Let’s review that. According to the documentation:

This operation retrieves a redirection URL containing an authentication token for signing a given user into the developer portal.

The above actually also applies to the Publisher portal, which can use the same access token, however the user for which you need the token needs to be an admin user. This is done by leveraging the User ID 1. The API Management setup this concept of user 1 being the admin, because they wanted something simple to bridge between now and the moment RABC will be baked in. So, exactly what we need!

Setting up our RBAC workaround

Here’s the tasks we will execute to get this working:
1. Configure Azure API management account to enable the REST API and setup the access token.
2. Setup a development environment with Visual Studio 2015 and Azure SDK 2.8.
3. You need Admin access to your Azure subscription, and make sure you have service administrator level to the Azure AD domain you want to use.
4. Create a web app (ASP.NET) that validates whether the current user is member of a pre-defined Azure AD group. If yes: generate a Login link with an access token to the Azure API Management account.
5. Deploy the application to Azure, to an App Service Web App.
6. Leverage or create a custom Azure AD group to hold the members with Admin rights to the Azure API management account.
7. Setup Authorization/Authentication feature in the Azure Web App to validate the user.

Configure Azure API Management account

In this portion, we assume you already have an account created. Go to the publisher portal of your account, browse to Security and activate Enable API Management REST API checkbox. Wait for a confirmation the action is successful.

Now configure and make a note of the access token. Scroll to the bottom of the page and configure an expiry date for your token. For testing, choose at least a date later than today. This token can later be changed, just make sure it is then copied to the App settings if that happens.

 Write down the SharedAccessSignature as we’ll need it later. You won’t be able to see it once you leave this page.

Azure AD: Retrieving the right Group ID

This step can also be done at the end, but if you want to have more settings automated through the ARM resource deployment, then get the ID for your group before creating the first deployment.
Navigate to your Azure AD using the Azure Management Portal, click Groups. Go to the Configure tab and copy the Object ID. You will need this ID in the deployment step. If you skipped this step in Visual Studio, you can still edit its value through the Web App’s Application Settings pane.

For this setup to function, you need to make sure your test users are actually members of the Group above.

Creating the ASP.NET Web app

We’ll use ASP.NET app with just one page that shows a login box for entitled users, and a default message for those that are not. You can review the sample code in this GitHub repo.

Nothing of a sophisticated web app, just something to get the point across in this post.

A few elements relevant to review:

[Authorize] 

public class HomeController : Controller

We leverage the Authorize attribute to make sure the page does not process without the user being authenticated.

Next, a utility class is used to interact with the API Management REST API, and use the generateSsoUrl action.

string

requestUrl = string.Format("{0}/users/{1}/generateSsoUrl?api-version={2}", baseUrl, "1", API_VERSION);

using (HttpClient httpClient = newHttpClient())

            {

               var request = new HttpRequestMessage(HttpMethod.Post, requestUrl);

                request.Headers.Authorization = new AuthenticationHeaderValue("SharedAccessSignature", sharedAccessSignature);

        HttpResponseMessage response = await httpClient.SendAsync(request);

                response.EnsureSuccessStatusCode();

               string responseBody = await response.Content.ReadAsStringAsync();

return responseBody;

             }

We leverage the Authorize attribute to make sure the page does not process without the user being authenticated.

Next, a utility class is used to interact with the API Management REST API, and use the generateSsoUrl action.

publicActionResult Index()

        {

     var claimsPrincipal = Thread.CurrentPrincipal asClaimsPrincipal;

            ViewBag.HasAccess = false;

           if (claimsPrincipal != null)

            {

               Claim groupApimAdmin = claimsPrincipal.Claims.FirstOrDefault(

                c => c.Type == "groups" &&  c.Value.Equals(groupToValidate, StringComparison.CurrentCultureIgnoreCase));

               if (null != groupApimAdmin)

                {

                    ViewBag.HasAccess = true;

                }

            }

           return View();

        }

Deploying the app to Azure

We’ve also created a Cloud Deployment project in Visual Studio to help us with the deployment of the application to Azure. The Cloud Deployment project uses Azure Resource Management JSON template to create the web app, an App Service Plan and set the Application Settings we require for our app to function.

Note: Before deploying though, make sure you have a Storage account created through the portal, as the Cloud Deployment Project requires this to temporarily copy the deployment contents.
This needs to be a Storage account using the Resource Manager deployment type – see more here https://azure.microsoft.com/en-us/documentation/articles/resource-manager-deployment-model/

In the Visual Studio project, the Cloud Deployment project already has a reference to the web application, this will build and generate a webdeploy package.

The JSON parameters can be entered through the Visual Studio interface, then click Save and Deploy to initialize the deployment to Azure.

- webSiteName – the name of the website that will host the webapp  - needs to be unique on Azure (so not just for your subscription)
- hostingPlanName – new app service plan name, unique only for your Azure account.
- apimTenantName – the name of the APIM account
- apimAdGroupId – GUID corresponding to the group to which the internal Admin users must belong to in order to get access to the Azure API Management publisher portal. See above for details on retrieving the right Group ID.
- apimSas – this is a secure string that needs to contain the ShareAccessSignature you created above. Only copy the part after ShareAccessSignature and remove the space. It should start with uid=…
- ApimDeployPackageFolder: The name of the app in Visual Studio
- ApimDeployPackageFileName: package.zip (use this name)

Review the Output window to validate the progress and successful completion of the ARM deployment.

Securing the Web App

The Azure web application uses Authorization/Authentication feature in Azure App Service to secure the application itself. Once the user is allowed in through Azure AD authentication, it then validates the user is part of the predefined Group (claim). If valid, the Azure API Management REST API is used to generate a valid Admin User token. With this valid token the redirection to the Publisher portal is then initiated.

To set this up, go to your newly deployed Web App in the new Azure Portal. When browsing to the web app, you should see something like this.

This is because we have used the [Authorize] attribute in the Controller, so that the web app is not accessible at all without the proper Authorization setup in Azure.

In the Azure portal, browse to the newly created web app, then click Authentication/Authorization.

Choose On to activate the feature. Next choose “Login with Azure Active Directory” in the Action to take when request is not authenticated. Then continue by configuring Azure AD, click Not Configured to open the details pane.

Choose Express settings, provide a unique name to the app. This will create and configure the unique App in Azure AD.

Note if you prefer to setup another Azure AD domain or app settings, you can manually configure the right app in Azure AD and choose the Advanced pane to just enter the app’s ID and secret.

For this test we just choose the simple Express version. Click OK, then back in the main Authorization pane, click the Save button. You can now close the Authentication/Authorization pane.

Configure Azure AD app settings

With the above configuration, a new Azure AD application has been added. We still need to configure a few things. Browse to the (old) Azure Management portal and open up your Azure AD domain details.
Choose Applications tab, then select Applications my company owns, and click the search button (v). The newly created app should be in the list. Click on it to open it. Go to the app’s Configure tab and click Delegated Permissions, activate Read directory data, and then click SAVE.

Next, after successfully saving, the bottom bar should now display a button “Manage Manifest”. In that action, choose Download manifest. Save it locally and open it up in a code editor. For more information about the Azure AD manifest, see here https://azure.microsoft.com/en-gb/documentation/articles/active-directory-application-manifest/.
Edit your manifest and change “groupMembershipClaims” value to “SecurityGroup” instead of the value null.

Save the manifest.

Back in the Azure portal, in your Azure AD application were editing previously, click the Manage Manifest button again, this time choose Upload Manifest.
See the following article for a detailed overview of authorization with AD group claims:  https://www.dushyantgill.com/blog/2014/12/10/authorization-cloud-applications-using-ad-groups/

Validating the solution

Before testing if the solution works, make sure the App Settings have been updated with the different values:

With all the settings configured, browse to the Web App again. Instead of receiving the error message, you should see a redirection to Azure AD authentication. If you are using the same browsing window as your Azure user, you will be redirected automatically as you are already authenticated. Now click the LOGIN button and you should have access to the Publisher portal for API Management.

To test correctly, I advise creating a new test user in Azure AD, assigning the user to the above group, and activating the user. Testing the application with the newly created user should work end to end.

Possible issues

- Token is not valid – to see the actual error message you can activate Stream logs
- Token has expired: generate a new one and update the Web App’s app setting.
- Group claims does not return the required Group – you might see a detail in getting the newly assigned group of an AD user, this might seem like an error but I assume there is a cache that needs to expire so that new group memberships get returned with in the claims.

Security concerns: the access token is stored in the App Settings pane, which is accessible by Azure admins. Knowing the same admins also have access to the portal to generate a new token we don’t think this is a big risk. You can evaluate storing the token in Key Vault and retrieving it from there.

One of the ways to automate in Azure is by using PowerShell tools for Azure, next to other options. I've been working with Azure API Management for some customers lately, and one interesting short post caught my attention: Full set of Windows PowerShell cmdlets for Azure API Management API. This means that now a number of functions to manage API Management have been made available as PowerShell cmdlets, making it easy to use in automation tasks.
Backup and restore is one of the features I’ve been using. While its primary use is for having a backup of your current API Management account, for example making sure this is done very regularly as a way to recover in the event of failure. Another use for the backup/restore feature is when going from development to a staging environment.
Official documentation for doing backup/restore shows us how to do this using the Azure Resource Manager based API Management REST API. But it also requires creating an Azure AD application, setting the right permissions and getting a token for authenticating requests to Azure Resource Manager. Stuart Leeks has an interesting blog post with an alternative non-supported way to use PowerShell, and now with the official cmdlets this is exactly what we can do.

So why not give that a try?

Creating a backup requires the following information: your API Management account, the resource group name and a storage account to which to save the backup to as well as the container in which it will go.

Prepare for the backup

1. Make sure you have configured PowerShell and connected to your subscription.

2. Connect to the storage account and make sure to create the container to which you will store your backup to. Note the name. You can do this through the Azure Management Portal, or using a Storage explorer tool. Also take note of the type of Storage that you are using. There are currently two types, one used in the current Management Portal, and the new mode using Azure Resource Manager.

3. Identify the name of the Resource Group in which your API Management account is created: use https://resources.azure.com/ to navigate to the subscription. The resource group name has automatically been created, and is in the form of 'Api-Default-{service-region}'.
Run backup

Create a Storage Context.

 if ($ARMStorage)
 {
  Switch-AzureMode AzureResourceManager
     $StorageAccountKey = (Get-AzureStorageAccountKey -ResourceGroupName $StorageAccountResourceGroupName -Name $StorageAccountName).Key1
    }
    else
 {
  Switch-AzureMode AzureServiceManagement
     $StorageAccountKey = (Get-AzureStorageKey -StorageAccountName $StorageAccountName).Primary
    }
   

$StorageAccountContext = New-AzureStorageContext -StorageAccountName $StorageAccountName -StorageAccountKey $StorageAccountKey

Run backup

Switch-AzureMode AzureResourceManager

Backup-AzureApiManagement -Name "myAPIMaccount" -ResourceGroupName "Api-Default-West-Europe" -StorageContext $StorageAccountContext `
                       -TargetContainerName "mycontainer" `
                       -TargetBlobName "myapimbackupddmmyy"

Typically you’d create variables for the above values, but for testing we can hard-code them.
For automating the backup you can use something like Azure Automation, currently you’ll need some manual work to support Azure Resource Manager though.

Run restore

To run a restore, simply run the following command.

Restore-AzureApiManagement -Name "myAPIMaccount" -ResourceGroupName "Api-Default-West-Europe" `
                        -StorageContext $StorageAccountContext `
                        -SourceContainerName "mycontainer" `
                        -SourceBlobName "myapimbackupddmmyy" -Verbose

Do read through the notes on the official documentation to understand some of the constraints, including the fact that a restore is only guaranteed maximum 7 days after backup.

Now you can accelerate your development time to build a Windows Store LOB app. A couple of days ago the Pattern & Practices team have released Prism for Windows Runtime and the associated AdventureWorks Shopper reference implementation to the Windows Dev Center.

What is Prism for Windows Runtime?

The Prism for Windows Runtime release provides you guidance to help you more easily design and build flexible and easy-to-maintain Windows Store apps using C# and XAML and the Windows Runtime.

Prism comes with the AdventureWorks Shopper reference implementation which uses the Prism library to demonstrate modern development practices such as Model-View-ViewModel (MVVM) pattern with navigation and app lifecycle management. Additionally the reference implementation demonstrates validation, application data management, accessibility, localizability, touch, search, tiles, tile notification, and multiple view states.

Where do you get started?

The Prism library source code is available with the AdventureWorks Shopper reference implementation on the MSDN Code Gallery at https://aka.ms/prism-winrt-code. The Prism binaries will also be available on NuGet starting Monday May 20. Search for Prism.  You can view the documentation at https://aka.ms/prism-winrt-doc or download a PDF version at https://aka.ms/prism-winrt-pdf.

Check also our local Apps on Windows portal for more resources on how to develop apps for Windows 8, Windows Azure and Windows Phone – you can find local trainings and events, contests and links to online training resources.

We want to give you a push in the back to develop great applications – join the Windows 8 App Race and win:

How to win

Your app(s) need to be published between April 1 and June 15, 2013. Complete the contest form(s) on https://aka.ms/race.

There is no limit to the number of entries you can submit but each entry must be substantially unique and different. The date and time of the first and fifth application as part of the entry submitted in a particular timeframe will determine the winners of the tablets. Note: this contest is only open for residents from Belgium and Luxembourg. Please read the full terms & conditions of this contest before entering. Questions? Contact us msdnbewm@microsoft.com.

We’re looking forward to see your apps shine in the Store … and who knows soon on your brand new Asus tablet!

Microsoft just announced the general availability of our Windows Azure Infrastructure as a Service (IaaS) support! With this release Azure Virtual Machines and Virtual Network move out of Preview and are now ready to use for your production apps.

With Azure Virtual Machines you can deploy and run durable VMs in the cloud, provisioned from prebuilt templates or alternatively upload your own custom-built VMs.  All this in a matter of seconds!  Azure Virtual Network allows you to securely bridge between your on-premises infrastructure and your infrastructure in the cloud. This gives you the flexibility to run your workloads where you want, but manage them all in the same way.

Whether you want to securely extend your on-premises network to Windows Azure or you want to create a virtual private network with persistent private IPs..

Let’s look in more detail into what we have announced today:

• For memory intensive scenarios, we are now introducing two high-memory compute instances: 4 core x 28GB RAM and 8 core x 56GB RAM. With these VM sizes you can run even larger workloads on Windows Azure, for example SharePoint Server or SQL Server workloads.
• We have added several new VM image templates to the Image Gallery, such as SQL Server 2012, BizTalk Server 2013 and SharePoint Server 2013 images. These images also come with hourly billing, so you don’t have to pay for an upfront license.
• We have updated the SLA for Virtual Machines and Virtual Network.  For VMs that have 2 or more instances deployed in the same availability set, we have a 99.95% SLA for external connectivity.  For Virtual Network, we guarantee a 99.9% Virtual Network Gateway availability.
• As of this announcement, Virtual Machines and Virtual Network are now supported by Microsoft Support staff, so you can confidently run your production apps on Azure.

On top of all these great features, we’re also announcing significant pricing reductions to our Windows Azure PaaS and IaaS VM pricing. You can expect to see from 20% (Virtual Machines) to 33% (Cloud Services) price reductions! These new prices are effective as of June 1.  And as of today, we’re also adding 50 hours of free memory-intensive-instance hours to our member offers and 90-day trials.

For a more detailed description of the announcement, you can check out Scott Guthrie’s blog post.

If you don’t already have a Windows Azure account, you can sign-up for a free trial and start using all of the above features today.  Did you know that you already have a lot of free Azure resources as part of your MSDN, MPN or BizSpark membership? 

If you want to learn more about our Windows Azure IaaS capabilities, don’t forget to listen in on our dedicated IaaS webcast on April 30. If you want to experience this great technology hands-on, join us for our Azure IT Camp on May 6.

Also don’t forget there is a virtual conference runnning next Tuesday April 23rd: https://www.windowsazureconf.net/

  
We organized Microsoft TechDays 2013 in Antwerp two weeks ago, where we welcomed close to 2900 IT Professionals, Developers and Students all enjoying 90+ sessions with top content led by a broad selection of international and local top speakers. A special THANK YOU goes to our partners, our MVP’s and MEET (Microsoft Extended Experts Team) members and of none the least, all our enthusiastic attendees!  Check out the pictures to get an idea!

What’s next?

The session videos and slides are now available on www.techdays.be! (Re)live the sessions and take the next steps to truly master the technologies.

Here’s a selection of my favorite picks out of the difficult to choose from list!

The Hands-on Labs
Many of you also took the opportunity to run through one or more hands-on labs. Good news, if you did not have the time and would like to give a first try on the Windows Store, Windows Phone, or Windows Azure step by step tutorial: you can! The labs can now be downloaded and followed on your own computer. Go here for the latest version: https://bit.ly/applabbe

Enjoy!

The TechDays Team   

Questions? Connect with us on Twitter, Facebook or simply via e-mail.

If you speak French, check out the great work they have prepared and jumpstart your Windows 8 app development! 

This MOOC (in French) is an introduction to that new Windows 8 development environment. It’s meant for people who want to get started quickly.

Objectives:

With the videos, you’ll learn :

• The new Windows 8 
• WinRT, the framework for Modern apps  
• 8 design principles for Windows 8 
• What’s new for Web developers 
• What’s new for .NET developers 
• A few new controls…

Course :

1. Introduction :

• 1.1 – Resources and useful links  
• 1.2 – Windows 8 for the end user
• 1.3 – WinRT, the modern framework
• 1.4 – Application lifecycle

2. Windows 8 design principles :

• 2.1 – Focus on content
• 2.2 – Be fast and fluid
• 2.3 – Responsive and scalable design
• 2.4 – Take advantage of contracts
• 2.5 – Live Tile and Roaming

3. Development’s basics :

• 3.1 – For web developers
• 3.2 – For .NET developers
• 3.3 – New controls
• 3.4 – Present data with GridView and ListView
• 3.5 – Makes your layout responsive with XAML and CSS

Resources :

Now that you’re ready to start developing your own Windows Store app, you probably want to dive into code… Here are some must-have resources:

Microsoft Belgium & Luxembourg:

The reference for every Windows developer in Belgium. Have a look at the agenda to know about all the Windows 8 events planned by Microsoft and the community.
https://www.microsoft.com/belux/msdn/apps/windows/default.aspx

Windows 8 Dev Camp In a Box :

A Hands-On kit containing all the labs you need to learn how to build Windows Store apps. It is available in JS/HTML and in C#/XAML.
https://aka.ms/windows8campinabox

We come to your cities (4!), we bring the experts (many!), feed you with breakfast, pizza, coffee (lots!) and Red Bull, honor you with prizes and rewards (countless!). End goal: Get to Windows Store, have fun doing it, go home with prizes (to be announced soon, we promise you: you’ll really like them!). Hint hint: for the best quality app we’ll have a conference ticket…

Go ahead and reserve your spot. Join us for the Day event or the Night event or both. See the agenda setup at the bottom of this post.

• Register for the hackathon in Brussels
• Register for the hackathon in Genk
• Register for the hackahton in Kortrijk
• Register for the hackathon in MIC Mons

Superhackathon theme
Yes, winter is cosy with the snow and all – but after months of darkness we all need light. So the theme for the superhackathon is around spring, well-being, health and happiness. To be interpreted very broadly
Feel the ideas coming?

First time app? Build your first one – see how to get started here.

Design reference templates
You can use a template fully created for the Windows 8 style & experience. Just by binding the relevant data, you should have a good looking app that runs in the paradigm of Windows 8. And the good news: the templates are available as Visual Studio 2012 project in both C#/XAML and HTML/JavaScript options. So pick your template and platform and build your app in a breeze.

The template addresses App Views (Landscape, Fill, Snap and Portrait), Live Tiles, Search & Share Contract, Settings, Navigation across pages, Bottom & Top App Bar (If applicable). So get started today and finish off the app together with us!

Agenda

Day

8:30: Welcome and registration

9:00 – 9:30: Introduction and getting started

9:30 – 12:30: Coding (alone or with your group)Guidance, hands-on labs and expert advice on site

12:30 – 13:30: Lunch

13:30 – 16:00: Coding (alone or with your group)Guidance, hands-on labs and expert advice on site

16:00 – 17:00: Demo time and best app showdown for Day attendees
Publish your first finished app: prize

17:00: Break and end of the Day part

Night

17:30: Welcome and registration (or continue working for those going for the full day)

18:00 – 18:30: Introduction and getting started

18:30 – 19:30: Coding (alone or with your group)Guidance, hands-on labs and expert advice on site

19:30 – 20:30: Dinner

20:30 – 23:00: Coding (alone or with your group)Guidance, hands-on labs and expert advice on site

23:00 – 24:00: Demo time and best app showdown
Publish your first finished app: prize

24:00: End

To discover what Modern.IE is all about, check out the video below and then dive into the site to start benefiting from the tools.

The main features:

1. Scanning a web page

The page scan tool detects common coding practices that may cause compatibility problems, giving you clear indication of where the issues are occurring and providing you with guidance on how to solve the issues to deliver a better experience to your users.

2. Virtual testing tools

Testing on multiple versions of Internet Explorer is hard. With the virtual test tools, Modern.IE delivers two solutions to help you:

• A free 3-month subscription to BrowserStack that allows you to test your sites through a web based application, without the need to setup a virtual environment.
• Virtualized environments for you to download on Windows, Mac and Linux

3. Code with standards guidance

A great overview written by Rey Bango and Dave Methvin on coding practices and patterns for building modern standards-based sites while still supporting older versions of Internet Explorer.

Highly recommended: Modern.IE.