Web application w/ AD authentication accessing IoT Hub API: working example?

Question

I am trying to build a web application that allows users to

1. Log-in with an AD account
2. Interact with the IoT Hub API in order e.g. to list all devices

I ran into multiple problems:

• The recommended way for a browser app to authenticate against AD is msal.js. Unfortunately the IoT Hub SDK cannot work with MSAL, but needs to use the V1 JavaScript SKD.
• So I tried to set up the authentication flow in my React app using ms-rest-browserauth. But there I discovered that an endless redirect happens after authenticating the user.
• I tried to make sure that this bug exists on the sample provided by ms-rest-browserauth, but it is so hopelessly outdated, that dependencies no longer install.
• When I tried to update the dependencies I encountered issues with the compatibility of different libraries.

I am looking for a working web application sample and would greatly appreciate any pointers.

Answer 1

If you make use of the IoT Hub Rest API, take a look at https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-security#security-tokens where the creation of a security token is shown.

There is an example shown in javascript.

With that token, you could do something like:

   using var client = new HttpClient();  
      
   client.DefaultRequestHeaders.Add("Authorization", token);  
      
   var body = "[some json structure]";  
     
   var stringContent = new StringContent(body, Encoding.UTF8, "application/json");  
      
   var restUriPost = $"https://{iotHubName}/[some method]";  
      
   using var resultPost = client.PostAsync(restUriPost, [stringContent of body]).Result;  
      
   return resultPost.StatusCode.ToString();  

This works in any programming language which is capable to some basic security stuff and HTTPS calls.

Due to the usage of an IoT hub connection string, please do not distribute that connection string to devices, just use it in cloud resources using a key vault.

Answer 2

There seem to be some C# examples here. https://github.com/Azure/azure-iot-sdk-csharp

I don't think the authentication piece would be drastically different from authentication on any other web app in Azure but I am looking into this to confirm.

For a regular web app you would use a sample like this one. https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect