Given that the Azure function is configured for AAD authentication in the Authentication / Authorization section of the function as shown below

Now that we have provided for AAD authentication that requires a user login, it would be good if all operations are executed within the context of the same user.

Within your Azure function, you can get the details of the logged-in user using the ClaimsPrincipal

ClaimsPrincipal principal = req.HttpContext.User;

if (principal.Identity != null)

{

log.LogInformation(“Claims identity ” + principal.Identity.Name);

}

if (principal.Claims != null)

{

foreach (Claim c in principal.Claims)

{

log.LogInformation(“CLAIM TYPE: ” + c.Type + “; CLAIM VALUE: ” + c.Value + “</br>”);

}

 }

In the console, you can see all the claims returned

One of the claims returned is AADID

Read this specific claim value

Claim claim = principal.Claims.FirstOrDefault(c => c.Type.Contains(“objectidentifier”));

string aadobjid = “”;

if (claim != null)

{

aadobjid = claim.Value;

log.LogInformation(“aadobjid = ” + aadobjid);

}

Every CRM User that we create has an associated AADID stored along which is this objectid.

Set this to the cds client object we have created for impersonation

//establish connection with CDS

CdsServiceClient client = new CdsServiceClient(connectionString);

if (!string.IsNullOrEmpty(aadobjid))

{

client.CallerAADObjectId = new Guid(aadobjid);

}

Do note if you run a WhoAmI request – it still returns the id of the original credentials used for establishing the connection.

However, when you create a record, you will notice that the owner of the new record is the same user that had logged in to the connector.

Source

The post Impersonation within Azure Function or Custom Connector when using AAD authentication appeared first on Microsoft Dynamics 365 Blog.

Do remember, we have enabled AAD authentication for our Azure function.

The APP registration provided while enabling AAD authentication was set for multi-tenant authentication.

While we have an easy way to create a custom connector outside the scope of a solution, since we will also cover moving custom connectors from one environment to another, we will look at the steps to create the connector from within a solution

Navigate to https://make.powerapps.com and open your solution. Next, choose New > Other > Custom Connector.

First Step provide Connector details like name, image and short description. In the host add the host name of your Azure function i.e if your azure function url was

https://xxx.azurewebsites.net/api/GetTaxRate?code=xxxx

the host would be xxx.azurewebsites.net

Next comes security. Since we are looking for AAD authentication, we will choose OAuth 2.0 in this step.

Client ID = APP ID of the App registration created while setting the AAD security for Azure function

Client Secret = Secret key of the above app.

Leave the login url and tenant id as is.

Resource URL = Copy and paste the client id (app id of the app registration)

Ref: Why leave common in tenant id –  https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant

After you save the connector, the Redirect URL will be generated as shown above. Copy the redirect URL and we need to add this to our app registration (same one of which you have provided the client id here)

Next in the Definition tab, we will provide the details of the actions that we wish to expose through our connector

Under actions choose new action and provide the action details. The details entered here will be displayed to the user when using your connector and this action so make sure to have all the descriptive information included here.

In the request section click import from sample and provide the request details. You can copy the url from Postman where we had done the test call.

My request has 2 query parameters and in the header I need to pass the CRM connection details like URL and the Client ID, Secret for connection to the said environment.

When you click import, you will see all the query parameters and header information has been generated for you.

Click Update Connector to save all changes to the connector.

Before we test the connector we need to complete a few additional settings in Azure APP registration.

Completing the authentication settings on Azure AD APP registration

Navigate to Authentication section of the App Registration

Click Add a platform

Choose Web and paste the Redirect URI copied from the connector

Click Save to save this redirect uri.

Next navigate to the Expose an API setting of the APP registration and click add scope

Details provided here are displayed to the user when they are making a connection to our connector and are from another tenant. These details are used on the Consent screen

Test the connection for the connector:

Navigate to https://make.powerapps.com > Data > Custom Connectors

Click the + button against the connector to build a connection to it. When you click, you should be prompted to login to Azure AD

Enter the credentials, if you enter the credentials of an environment other than the current environment, you would be prompted with the following screen

Click Accept and you should have a successful connection object created for this connector.

Note sometimes, after this screen it may display you an error about app registration error. Try again and the next time it succeeds

Moving this custom connector to another environment

Since we added this connector to a solution, simply export the solution as managed solution and import it to the other environment.

Navigate to Custom connectors tab to find the connector listed there

Click the + button to test connection with the connector

If you get an error about invalid client id and secret key,

edit the connector and fill in the security page once again. It will be the same client id and secret key that we had added when creating this connector in the other environment.

Consuming this connector through Power Automate Flows

We are now ready to create a flow and add a step for the operation in our connector.

Choose Manual Trigger of flow

In the Custom tab, you should find our connector

Choose our action

And now provide the requested details in an end user friendly UI

And the result is

Source

The post Building Custom Connectors for Power Apps and Power Automate Flows – Part 2 appeared first on Microsoft Dynamics 365 Blog.