create a windows phone multitenant app with azure ad

Question

I am building a windows phone 8 app using Azure Active directory for authentication. This would be a multi-tenant application where once the user logs in I would like to read certain basic information from their tenant in AD.

I am planning on using http://azure.microsoft.com/en-us/documentation/articles/mobile-services-how-to-register-active-directory-authentication/ as a starting point and will use a browser control in my app to take the user to the standard azure AD login page.

So here is my question, while I know how to use Azure AD Graph API to find specific information about my own tenant, how do I find out the tenant domain name of the external user so I can use Graph API to find information about their tenant/AD? If I had created the login and password input fields in my own app, I could have easily figured out their domain but since I redirect them to the Azure AD service....I am having a hard time figuring out how I will determine their domain name so I could then do a Graph API query on it?

Thanks for your help!

Answer 1

In your authorize request, use code+id_token response_type. Your client app will receive an id_token - a jwt with user's information including the user's tenant id (tid) that you can use to construct Graph API queries.

Request:

login.windows.net/common/oauth2/authorize?response_type=code+id_token&client_id=f034219b-9048-452a-aa0c-ce7661fcd2a0&resource=<graph api resource id>&redirect_uri=<your redirect uri>&nonce=7a16fa03-c29d-4e6a-aff7-c021b06a9b27

Response:

<redirect_uri>?code=AwABAAAAvPM1KaPlrEqdFSBzjqfTGB_K3PrvqLGyrC3bsLKpSYcEMwgiAbLpF6yKUxMRX3P1g3GqXDmmtKUkuVr0HjiWhO5EuW5RExGaucKvRhSes9Fzxm4Mxsoz0_8hbAwdC7zn8e74ENcgWwat6OLpSkYLFvBuJFvhp8k0ng3VIxJm5iMP7iC7DM1XGO5ECnwjz-Iu6MsiTwRG78L8p1x8vudlF-uAyDBkINiGRI-cFv6Q65xoU-uNWuiGBQ7H03OkDVnu29LYjrwGmJvq6yL1wzL2SyBXR8fKmmgqMTqu8jz0I94oTPYYtv-Cnq2hXP8_QpaDjiHHM6v9ymkSYnVNvSlkDgeqhwnqoU29DOEYQLNuAewzbWkIsCQJl9SCmcTtJ8Xsh75HV2KbVMHKAfZ0yLUggCAA&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik5HVEZ2ZEstZnl0aEV1THdqcHdBSk9NOW4tQSJ9.eyJhdWQiOiJmMDM0MjE5Yi05MDQ4LTQ1MmEtYWEwYy1jZTc2NjFmY2QyYTAiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC82MmUxNzNlOS0zMDFlLTQyM2UtYmNkNC0yOTEyMWVjMWFhMjQvIiwiaWF0IjoxMzk3MDY0NTE3LCJuYmYiOjEzOTcwNjQ1MTcsImV4cCI6MTM5NzA2ODQxNywidmVyIjoiMS4wIiwidGlkIjoiNjJlMTczZTktMzAxZS00MjNlLWJjZDQtMjkxMjFlYzFhYTI0Iiwib2lkIjoiODRlNjg1MmMtYjJlZS00ODMwLTkyMjYtNjYwNzYzOWU2Mzc0IiwidXBuIjoiYmFkYW1zQGR1c2h5YW50Z2lsbC5jb20iLCJ1bmlxdWVfbmFtZSI6ImJhZGFtc0BkdXNoeWFudGdpbGwuY29tIiwic3ViIjoiRGVldTRUTmxPZjMwSVA2YnBBRVJlOTRNNHJ2VHpfeDdFWE5UYkNXeTFTbyIsImZhbWlseV9uYW1lIjoiQWRhbXMiLCJnaXZlbl9uYW1lIjoiQnJhZCIsIm5vbmNlIjoiN2ExNmZhMDMtYzI5ZC00ZTZhLWFmZjctYzAyMWIwNmE5YjI3IiwiY19oYXNoIjoiM01FYmNleUFYUlBtOGVMRE11cEpUZyJ9.L4FcbHGCTROgDT4Hpuc2kczSOh7HooLpUTQVpYve76Ucwyl4pFmb1IDKsES_d0stK6kyr2__Qs3ckMs5lm0SnsMuI3KIK53j3H_KeaswfbD5AYOm7gbEqA4VDcjQRVbEHW4Lyd8ij4b-Xss9O2N6ZbSKRZ-uuM78y5-lmQZ5KsRsdg7B9sLfHsRTjbrT9YryPUotbivUg3ioSZ9g3PYZwb0XiRO9enM9nYjz8rZXINB3ODr7-ccr4_n8AOWwvPunM1rXLxTZTEO3ADDU-anK_2OLH6Ab_6OMKljzigJbciol7DvBXaNZf7guHvDXV6VXTnPim2XhSOp_tcaVRj4yAA&session_state=b41d7528-2c8c-4e76-b17f-0732e8697798

Decoded id_token jwt:

aud: f034219b-9048-452a-aa0c-ce7661fcd2a0
iss: https://sts.windows.net/62e173e9-301e-423e-bcd4-29121ec1aa24/
iat: 1397064517
nbf: 1397064517
exp: 1397068417
ver: 1.0
**tid**: 62e173e9-301e-423e-bcd4-29121ec1aa24
oid: 84e6852c-b2ee-4830-9226-6607639e6374
upn: badams@dushyantgill.com
unique_name: badams@dushyantgill.com
sub: Deeu4TNlOf30IP6bpAERe94M4rvTz_x7EXNTbCWy1So
family_name: Adams
given_name: Brad
nonce: 7a16fa03-c29d-4e6a-aff7-c021b06a9b27
c_hash: 3MEbceyAXRPm8eLDMupJTg