How to setup Content Delivery API with AAD

  • Updated

<1> Setup Azure Active Directory

Following the steps in the docs below to config AAD
https://support.optimizely.com/hc/en-us/articles/20767067525773

 

<2> Integrated  CD with AAD into CMS site

Step 1: Install JwtBearer and content delivery API package:

Note: You can add the package directly to “.csproj” file to install like this
<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.23" />
<PackageReference Include="EPiServer.ContentDeliveryApi.Cms" Version="3.9.0" />
<PackageReference Include="EPiServer.ContentDefinitionsApi" Version="3.9.0" />
<PackageReference Include="EPiServer.ContentManagementApi" Version="3.9.0" />

Step 2: Update Startup.cs file

// AAD Auth info
           var clientId = _configuration["Authentication:AzureClientID"];
           var clientSecret = "YOUR CLIENT SECRET ";
           var callbackPath = "/signin-oidc";
           var azureAuthority = _configuration["Authentication:azureAuthority"];
           var cookieSchema = "azure-cookie";
           var challengeSchema = "azure";
           var oidcConfig = new ConfigurationManager<OpenIdConnectConfiguration>($"{azureAuthority}/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever()).GetConfigurationAsync().Result;
   
// Authentication Config
           services
             .AddAuthentication(options =>
             {
                 options.DefaultAuthenticateScheme = cookieSchema;
                 options.DefaultChallengeScheme = challengeSchema;
             })
             .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme,
                 options =>
                 {
                     options.TokenValidationParameters = new TokenValidationParameters
                     {
                         ValidIssuer = azureAuthority,
                         ValidateIssuer = true,
                         ValidAudience = clientId,
                         ValidateAudience = true,
                         ValidateLifetime = true,
                         IssuerSigningKeys = oidcConfig.SigningKeys,
                         ValidateIssuerSigningKey = true
                     };
                  })
             .AddCookie(cookieSchema, options =>
             {
                 //same as last docs~~~
             })

              .AddOpenIdConnect(challengeSchema, options =>
             {
               //same as last docs~~~
             })

// Add content delivery config

            services.AddContentDeliveryApi(JwtBearerDefaults.AuthenticationScheme)
               .WithFriendlyUrl()
               .WithSiteBasedCors();

            services.AddContentDefinitionsApi(c =>
           {
               c.DisableScopeValidation = true;
           });

            services.AddContentManagementApi(c =>
           {
              c.DisableScopeValidation = true;
           });

 

Step 3: Try to test the CD API

  1. Make sure you can log in the CMS using the Entra ID (formerly Azure AD) account from Section 1
  2. After accessing Admin mode, set up a page that is not visible to Everyone but Administrators only


  3. This page has ID = 9 so we will send a request to get this content in Postman but with no authentication first.It should return a 401 Unauthorized error as this content will not be visible for Everyone Query: https://localhost:5000/api/episerver/v3.0/content/9


  4. In this example, we will get the JWT to communicate with CD using the URL: https://login.microsoftonline.com/{TENNANTID}/oauth2/v2.0/token For more information: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc#authorization-request In this case, we will use the id_token to authenticate. Decode the token we can see that has 3 roles



  5. Try to get the content again with the Bearer token and the content should return now