Muokkaa

Jaa

Sign in users in sample macOS (Swift) app by using native authentication

  • Artikkeli

This guide shows how to run an macOS sample application that demonstrates sign-up and sign in scenarios using Microsoft Entra External ID.

In this article, you learn how to:

  • Register application in the external tenant.
  • Enable public client and native authentication flows.
  • Create user flow in the external tenant.
  • Associate your application with the user flow.
  • Update a sample native macOS application to use your own external tenant details.
  • Run and test the sample native macOS application.

Prerequisites

Register an application

To enable your application to sign in users with Microsoft Entra, Microsoft Entra External ID must be made aware of the application you create. The app registration establishes a trust relationship between the app and Microsoft Entra. When you register an application, External ID generates a unique identifier known as an Application (client) ID, a value used to identify your app when creating authentication requests.

The following steps show you how to register your app in the Microsoft Entra admin center:

  1. Sign in to the Microsoft Entra admin center as at least an Application Developer.

  2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to your external tenant from the Directories + subscriptions menu.

  3. Browse to Identity >Applications > App registrations.

  4. Select + New registration.

  5. In the Register an application page that appears;

    1. Enter a meaningful application Name that is displayed to users of the app, for example ciam-client-app.
    2. Under Supported account types, select Accounts in this organizational directory only.

  6. Select Register.

  7. The application's Overview pane displays upon successful registration. Record the Application (client) ID to be used in your application source code.

Enable public client and native authentication flows

To specify that this app is a public client and can use native authentication, enable public client and native authentication flows:

  1. From the app registrations page, select the app registration for which you want to enable public client and native authentication flows.
  2. Under Manage, select Authentication.
  3. Under Advanced settings, allow public client flows:
    1. For Enable the following mobile and desktop flows select Yes.
    2. For Enable native authentication, select Yes.
  4. Select Save button.

Once you register your application, it gets assigned the User.Read permission. However, since the tenant is an external tenant, the customer users themselves can't consent to this permission. You as the admin must consent to this permission on behalf of all the users in the tenant:

  1. From the App registrations page, select the application that you created (such as ciam-client-app) to open its Overview page.

  2. Under Manage, select API permissions.

    1. Select Grant admin consent for <your tenant name>, then select Yes.
    2. Select Refresh, then verify that Granted for <your tenant name> appears under Status for the permission.

Create a user flow

Follow these steps to create a user flow.

  1. Sign in to the Microsoft Entra admin center as at least an Application Developer.

  2. If you have access to multiple tenants, make sure you use the directory that contains your external tenant:

    1. Select the Directories + subscriptions icon in the toolbar.
    2. On the Portal settings | Directories + subscriptions page, find your external tenant directory in the Directory name list, and then select Switch.

  3. On the sidebar menu, select Identity.

  4. Select External Identities > User flows.

  5. Select + New user flow.

  6. On the Create page:

    1. Enter a Name for the user flow, such as SignInSignUpSample.

    2. In the Identity providers list, select Email Accounts. This identity provider allows users to sign-in or sign-up using their email address and password.

    3. Under Email accounts, you can select one of the two options. For this tutorial, select Email with password.

      • Email with password: Allows new users to sign up and sign in using an email address as the sign-in name and a password as their first factor credential.
      • Email one-time passcode: Allows new users to sign up and sign in using an email address as the sign-in name and email one-time passcode as their first factor credential. For this option to be available at the user flow level, make sure you enable email one-time passcode (OTP) at the tenant level (select All Identity Providers, and then for Email One-time passcode select Configured, select the Yes option, and then select Save).

    4. Under User attributes, you can choose the attributes you want to collect from the user upon sign-up. For this guide, select Country/Region and City.

  7. Select Create. The new user flow appears in the User flows list. If necessary, refresh the page.

Associate the application with the user flow

For the customer users to see the sign-up or sign-in experience when they use your app, you need to associate your app with a user flow. Although many applications can be associated with your user flow, a single application can only be associated with one user flow.

  1. On the sidebar menu, select Identity.

  2. Select External Identities, then User flows.

  3. In the User flows page, select the User flow name you created earlier, for example, SignInSignUpSample.

  4. Under Use, select Applications.

  5. Select Add application.

  6. Select the application from the list such as ciam-client-app or use the search box to find the application, and then select it.

  7. Choose Select.

Once you associate your app with a user flow, you can test your user flow by simulating a user’s sign-up or sign-in experience with your application from within the Microsoft Entra admin center. To do so, use the steps in Test your sign-up and sign-in user flow.

Clone sample macOS application

  1. Open Terminal and navigate to a directory where you want to keep the code.

  2. Clone the macOS application from GitHub by running the following command:

    git clone https://github.com/Azure-Samples/ms-identity-ciam-native-auth-macos-sample.git

  3. Navigate to the directory where the repo was cloned:

    cd ms-identity-ciam-native-auth-macos-sample

Configure the sample macOS application

  1. In Xcode, open NativeAuthSampleAppMacOS.xcodeproj project.

  2. Open NativeAuthSampleAppMacOS/Configuration.swift file.

  3. Find the placeholder:

    • Enter_the_Application_Id_Here and replace it with the Application (client) ID of the app you registered earlier.
    • Enter_the_Tenant_Subdomain_Here and replace it with the Directory (tenant) subdomain. For example, if your tenant primary domain is contoso.onmicrosoft.com, use contoso. If you don't have your tenant subdomain, learn how to read your tenant details.

Note

Remember to select a scheme to build and destination where you run the built products. Each scheme contains a list of real or simulated devices that represent the available destinations.

Run and test sample macOS application

To build and run your code, select Run from the Product menu in Xcode. After a successful build, Xcode will launch the sample app in the Simulator.

Screenshot of user prompt to enter email and password in macOS app.

This guide tests Email and password usage. Enter a valid email address and password, select Sign Up, and launch the submit code screen:

Screenshot of user prompt to enter one-time passcode (OTP) in macOS app.

After you enter your email address on the previous screen, the application will send a verification code to it. Once you submit the received code, the application takes you back to the previous screen and automatically signs you in.

Next steps