual Directory

Office 365 & Cloud DirectoryHave an out-of-the-box Graph API VISA that can read/write to Office 365 (Standard LDAP to read cloud)Will be the mechanism VIS for Office 365 solution provisions/de-provisions to Office 365.

partner

Orcas ConsultingName: Jeremy PalencharTitle: PartnerCompany: Orcas Consulting

jeremyp@orcasconsulting.com

announcing

Email: sales@orcasconsulting.com

Graph API Management Agent for FIM 2010 from Orcas Consulting

Demo Environment

Azure ADpre-production tenant

FIM 2010

On-PremIn Cloud

Salesforce.comorcas development tenantImport

Export

demo

Graph API Management Agent for FIM 2010

Graph API Development – Thoughts & Lessons Learned

FIM MA Page Size & Graph API Continuation TokensReference Objects & Attributes

Easy to consume data using OData for .NetVery little custom code for MA implementationAuthentication tested using symmetric and PKI (asymmetric) tokens

Preview: POST – Creating a new user

{"AccountEnabled":true,"City":Seattle,"Country":US,"DisplayName":“Bob Jones","GivenName": Bob,"PostalCode":98125,"PreferredLanguage":EN,"State":WA,"StreetAddress":123 Main Street,"Surname":Jones,"UsageLocation":US,"UserPrincipalName":Bob.Jones@contoso.com}

POST /Contoso.com/Users HTTP/1.1Host: https://directory.Windows.netContent-Type: application/json;odata=verboseAuthorization: Bearer ey1287Z………X-ms-dirapi-contract-version: 0.5

Azure AD Graph API Developer Preview- interface to change, no production SLA

Summer: July Preview Read Aug Preview Write Future - Additional Directory properties - User Authentication/Delegation - ISV Commerce scenarios - Notifications and Provisioning Give Us Feedback – what do you need?

34

Getting StartedComing soon

Watch this blog: http://blogs.msdn.com/windowsazureReview MSDN content

http://msdn.microsoft.com/en-us/library/hh974476.aspx

Download the Sample application Run it against a test tenant in Windows Azure AD

Get your own Windows Azure Active Directory Test CompanyOffice 365 Trial Sign-up www.office365.comConfigure your Tenant, Service Principal and Application

Use provided PowerShell Scripts to configure App and to add sample directory data

F5 - Build and Run your app – extend it, play with it, integrate itRate the App, ask Questions and give feedback

AzureADGraphFeedback@microsoft.com

Connecting to Windows Azure Active Directory

36

WindowsAzureActive

Directory

PowerShell

Directory Synch

Admin Portal

On PremisesActive

Directory Multi Tenant EnvironmentDivided into Tenants

Typed objects Example: Users, Groups, Contacts, Roles, Licenses

RelationshipsMember/Member of, Manager/Direct reports

REST OAuth

YourApplications

Applications

LDAPKerberos

REST Interface

Related Content that was presented

Find Me Later : at the Party and Online

OSP321 Active Directory Integration with Microsoft Office 365, Tuesday

SIA205 Running AD on Windows Azure VM, Monday

SIA209 A Lap Around Windows Azure Active Directory, Monday

Resources

Watch this Space: http://blogs.msdn.com/windowsazure

MSDN Documentation: Windows Azure AD Graph API http://msdn.microsoft.com/en-us/library/hh974476.aspx

Preview Sample Application download linkhttp://go.microsoft.com/fwlink/?LinkID=95732&clcid=0x409

SIA, WSV, and VIR Track Resources

Talk to our Experts at the TLC

#TE(sessioncode)

DOWNLOAD Windows Server 2012 Release Candidate

microsoft.com/windowsserverHands-On Labs

DOWNLOAD Windows Azure

Windowsazure.com/teched

Resources

Connect. Share. Discuss.

http://northamerica.msteched.com

Learning

Microsoft Certification & Training Resources

www.microsoft.com/learning

TechNet

Resources for IT Professionals

http://microsoft.com/technet

Resources for Developers

http://microsoft.com/msdn

Complete an evaluation on CommNet and enter to win!

Please Complete an Evaluation Your feedback is important!

Multipleways to Evaluate Sessions

Scan the Tagto evaluate thissession now on myTechEd Mobile

© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to

be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS

PRESENTATION.

Why REST for the Directory?REST

Broad Industry AdoptionSuper Simple - Http - GET, PUT, POST, DELETELots of available client librarieshttp://www.ics.uci.edu/~fielding/pubs/dissertation/rest_arch_style.htm

REST for the DirectoryEasy integration with any app on any platform