Skip to content

Commit e853008

Browse files
rayluorayluo
committed
Use the new identity.flask
1 parent 61e3981 commit e853008

14 files changed

+303
-245
lines changed

‎.env.sample

Lines changed: 0 additions & 31 deletions
This file was deleted.

‎.env.sample.b2c

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# This sample can be configured to work with Azure AD B2C.
2+
#
3+
# If you are using an Azure AD B2C tenant,
4+
# configure the B2C_TENANT_NAME variable with your tenant name, such as "contoso".
5+
B2C_TENANT_NAME=<your tenant name>
6+
7+
# You will also need to configure the following variables with your B2C policies.
8+
SIGNUPSIGNIN_USER_FLOW=B2C_1_signinpolicy
9+
10+
# Optionally, you may configure the following variables with your B2C policies.
11+
EDITPROFILE_USER_FLOW=B2C_1_ProfileEditPolicy
12+
RESETPASSWORD_USER_FLOW=B2C_1_Password_Reset_Policy
13+
14+
# The following variables are required for the app to run.
15+
CLIENT_ID=<client id>
16+
CLIENT_SECRET=<client secret>
17+
18+
# Your project's redirect URI that you registered in Azure Portal.
19+
# For example: http://localhost:5000/redirect
20+
REDIRECT_URI=<your redirect uri>
21+
22+
# The following variables are required if the app needs to call an API.
23+
#
24+
# Multiple scopes can be added into the same line, separated by a space.
25+
# Here we use a Microsoft Graph API as an example
26+
# You may need to use your own API's scope.
27+
#SCOPE=User.Read
28+
#
29+
# The sample app will acquire a token to call this API
30+
#ENDPOINT=https://graph.microsoft.com/v1.0/me
31+

‎.env.sample.entra-id

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# This sample can be configured to work with Microsoft Entra ID.
2+
#
3+
# If you are using a Microsoft Entra ID tenant,
4+
# configure the AUTHORITY variable as
5+
# "https://login.microsoftonline.com/TENANT_GUID"
6+
# or "https://login.microsoftonline.com/contoso.onmicrosoft.com".
7+
#
8+
# Alternatively, use "https://login.microsoftonline.com/common" for multi-tenant app.
9+
AUTHORITY=<authority url>
10+
11+
# The following variables are required for the app to run.
12+
CLIENT_ID=<client id>
13+
CLIENT_SECRET=<client secret>
14+
15+
# Your project's redirect URI that you registered in Azure Portal.
16+
# For example: http://localhost:5000/redirect
17+
REDIRECT_URI=<your redirect uri>
18+
19+
# The following variables are required if the app needs to call an API.
20+
#
21+
# Multiple scopes can be added into the same line, separated by a space.
22+
# Here we use a Microsoft Graph API as an example
23+
# You may need to use your own API's scope.
24+
#SCOPE=User.Read
25+
#
26+
# The sample app will acquire a token to call this API
27+
#ENDPOINT=https://graph.microsoft.com/v1.0/me
28+

‎.env.sample.external-id

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# This sample can be configured to work with Microsoft External ID.
2+
#
3+
# If you are using a Microsoft Entra External ID for customers (CIAM) tenant,
4+
# configure AUTHORITY as https://contoso.ciamlogin.com/contoso.onmicrosoft.com
5+
AUTHORITY=<authority url>
6+
7+
# The following variables are required for the app to run.
8+
CLIENT_ID=<client id>
9+
CLIENT_SECRET=<client secret>
10+
11+
# Your project's redirect URI that you registered in Azure Portal.
12+
# For example: http://localhost:5000/redirect
13+
REDIRECT_URI=<your redirect uri>
14+
15+
# The following variables are required if the app needs to call an API.
16+
#
17+
# Multiple scopes can be added into the same line, separated by a space.
18+
# Here we use a Microsoft Graph API as an example
19+
# You may need to use your own API's scope.
20+
#SCOPE=User.Read
21+
#
22+
# The sample app will acquire a token to call this API
23+
#ENDPOINT=https://graph.microsoft.com/v1.0/me
24+

‎.env.sample.external-id-custom-domain

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# This sample can be configured to work with Microsoft External ID with custom domain.
2+
#
3+
# If you are using a Microsoft External ID tenant with custom domain,
4+
# configure the OIDC_AUTHORITY variable as
5+
# "https://www.contoso.com/TENANT_GUID/v2.0"
6+
OIDC_AUTHORITY=<authority url>
7+
8+
# The following variables are required for the app to run.
9+
CLIENT_ID=<client id>
10+
CLIENT_SECRET=<client secret>
11+
12+
# Your project's redirect URI that you registered in Azure Portal.
13+
# For example: http://localhost:5000/redirect
14+
REDIRECT_URI=<your redirect uri>
15+
16+
# The following variables are required if the app needs to call an API.
17+
#
18+
# Multiple scopes can be added into the same line, separated by a space.
19+
# Here we use a Microsoft Graph API as an example
20+
# You may need to use your own API's scope.
21+
#SCOPE=User.Read
22+
#
23+
# The sample app will acquire a token to call this API
24+
#ENDPOINT=https://graph.microsoft.com/v1.0/me
25+

‎README.md

Lines changed: 146 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,42 +7,169 @@ products:
77
description: "This sample demonstrates a Python web application calling a Microsoft Graph that is secured using Azure Active Directory."
88
urlFragment: ms-identity-python-webapp
99
---
10-
# Integrating Microsoft Identity Platform with a Python web application
10+
# Integrating Microsoft Entra ID with a Python web application written in Flask
1111

12-
This is a Python web application that uses the Flask framework and the Microsoft identity platform to sign in users and make authenticated calls to the Microsoft Graph API.
12+
This is a multi-purpose [Flask](https://flask.palletsprojects.com/en/3.0.x/) web app sample.
13+
Write your app like this once, and the same implementation will support 4x2=8 scenarios.
1314

14-
# Configuration
15+
| | Microsoft Entra ID | External ID | External ID with Custom Domain | Azure AD B2C |
16+
|----------------|--------------------|-------------|--------------------------------|--------------|
17+
| Web App Sign-In & Sign-Out | ✓ | ✓ | ✓ | ✓ |
18+
| Web App Calls a web API | ✓ | ✓ | ✓ | ✓ |
1519

16-
## If you are configuring your Microsoft Entra ID app or Microsoft Entra External ID app
20+
![Topology](https://raw.githubusercontent.com/Azure-Samples/ms-identity-python-webapp-django/main/static/topology.png)
1721

18-
To get started with this sample, you have two options:
22+
## Getting Started
1923

20-
* Use the Azure portal to create the Azure AD applications and related objects. Follow the steps in
21-
[Quickstart: Add sign-in with Microsoft to a Python web app](https://docs.microsoft.com/azure/active-directory/develop/web-app-quickstart?pivots=devlang-python).
22-
* Use PowerShell scripts that automatically create the Azure AD applications and related objects (passwords, permissions, dependencies) for you, and then modify the configuration files. Follow the steps in the [App Creation Scripts README](./AppCreationScripts/AppCreationScripts.md).
24+
### Prerequisites
2325

24-
## If you are configuring your B2C app
26+
1. Have [Python](https://python.org) 3.8+ installed
27+
1. Clone from
28+
[its repo](https://github.com/Azure-Samples/ms-identity-python-webapp)
29+
or download its zip package, and then start using it or build on top of it.
30+
1. `cd project_name`
31+
1. Run `pip install -r requirements.txt` to install dependencies
32+
1. Run `flask run -h localhost` and then browse to http://localhost:5000
33+
You may need to change to a different port to match your redirect_uri setup.
2534

26-
This sample can also work as a B2C app. If you are using a B2C tenant, follow
27-
[Configure authentication in a sample Python web app by using Azure AD B2C](https://learn.microsoft.com/azure/active-directory-b2c/configure-authentication-sample-python-web-app).
2835

36+
### How to configure and use this sample
2937

30-
# Deployment
38+
<table border=1>
39+
<tr>
40+
<th></th>
41+
<th>Microsoft Entra ID</th>
42+
<th>Microsoft Entra External ID</th>
43+
<th>Microsoft Entra External ID with Custom Domain</th>
44+
<th>Azure AD B2C</th>
45+
</tr>
3146

32-
Once you finish testing this web app locally, you can deploy it to your production.
33-
You may choose any web app hosting services you want.
34-
Here we will describe how to deploy it to
35-
[Azure App Service](https://azure.microsoft.com/en-us/products/app-service).
47+
<tr>
48+
<th>App Registration</th>
49+
<td><!-- See https://github.com/github/cmark-gfm/issues/12 -->
3650

37-
* Follow the ["Quickstart: Deploy a Python (Django or Flask) web app to Azure App Service"](https://learn.microsoft.com/en-us/azure/app-service/quickstart-python),
38-
but replace its sample app (which does not do user sign-in) with this web app.
51+
Following only the step 1, 2 and 3 of this
52+
[Quickstart: Add sign-in with Microsoft to a Python web app](https://learn.microsoft.com/entra/identity-platform/quickstart-web-app-python-sign-in?tabs=windows)
53+
54+
</td>
55+
<td>
56+
57+
Follow only the page 1 of this [Tutorial: Prepare your customer tenant ...](https://learn.microsoft.com/entra/external-id/customers/tutorial-web-app-python-flask-prepare-tenant)
58+
59+
</td>
60+
<td>
61+
62+
Coming soon.
63+
64+
</td>
65+
<td>
66+
67+
Following only the step 1 and 2 (including 2.1 and 2.2) of this
68+
[Configure authentication in a sample Python web app by using Azure AD B2C](https://learn.microsoft.com/azure/active-directory-b2c/configure-authentication-sample-python-web-app?tabs=linux)
69+
70+
</td>
71+
</tr>
72+
73+
<tr>
74+
<th rowspan=2>Configuration</th>
75+
<td><!-- See https://github.com/github/cmark-gfm/issues/12 -->
76+
77+
Copy this [Entra ID template](.env.sample.entra-id)
78+
as `.env` and then modify `.env` with your app's settings.
79+
80+
</td>
81+
<td>
82+
83+
Copy this [External ID template](.env.sample.external-id)
84+
as `.env` and then modify `.env` with your app's settings.
85+
86+
</td>
87+
<td>
88+
89+
Copy this [External ID with Custom Domain template](.env.sample.external-id-custom-domain)
90+
as `.env` and then modify `.env` with your app's settings.
91+
92+
</td>
93+
<td>
94+
95+
Copy this [Azure AD B2C template](.env.sample.b2c)
96+
as `.env` and then modify `.env` with your app's settings.
97+
98+
</td>
99+
</tr>
100+
101+
<tr>
102+
<td colspan=4>
103+
104+
Do not reverse the order of the configuration steps above.
105+
If you put your app credentials into the template and then copy it into `.env`,
106+
you risk accidentally committing your templates with credentials into Version Control System.
39107

40-
* [Configure your app's settings](https://learn.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal#configure-app-settings) to define [these environment variables](https://github.com/Azure-Samples/ms-identity-python-webapp/blob/main/.env.sample).
108+
</td>
109+
</tr>
41110

111+
<tr>
112+
<th>Web App Sign In & Sign Out</th>
113+
<td colspan=4>
114+
115+
With the basic configuration above,
116+
you can now browse to the index page of this sample to try the sign-in/sign-out experience.
117+
118+
</td>
119+
</tr>
120+
121+
<tr>
122+
<th>Web App Calls a web API</th>
123+
<td colspan=4>
124+
125+
Add the web API's *endpoint* into your `.env` file.
126+
Also add the *scopes* it needs, separated by space.
127+
The following example is the settings needed to call the Microsoft Graph API.
128+
You may need to replace the their values with your own API endpoint and its scope..
129+
130+
```ini
131+
ENDPOINT=https://graph.microsoft.com/v1.0/me
132+
SCOPE=User.Read
133+
```
134+
135+
Now restart this sample and try its "Call API" experience.
136+
137+
</td>
138+
</tr>
139+
140+
<tr>
141+
<th>
142+
143+
Deploy to
144+
[Azure App Service](https://azure.microsoft.com/en-us/products/app-service)
145+
146+
</th>
147+
<td colspan=4>
148+
149+
* Follow the ["Quickstart: Deploy a Python (Django or Flask) web app to Azure App Service"](https://learn.microsoft.com/en-us/azure/app-service/quickstart-python),
150+
but replace its sample app (which does not do user sign-in) with this web app.
151+
* [Configure your app's settings](https://learn.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal#configure-app-settings)
152+
to define environment variables mentioned in the **Configuration** row of this table.
42153
* If your `app_config.py` contains `SESSION_TYPE = "filesystem"`,
43154
you shall turn on "session affinity" (a.k.a. "ARR affinity") in your
44155
[App Service Web App's Configuration](https://learn.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal#configure-general-settings)
45156

157+
</td>
158+
</tr>
159+
160+
</table>
161+
162+
163+
## How to build this sample (or a new web project) from scratch
164+
165+
You can follow the
166+
[instructions for Flask, from the underlying library](https://identity-library.readthedocs.io/en/latest/flask.html).
167+
168+
You can refer to the
169+
[source code of this full sample here](https://github.com/Azure-Samples/ms-identity-python-webapp)
170+
to pick up other minor details, such as how to modify `app.py` accordingly,
171+
and how to add templates for the new view (and for the existing `index()` view).
172+
46173

47174
## Contributing
48175

0 commit comments

Comments
 (0)