Authenticating a Server Application to a Remote Resource: In this scenario, a developer has an application running on a server that needs to access a remote resource, such as a REST service. She has a Windows Azure subscription, and therefore, can leverage Windows Azure AD to manage the application’s identity. She also knows how to invoke the downstream service, and knows the Windows Azure AD tenant the service uses. As a result, she can use ADAL to facilitate authentication with Windows Azure AD, by explicitly handling the application’s credentials. Authentication with Windows Azure AD results in a token, and ADAL makes it easy to obtain this token and use it to make requests to the REST service. API Windows Azure AD Graph provides programmatic access to Windows Azure AD through REST API endpoints. Using Windows Azure AD Graph, developers can execute create, read, update and delete (CRUD) operations on Windows Azure AD objects such as users and groups. In the on-premises world, you would usually programmatically access Windows Server Active Directory by using ADSI or ADO.NET libraries. In the cloud, you programmatically access Windows Azure AD using Windows Azure AD Graph. Windows Azure AD Graph enables the following key scenarios: Multi-Tenant Applications That Require Windows Azure AD Access. Building a multi-tenant application that requires access to a tenant’s directory data (very similar to an on-premises application that use LDAP to query the local directory). Directory access for reading or writing data is done by calling the Graph API. Typical use cases include people pickers, validating a user’s security group membership, updating group membership, provisioning new users and groups, resetting users’ passwords, and validating a tenant or users’ licensing information. Creating Reusable Features That Require Windows Azure AD Access. An independent software vendor (ISV) that specializes in creating and selling reusable features that extend the functionality of cloud applications. An ISV can offer its customers reusable features that require access to Windows Azure AD objects. More Information Detailed implementation guidance is available through the article. Windows Azure Service Layer Security Considerations This section highlights some specific threats that developers are responsible for mitigating in the cloud and describes the protections that Windows Azure provides against an array of service-, platform- and infrastructure-layer security threats.
Authenticating a Server Application to a Remote Resource: In this scenario, a developer has an application running on a server that needs to access a remote resource, such as a REST service. She has a Windows Azure subscription, and therefore, can leverage Windows Azure AD to manage the application’s identity. She also knows how to invoke the downstream service, and knows the Windows Azure AD tenant the service uses. As a result, she can use ADAL to facilitate authentication with Windows Azure AD, by explicitly handling the application’s credentials. Authentication with Windows Azure AD results in a token, and ADAL makes it easy to obtain this token and use it to make requests to the REST service. API Windows Azure AD Graph provides programmatic access to Windows Azure AD through REST API endpoints. Using Windows Azure AD Graph, developers can execute create, read, update and delete (CRUD) operations on Windows Azure AD objects such as users and groups. In the on-premises world, you would usually programmatically access Windows Server Active Directory by using ADSI or ADO.NET libraries. In the cloud, you programmatically access Windows Azure AD using Windows Azure AD Graph. Windows Azure AD Graph enables the following key scenarios: Multi-Tenant Applications That Require Windows Azure AD Access. Building a multi-tenant application that requires access to a tenant’s directory data (very similar to an on-premises application that use LDAP to query the local directory). Directory access for reading or writing data is done by calling the Graph API. Typical use cases include people pickers, validating a user’s security group membership, updating group membership, provisioning new users and groups, resetting users’ passwords, and validating a tenant or users’ licensing information. Creating Reusable Features That Require Windows Azure AD Access. An independent software vendor (ISV) that specializes in creating and selling reusable features that extend the functionality of cloud applications. An ISV can offer its customers reusable features that require access to Windows Azure AD objects. More Information Detailed implementation guidance is available through the article. Windows Azure Service Layer Security Considerations This section highlights some specific threats that developers are responsible for mitigating in the cloud and describes the protections that Windows Azure provides against an array of service-, platform- and infrastructure-layer security threats.
SecurityBestPracticesForWindowsAzureSolutionsFeb2014.docx