Automating Azure Active Directory: Provision Users and Apps

Some time ago I wrote about User App Provisioning in Azure, which can be achieved manually through the Azure Portal.

But if you happen to have already an application that you use to manage your users and permissions, and you want to deploy such application to Azure, you might want to automate things a bit more.

At a high level, this is the Graph API flow:

1. Find the User in AAD
2. Invite the User to AAD
3. Find the App to Assign in AAD
4. Find existing App Assignment for the User
5. Assign the App to the User

This is the flow diagram (a bit more detailed):

The Management App (green color) is the main application where you already manage users and permissions, which did not require AAD integration so far.
However, once the application is deployed to Azure, AAD integration becomes essential.
This is the place where you would want to integrate this POC application.

The POC application is represented by the App Provision App (yellow color), and it manages the Graph API flow. It executes HTTP Requests to the Graph REST APIs (blue color), and it parses and displays the returned JSON data.

Considering that this process should be automated behind the scenes of your existing Management App (unlike in this POC where it is a standalone MVC web app), when things go wrong and errors are returned instead of JSON data, an email is sent to an Admin address (so that a manual action in the Azure portal can be performed and the error fixed).

As of now there are 2 different versions of Graph API:

• Azure Graph API 
• Microsoft Graph API

Microsoft recommends to use the Microsoft Graph API, however it is still very raw and unstable (beta), with many features not available yet.

So in this POC I implemented the Azure Graph API for almost all calls, and just used the Microsoft API for the AAD Invitation (not available in the Azure one).

Here are the screenshots of the App Provision App:

And that's it.

Feel free to ask questions (or code) in the comments below!

Scoring bad at Pentest... thanks to Azure :)

As part of a security compliancy, we had our application (deployed in Azure), scanned with a Pentest by an external company.

I just received the Scan Reports, and I was surprised to see issues that I was sure we fixed (such as OWASP XSS (Cross Site Scripting) just to name one..

Well, after a quick analysis of the reports, it turns out that most of those issues belong to Azure resources!

By having our APIs behind Azure API Management, its Developer Portal was scanned as well, and resulted in a few issues (between Low and Medium, nothing critical).

The AAD login page, has a few of those issues as well, and because of the automatic redirect they seem caused by our app during the scan..

Obviously those resources are out of our control, and we can't do anything to fix those issues, maybe Microsoft will.

At the same time it is nice to find out that the hard work to secure our app paid off, and only a few minor issues were found that actually belong to it.

This is the list of issues belonging to Azure resources:

• Medium (Medium) – Application Error Disclosure
• Low (Medium) – Web Browser XSS Protection Not Enabled
• Low (Medium) – Incomplete or No Cache-control and Pragma HTTP Header Set
• Low (Medium) – X-Content-Type-Options Header Missing
• Low (Medium) – Cookie Without Secure Flag
• Low (Medium) – Cross-Domain JavaScript Source File Inclusion
• Low (Medium) – Password Autocomplete in Browser

Openhack Amsterdam Day 3

Last Day.
Challenge completed.
New Stuff learned.
Thanks Microsoft.

Openhack Amsterdam

Openhack Amsterdam Day 2

Keep hacking...



Openhack Amsterdam

Openhack Amsterdam Day 1

Having fun with Containers and Minecraft at Openhack Amsterdam :)