{"id":2388,"date":"2013-09-12T10:00:36","date_gmt":"2013-09-12T17:00:36","guid":{"rendered":"http:\/\/www.cloudidentity.com\/blog\/?p=2388"},"modified":"2024-07-02T15:08:28","modified_gmt":"2024-07-02T22:08:28","slug":"active-directory-authentication-library-adal-v1-for-net-general-availability","status":"publish","type":"post","link":"https:\/\/www.cloudidentity.com\/blog\/2013\/09\/12\/active-directory-authentication-library-adal-v1-for-net-general-availability\/","title":{"rendered":"Active Directory Authentication Library (ADAL) v1 for .NET – General Availability!"},"content":{"rendered":"

After more than one year, three developer previews and a ton<\/em> of feedback from customers and partners (that would be you! Thank you!!!) today we are finally announcing the general availability of the Active Directory Authentication Library (ADAL) for .NET v1.0<\/span><\/strong>!
\nYou can download it directly from the NuGet gallery<\/a> or get it from Visual Studio.<\/p>\n

Through the year we produced a lot of material on ADAL, but between name changes (it started its existence as Windows Azure Authentication Library – AAL) and features set variations it might not be super easy for you to get a good idea of what the product does. The good news is that the MSDN documentation for ADAL is on its way. Also, I am going to take this chance to pretend that I never wrote anything about ADAL and use this post to (re)introduce the library to you, so that you can be confident that what you are reading is up to date for the RTM version. I will also try to convey the why\u2019s behind the current design, which are likely to make this a pretty long post. So, grab your favorite caffeine delivery vessel and read on! \"Smile\"<\/p>\n

What Is the Active Directory Authentication Library (ADAL)?<\/h2>\n

 <\/p>\n

If you are into definitions, here\u2019s one for you:<\/p>\n

The Windows Azure Authentication Library (ADAL) is a library meant to help developers to take advantage of Active Directory for enabling client apps to access protected resources.<\/em><\/p><\/blockquote>\n

In more concrete terms. If you have a resource (Web API or otherwise) that is secured via Active Directory, and you have a client application that needs to consume it, ADAL will help you to obtain the security token(s) the client needs to access the resource. In addition, ADAL will help you to maintain and reuse the tokens already obtained.<\/p>\n

That\u2019s pretty much it, actually. The rest is all about qualifying a bit better the terms I used:<\/p>\n

Active Directory – <\/strong>I am using the term in its broadest sense. In practice: ADAL can work with Windows Azure AD, Windows Server AD (it requires the ADFS version in Windows Server 2012 R2) and ACS namespace.<\/p>\n

Protected resource \u2013 <\/strong>In theory this can be pretty much anything that can be remotely accessed; in practice, we expect it to be a REST service in the vast majority of cases.
\n\u201dProtected\u201d in this context means that the service expects the caller to present an access token, which must be verified as coming from the right AD before granting access.<\/p>\n

Client app \u2013 <\/strong>This probably calls to mind the classic rich client applications, something with a UI built on the native visual elements of the platform it targets. ADAL can totally work with those, I\u2019d even daresay they are the top scenario for this release, but they are not the only one: any app operating in a client role<\/em> is a candidate. In practice, any application that is not a browser (code-behind of web sites, long running processes, workers, batches, etc) and needs to request a token to access a resource is a client app that can take advantage of ADAL.<\/p>\n

Today\u2019s release, the v1 of ADAL .NET, applies those principles to the .NET platform. However all of the above holds for ADAL in general: different platforms will have different capabilities and admit different app types, but that\u2019s the general scope.<\/p>\n

Now that you know what ADAL is for, let\u2019s focus on how it operates.
\nWhereas in the past our libraries surfaced all the constructs and concepts of the protocols and artifacts used in the mechanics of authentication, in ADAL we decided to focus on the scenario and the high level tasks. That allows us to eliminate, or at the very least late-bind, a lot of the complexity that with the traditional approaches would be something inescapable even for the simplest uses. Skeptical? A healthy attitude, very good. Go on, all will be revealed! \"Smile\"<\/p>\n

ADAL\u2019s Main Pattern<\/h3>\n

Identity is hard. There are so many things one needs to keep track of! Token formats, what protocol to use for a given topology, which parameters work for one identity provider but not for the other, how to prevent the user from being prompted every time, how to avoid saving passwords and secrets, what to do when you need multiple authentication factors, and many more obscure details.<\/p>\n

\u2026And yet, a high level description of how things work sounds so simple:<\/p>\n