title: Single Sign On with Azure Active Directory
body: <p>I have a bunch of web apps that I've created. Some of them use old-style webforms authentication, and some other sites at our company use different authentication patterns.</p>
  
  <p>I'm trying to consolidate this, under one SSO pattern using Azure Active Directory. I've been trying to following guides/tutorials but it's not clicking for me.</p>
  
  <p>My tech is currently ASP 4/MVC 5, although if ASP 5/MVC 6 is easier then I have the freedom to go that route as well. All web apps are hosted in Azure currently.</p>
  
  <p>The confusion for me comes in that while looking through documentation, there seem to be so many ways to authentication and authorize users (also, authenticate vs authorize isn't absolutely clear to me). </p>
  
  <p>I went to the Active Directory area of Azure Management portal (the old one). I added a new application called <code>TestApp</code>. I set the app URL to <code>https://localhost:44320/</code>, then sign-on URL to <code>https://localhost:44320/</code>, the tenant name to <code>testapp</code>. And my reply URL is <code>https://localhost:44320/</code></p>
  
  <p>This makes my app id uri <code>https://localhost:44320/testapp</code> I think? I also have my client ID guid.</p>
  
  <p>The tutorial has an <code>AccountController</code> with a <code>SignIn</code> method like this:</p>
  
  <pre><code>public void SignIn()
  {
      // Send an OpenID Connect sign-in request.
      if (!Request.IsAuthenticated)
      {
          HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties { RedirectUri = "/" }, OpenIdConnectAuthenticationDefaults.AuthenticationType);
      }
  }
  </code></pre>
  
  <p>When navigating to this, I receive the following in the browser:</p>
  
  <blockquote>
    <p>[InvalidOperationException: IDX10803: Unable to create to obtain configuration from: '<a href="https://localhost:44320/testapp/.well-known/openid-configuration" rel="nofollow">https://localhost:44320/testapp/.well-known/openid-configuration</a>'.]</p>
  </blockquote>
  
  <p>I have a feeling it's because Azure is unable to redirect this all to back to my localhost? How can I set this up so I can test it out on Azure itself? And even further than that, will this solution be usable from multiple webapps? I'd assume they'd each be different applications in my Active Directory, but they'd all need to use a SSO procedure, where users can sign into multiple apps with one identity.</p>
  
  <p>Sorry for any confusion, this is all very convoluted to me but I am trying to learn it as best I can.</p>
  
  <p>Edit:</p>
  
  <p>In the Startup of the webapp, I am calling this:</p>
  
  <pre><code>private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
  private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
  private static string tenant = ConfigurationManager.AppSettings["ida:Tenant"];
  private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];
  
  string authority = String.Format(CultureInfo.InvariantCulture, aadInstance, tenant);
  
  public void ConfigureAuth(IAppBuilder app)
  {
      app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
      app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
      app.UseOpenIdConnectAuthentication(
          new OpenIdConnectAuthenticationOptions
          {
              ClientId = clientId,
              Authority = authority,
              PostLogoutRedirectUri = postLogoutRedirectUri,
              Notifications = new OpenIdConnectAuthenticationNotifications
              {
                  AuthenticationFailed = context =&gt; 
                  {
                      context.HandleResponse();
                      context.Response.Redirect("/Error?message=" + context.Exception.Message);
                      return Task.FromResult(0);
                  }
              }
          });
  }
  </code></pre>
  
  <p>Which utilizes these app.config settings:</p>
  
  <pre><code>&lt;add key="ida:ClientId" value="[my client id here]" /&gt;
  &lt;add key="ida:Tenant" value="testapp" /&gt;
  &lt;add key="ida:AADInstance" value="https://localhost:44320/{0}" /&gt;
  &lt;add key="ida:PostLogoutRedirectUri" value="https://localhost:44320/" /&gt;
  </code></pre>