Exportera (0) Skriv ut
Visa allt
Expand Minimize
EN
Det här innehållet finns inte tillgängligt på ditt språk men här finns den engelska versionen,

How to: Use ACS Management Service to Configure Rules and Rule Groups

Published: April 7, 2011

Updated: February 21, 2014

Applies To: Azure

  • Microsoft Azure Active Directory Access Control (also known as Access Control Service or ACS)

You can configure ACS rules and rule groups using either the ACS Management Portal (for more information, see Rule Groups and Rules) or the ACS Management Service. Working with the ACS Management Service can be more efficient if you are building a custom user interface for managing ACS or if you want to automate the onboarding of a new tenant for multi-tenant Software as a Service (SaaS) solutions.

ImportantImportant
Before performing the following steps, make sure that your system meets all of the .NET framework and platform requirements that are summarized in ACS Prerequisites.

To configure rules and rule groups using the ACS Management Service, complete the following steps:

You can use the ACS Management Portal to collect the necessary configuration information. For more information about how to launch the ACS Management Portal, see ACS Management Portal.

  1. Launch the ACS Management Portal. For more information about how to launch the ACS Management Portal, see ACS Management Portal.

  2. Get the value of the ACS management service account. You can use the default ManagementClient account. To view this value, in the ACS Management Portal, click Management service under the Administration section in the tree on the left-hand side of the page.

  3. Get the value of the ACS Management Service account password. To view this value, do the following:

    1. In the ACS Management Portal, click Management service under the Administration section in the tree on the left-hand side of the page.

    2. On the Management Service page, click ManagementClient under Management Service Accounts.

    3. On the Edit Management Service Account page, under Credentials, click Password.

    4. On the Edit Management Credential page, copy the value in the Password field.

  4. Get the name of your Azure namespace from the Azure portal or from the URL of your ACS Management Portal. For example, in http://contoso.accesscontrol.windows.net, the name is contoso.

  5. Get the ACS hostname. Usually, it is accesscontrol.windows.net.

In this step, you create a sample console application that can run the code for adding your ACS rule groups and rules.

  1. Open Visual Studio 2012 and create a new console application project under the Windows installed template.

  2. Add the following code to the Program class and then assign serviceIdentityPasswordForManagement, serviceNamespace, and acsHostName variables to the appropriate configuration information that you collected in the previous step.

    public const string serviceIdentityUsernameForManagement = "ManagementClient";
    public const string serviceIdentityPasswordForManagement = "My Password/Key for ManagementClient";
    public const string serviceNamespace = "MyNameSpaceNoDots";
    public const string acsHostName = "accesscontrol.windows.net";
    public const string acsManagementServicesRelativeUrl = "v2/mgmt/service/";
    static string cachedSwtToken;
    
    

In this step you identify and add the required dependencies to the services and assemblies.

  1. Right-click References, click Add Reference, and add a reference to System.Web.Extensions.

    noteNote
    You might have to right-click your sample console application name in the Solution Explorer, select Properties, and change the target framework of your sample application from .NET Framework 4 Client Profile (assigned by default when you create a new console application) to .NET Framework 4.

  2. Right-click Service References, click Add Service Reference, and add a service reference to the Management Service. The Management Service URL is unique to your namespace and looks similar to the following:

    https://YOURNAMESPACE.accesscontrol.windows.net/v2/mgmt/service

  3. Add the following declarations, where MyConsoleApplication is the name of your console application and MyServiceReference is the name of your service reference:

    using System.Web;
    using System.Net;
    using System.Data.Services.Client;
    using System.Collections.Specialized;
    using System.Web.Script.Serialization;
    using System.Globalization;
    using System.Runtime.Serialization.Json; 
    using MyConsoleApplication.MyServiceReference;
    
    

In this step you implement the Management Service client.

  1. Add the following method to the Program class:

       public static ManagementService CreateManagementServiceClient()
            {
                string managementServiceEndpoint = String.Format(CultureInfo.InvariantCulture, "https://{0}.{1}/{2}",
                    serviceNamespace,
                    acsHostName,
                    acsManagementServicesRelativeUrl);
                ManagementService managementService = new ManagementService(new Uri(managementServiceEndpoint));
    
                managementService.SendingRequest += GetTokenWithWritePermission;
    
                return managementService;
            }
    
    
  2. Add the following code to the Program class to create GetTokenWithWritePermission method and its helper methods. GetTokenWithWritePermission and its helpers add the SWT OAuth token to the Authorization header of the HTTP request.

    public static void GetTokenWithWritePermission(object sender, SendingRequestEventArgs args)
            {
                GetTokenWithWritePermission((HttpWebRequest)args.Request);
            }
    
            public static void GetTokenWithWritePermission(HttpWebRequest args)
            {
                if (cachedSwtToken == null)
                {
                    cachedSwtToken = GetTokenFromACS();
                }
    
                args.Headers.Add(HttpRequestHeader.Authorization, "Bearer " + cachedSwtToken);
            }
    
            private static string GetTokenFromACS()
            {
                //
                // Request a token from ACS
                //
                WebClient client = new WebClient();
                client.BaseAddress = string.Format(CultureInfo.CurrentCulture, 
                                                   "https://{0}.{1}", 
                                                   serviceNamespace, 
                                                   acsHostName);
    
                NameValueCollection values = new NameValueCollection();
                values.Add("grant_type", "client_credentials");
                values.Add("client_id", serviceIdentityUsernameForManagement);
                values.Add("client_secret", serviceIdentityPasswordForManagement);
                values.Add("scope", client.BaseAddress + acsManagementServicesRelativeUrl);
    
                byte[] responseBytes = client.UploadValues("/v2/OAuth2-13", "POST", values);
    
                string response = Encoding.UTF8.GetString(responseBytes);
    
                // Parse the JSON response and return the access token 
                JavaScriptSerializer serializer = new JavaScriptSerializer();
    
                Dictionary<string, object> decodedDictionary = serializer.DeserializeObject(response) as Dictionary<string, object>;
    
                return decodedDictionary["access_token"] as string;
    
            }
    
    
    

In this step you add a rule group using the Management Service client you created in the step above.

  1. Initialize the Management Service client by adding the following code to the Main method in the Program class:

    ManagementService svc = CreateManagementServiceClient();
    
    
  2. Add your new rule group (you can call it “mygroup”, as shown in the code below) and save changes by adding the following code to the Main method in the Program class:

    RuleGroup rg = new RuleGroup();
                rg.Name = "mygroup";
                svc.AddToRuleGroups(rg);
                svc.SaveChanges(SaveChangesOptions.Batch);
    
    

In this step you add a rule to the rule group you created in the previous step using the ACS Management Service.

  1. Establish a variable for "LOCAL AUTHORITY", which is a built-in issuer name that represents your Access Control namespace namespace, by adding the following code to the Main method in the Program class:

    
    // "LOCAL AUTHORITY" is a built-in IDP name that represents the Access Control namespace. 
    Issuer localAuthority = svc.Issuers.Where(m => m.Name == "LOCAL AUTHORITY").FirstOrDefault();
    
    
  2. Do one of the following:

    1. To add a basic rule, add the following code to the Main method in the Program class:

      
                  //EXAMPLE #1 - BASIC RULE
                  Rule basicRule = new Rule()
                  {
                      InputClaimType = "https://acs/your-input-type",
                      InputClaimValue = "inputValue",
                      OutputClaimType = "https://acs/your-output-type",
                      OutputClaimValue = "outputValue",
                  };
      
                  basicRule.Description = string.Format(CultureInfo.InvariantCulture,
                      "Transforms claim from {0} with type: {1}, value: {2}, into a new claim with type: {3}, value:{4}",
                      "ACS",
                      basicRule.InputClaimType,
                      basicRule.InputClaimValue,
                      basicRule.OutputClaimType,
                      basicRule.OutputClaimValue);
      
                  svc.AddToRules(basicRule);
                  svc.SetLink(basicRule, "RuleGroup", rg);
                  svc.SetLink(basicRule, "Issuer", localAuthority);                                              
                    svc.SaveChanges(SaveChangesOptions.Batch);
      
      
      
    2. To add a rule that passes a particular input claim and value to the application without changes, add the following code to the Main method in the Program class:

      //EXAMPLE #2 - PASS TYPE AND VALUE RULE
                  Rule passSpecificClaimRule = new Rule()
                  {
                      InputClaimType = "https://acs/your-input-type2",
                      InputClaimValue = "inputValue2",
                  };
      
                  passSpecificClaimRule.Description = string.Format(CultureInfo.InvariantCulture,
                      "Passthough claim from {0} with type: {1}, value: {2}",
                      "ACS",
                      passSpecificClaimRule.InputClaimType,
                      passSpecificClaimRule.InputClaimValue);
      
                  svc.AddToRules(passSpecificClaimRule);
                  svc.SetLink(passSpecificClaimRule, "RuleGroup", rg);
                  svc.SetLink(passSpecificClaimRule, "Issuer", localAuthority); 
      svc.SaveChanges(SaveChangesOptions.Batch);
      
      
    3. To add a rule that passes any claim with a specified type, add the following code to the Main method in the Program class:

      //EXAMPLE #3 PASS SPECIFIC TYPE RULE
                  Rule passAnyClaimSpecificTypeRule = new Rule()
                  {
                      InputClaimType = "https://acs/your-input-type3",
                  };
      
                  passAnyClaimSpecificTypeRule.Description = string.Format(CultureInfo.InvariantCulture,
                      "Pass claim from {0} with type: {1}, and any value",
                      "ACS",
                      passSpecificClaimRule.InputClaimType);
      
                  svc.AddToRules(passAnyClaimSpecificTypeRule);
                  svc.SetLink(passAnyClaimSpecificTypeRule, "RuleGroup", rg);
                  svc.SetLink(passAnyClaimSpecificTypeRule, "Issuer", localAuthority); 
      svc.SaveChanges(SaveChangesOptions.Batch);
      
      
    4. To add a rule that passes any input claim with a specified value, add the following code to the Main method in the Program class:

      //EXAMPLE #4 PASS ANY CLAIM W/SPECIFIC VALUE RULE
                  Rule passAnyClaimSpecificValueRule = new Rule()
                  {
                      InputClaimValue = "inputValue3",
                  };
      
                  passAnyClaimSpecificValueRule.Description = string.Format(CultureInfo.InvariantCulture,
                      "Pass claim from {0} with any type, and specific value {1}",
                      "ACS",
                      passSpecificClaimRule.InputClaimValue);
      
                  svc.AddToRules(passAnyClaimSpecificValueRule);
                  svc.SetLink(passAnyClaimSpecificValueRule, "RuleGroup", rg);
                  svc.SetLink(passAnyClaimSpecificValueRule, "Issuer", localAuthority); 
      svc.SaveChanges(SaveChangesOptions.Batch);
      
      
    5. To add a rule that transforms a specified input claim type into a different output claim type, but does not change the claim value, add the following code to the Main method in the Program class:

      //EXAMPLE #5 COMPLEX RULE
                  Rule complexTransformationRule = new Rule()
                  {
                      InputClaimType = "https://acs/your-input-type4",
                      OutputClaimType = "https://acs/your-output-type2",
                  };
      
                  complexTransformationRule.Description = string.Format(CultureInfo.InvariantCulture,
                      "Transforms claim from {0} with type: {1}, and any value, into a new claim with type: {2}, keeping(passingthough) old value",
                      "ACS",
                      complexTransformationRule.InputClaimType,
                      complexTransformationRule.OutputClaimType);
      
                  svc.AddToRules(complexTransformationRule);
                  svc.SetLink(complexTransformationRule, "RuleGroup", rg);
                  svc.SetLink(complexTransformationRule, "Issuer", localAuthority);
      
                  svc.SaveChanges(SaveChangesOptions.Batch);
      
      

See Also

Concepts

ACS How To's

Gruppinnehåll

Lägg till
Visa:
© 2014 Microsoft