「ASP.NET Core Blazor WebAssembly でホストされるアプリを Azure Active Directory でセキュリティ保護する」のアプリ登録をコマンドで。

docs.microsoft.com

サーバー API アプリの登録。

# Create Application Object
$app = az ad app create --display-name "Blazor Server AAD"

# Get Application ID
$appId = ($app | ConvertFrom-Json).appId

# Create Service Principal
az ad sp create --id $appId

# 既定のスコープを削除
$oauth2Permissions = ($app | ConvertFrom-Json).oauth2Permissions
$oauth2Permissions[0].isEnabled = $false
$oauth2Permissions = ConvertTo-Json -InputObject @($oauth2Permissions)
$oauth2Permissions | Out-File -FilePath .\oauth2Permissions.json
az ad app update --id $appId --set oauth2Permissions=`@oauth2Permissions.json
az ad app update --id $appId --set oauth2Permissions="[]"
Remove-Item -Path .\oauth2Permissions.json

# アプリケーションIDのURIを追加
az ad app update --id $appId --identifier-uris "api://$appId"

# スコープを追加
$oauth2Permissions = @{
    adminConsentDescription = "Allows the app to access server app API"
    adminConsentDisplayName = "Access API"
    id = (New-Guid).Guid
    isEnabled = $true
    type = "Admin"
    userConsentDescription = ""
    userConsentDisplayName = ""
    value = "API.Access"
}
$oauth2Permissions = ConvertTo-Json -InputObject @($oauth2Permissions)
$oauth2Permissions | Out-File -FilePath .\oauth2Permissions.json
az ad app update --id $appId --set oauth2Permissions=`@oauth2Permissions.json
Remove-Item -Path .\oauth2Permissions.json

クライアントアプリの登録。

# Create Application Object
$app = az ad app create --display-name "Blazor Client AAD"

# Get Application ID & Object ID
$appId = ($app | ConvertFrom-Json).appId
$objectId = ($app | ConvertFrom-Json).objectId

# Create Service Principal
az ad sp create --id $appId

# 既定のスコープを削除
$oauth2Permissions = ($app | ConvertFrom-Json).oauth2Permissions
$oauth2Permissions[0].isEnabled = $false
$oauth2Permissions = ConvertTo-Json -InputObject @($oauth2Permissions)
$oauth2Permissions | Out-File -FilePath .\oauth2Permissions.json
az ad app update --id $appId --set oauth2Permissions=`@oauth2Permissions.json
az ad app update --id $appId --set oauth2Permissions="[]"
Remove-Item -Path .\oauth2Permissions.json

# アクセストークンを取得する
$response = az account get-access-token --resource-type ms-graph | ConvertFrom-Json
$accessToken = $response.accesstoken
$headers = @{"Authorization" = "Bearer $accessToken"; "Content-Type" = "application/json" }

# SPA のリダイレクトURLを設定する
$body = @{
    spa = @{
        redirectUris = @(
            "https://localhost:5001/authentication/login-callback"
        )
    }
} | ConvertTo-Json
Invoke-RestMethod -Method Patch -Uri https://graph.microsoft.com/v1.0/applications/$objectId -Headers $headers -Body $body

# 暗黙的な許可を無効にする
$body = @{
    web = @{
        implicitGrantSettings = @{
            enableAccessTokenIssuance = $false
            enableIdTokenIssuance     = $false
        }
    }
} | ConvertTo-Json
Invoke-RestMethod -Method Patch -Uri https://graph.microsoft.com/v1.0/applications/$objectId -Headers $headers -Body $body

# アクセス許可を付与する
$apiName = "Microsoft Graph"
$permissionType = "Scope"
$permissionName = "User.Read"
$apiServicePrincipal = az ad sp list --filter "displayname eq '$apiName'" | ConvertFrom-Json
$apiPermission = $apiServicePrincipal.oauth2Permissions | Where-Object { $_.value -eq $permissionName }
az ad app permission add --id $appId --api $apiServicePrincipal.appId --api-permissions "$($apiPermission.id)=$permissionType"

# アクセス許可を付与する
$apiName = "Blazor Server AAD"
$permissionType = "Scope"
$permissionName = "API.Access"
$apiServicePrincipal = az ad sp list --filter "displayname eq '$apiName'" | ConvertFrom-Json
$apiPermission = $apiServicePrincipal.oauth2Permissions | Where-Object { $_.value -eq $permissionName }
az ad app permission add --id $appId --api $apiServicePrincipal.appId --api-permissions "$($apiPermission.id)=$permissionType"

# 管理者の同意を与える
az ad app permission grant --id $appId --api $apiServicePrincipal.appId --scope $permissionName