{"id":3068,"date":"2014-11-18T22:03:21","date_gmt":"2014-11-19T06:03:21","guid":{"rendered":"http:\/\/www.cloudidentity.com\/blog\/?p=3068"},"modified":"2014-11-18T22:03:21","modified_gmt":"2014-11-19T06:03:21","slug":"from-domain-to-tenantid","status":"publish","type":"post","link":"https:\/\/www.cloudidentity.com\/blog\/2014\/11\/18\/from-domain-to-tenantid\/","title":{"rendered":"From Domain to TenantID"},"content":{"rendered":"<p>Ha, I discovered that I kind of like to write short posts <img decoding=\"async\" class=\"wlEmoticon wlEmoticon-smile\" style=\"border-top-style: none; border-bottom-style: none; border-right-style: none; border-left-style: none\" alt=\"Smile\" src=\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2014\/11\/wlEmoticon-smile1.png\"> so here there\u2019s another one.<\/p>\n<p>Azure AD endpoints can be constructed with both domain and tenantID interchangeably, <em>\u201chttps:\/\/login.windows.net\/<strong>developertenant.onmicrosoft.com<\/strong>\/oauth2\/authorize\u201d<\/em> and <em>\u201chttps:\/\/login.windows.net\/<strong>6c3d51dd-f0e5-4959-b4ea-a80c4e36fe5e<\/strong>\/oauth2\/authorize\u201d <\/em>are functionally equivalent \u2013 however the tenantID has some clear advantages. For example: it is immutable, globally unique and non-reassignable, while domains do indeed change hands on occasions. Moreover, you can have many domains associated to a tenant but only one tenantID. Really, the only thing that the domain has going for itself is that it is human readable and there\u2019s a reasonable chance a user can remember and type it.<\/p>\n<p>Per the above, there are times in which it can come in useful to find out the TenantID for a given domain. The trick is reeeeeally simple. You can use the domain to construct one of the AAD endpoints which return tenant metadata, for example the OpenId Connect one; such metadata will contain the tenantID. In practice: say that you know that the target domain is developertenant.onmicrosoft.com. How do I find out the corresponding tenantID, without even being authenticated?<\/p>\n<p>Easy. I do a GET of <em>https:\/\/login.windows.net\/<strong>developertenant.onmicrosoft.com<\/strong>\/.well-known\/openid-configuration<\/em>.<\/p>\n<p>The result is a JSON file that has the tenantID all over it:<\/p>\n<pre class=\"csharpcode\">{\n   <span class=\"str\">\"authorization_endpoint\"<\/span> : <span class=\"str\">\"https:\/\/login.windows.net\/<font style=\"background-color: #ffff00\">6c3d51dd-f0e5-4959-b4ea-a80c4e36fe5e<\/font>\/oauth2\/authorize\"<\/span>,\n   <span class=\"str\">\"check_session_iframe\"<\/span> : <span class=\"str\">\"https:\/\/login.windows.net\/<font style=\"background-color: #ffff00\">6c3d51dd-f0e5-4959-b4ea-a80c4e36fe5e<\/font>\/oauth2\/checksession\"<\/span>,\n   <span class=\"str\">\"end_session_endpoint\"<\/span> : <span class=\"str\">\"https:\/\/login.windows.net\/<font style=\"background-color: #ffff00\">6c3d51dd-f0e5-4959-b4ea-a80c4e36fe5e<\/font>\/oauth2\/logout\"<\/span>,\n   <span class=\"str\">\"id_token_signing_alg_values_supported\"<\/span> : [ <span class=\"str\">\"RS256\"<\/span> ],\n   <span class=\"str\">\"issuer\"<\/span> : <span class=\"str\">\"https:\/\/sts.windows.net\/<font style=\"background-color: #ffff00\">6c3d51dd-f0e5-4959-b4ea-a80c4e36fe5e<\/font>\/\"<\/span>,\n   <span class=\"str\">\"jwks_uri\"<\/span> : <span class=\"str\">\"https:\/\/login.windows.net\/common\/discovery\/keys\"<\/span>,\n   <span class=\"str\">\"microsoft_multi_refresh_token\"<\/span> : <span class=\"kwrd\">true<\/span>,\n   <span class=\"str\">\"response_modes_supported\"<\/span> : [ <span class=\"str\">\"query\"<\/span>, <span class=\"str\">\"fragment\"<\/span>, <span class=\"str\">\"form_post\"<\/span> ],\n   <span class=\"str\">\"response_types_supported\"<\/span> : [ <span class=\"str\">\"code\"<\/span>, <span class=\"str\">\"id_token\"<\/span>, <span class=\"str\">\"code id_token\"<\/span>, <span class=\"str\">\"token\"<\/span> ],\n   <span class=\"str\">\"scopes_supported\"<\/span> : [ <span class=\"str\">\"openid\"<\/span> ],\n   <span class=\"str\">\"subject_types_supported\"<\/span> : [ <span class=\"str\">\"pairwise\"<\/span> ],\n   <span class=\"str\">\"token_endpoint\"<\/span> : <span class=\"str\">\"https:\/\/login.windows.net\/<font style=\"background-color: #ffff00\">6c3d51dd-f0e5-4959-b4ea-a80c4e36fe5e<\/font>\/oauth2\/token\"<\/span>,\n   <span class=\"str\">\"token_endpoint_auth_methods_supported\"<\/span> : [ <span class=\"str\">\"client_secret_post\"<\/span>, <span class=\"str\">\"private_key_jwt\"<\/span> ],\n   <span class=\"str\">\"userinfo_endpoint\"<\/span> : <span class=\"str\">\"https:\/\/login.windows.net\/<font style=\"background-color: #ffff00\">6c3d51dd-f0e5-4959-b4ea-a80c4e36fe5e<\/font>\/openid\/userinfo\"<\/span>\n}<\/pre>\n<style type=\"text\/css\">.csharpcode, .csharpcode pre\n{\n\tfont-size: small;\n\tcolor: black;\n\tfont-family: consolas, \"Courier New\", courier, monospace;\n\tbackground-color: #ffffff;\n\t\/*white-space: pre;*\/\n}\n.csharpcode pre { margin: 0em; }\n.csharpcode .rem { color: #008000; }\n.csharpcode .kwrd { color: #0000ff; }\n.csharpcode .str { color: #006080; }\n.csharpcode .op { color: #0000c0; }\n.csharpcode .preproc { color: #cc6633; }\n.csharpcode .asp { background-color: #ffff00; }\n.csharpcode .html { color: #800000; }\n.csharpcode .attr { color: #ff0000; }\n.csharpcode .alt \n{\n\tbackground-color: #f4f4f4;\n\twidth: 100%;\n\tmargin: 0em;\n}\n.csharpcode .lnum { color: #606060; }\n<\/style>\n<p>Whip out your favorite JSON parsing class, and you\u2019re done. Ta\u2014dahh \u266b<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ha, I discovered that I kind of like to write short posts so here there\u2019s another one. Azure AD endpoints can be constructed with both domain and tenantID interchangeably, \u201chttps:\/\/login.windows.net\/developertenant.onmicrosoft.com\/oauth2\/authorize\u201d and \u201chttps:\/\/login.windows.net\/6c3d51dd-f0e5-4959-b4ea-a80c4e36fe5e\/oauth2\/authorize\u201d are functionally equivalent \u2013 however the tenantID has some clear advantages. For example: it is immutable, globally unique and non-reassignable, while&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3068","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3068","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/comments?post=3068"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3068\/revisions"}],"predecessor-version":[{"id":3069,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3068\/revisions\/3069"}],"wp:attachment":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/media?parent=3068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/categories?post=3068"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/tags?post=3068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}