Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 21 Next »

Description

Let's set up AAD authentication

Overview


1. Limitations

Barcode login is not suited for use with AAD as it will require two barcodes and generally lacks security.

2. Prerequisites

  • This guide only applies to Business Central Online and Nav and Business Central OnPrem
  • Note that the OnPrem setup requires an additional step (step 7), which should not be done for Business Central Online

  • An Administrator user account associated with the Customers Business Central environment

  • Extension version MOB5.18
  • Android App 1.5.0


3. Creating Microsoft Azure App Registration

To access Business Central using AAD authentication, you must grant client access to this service.

  1. Log into https://portal.azure.com using an administrator user associated with the Customers Business Central environment
  2. Navigate to “Azure Active Directory” -> “App registrations”:




  3. Select “New registration” and name it Mobile WMS



4. Configure Redirect URI

  1. Go to Redirect URI

  2. Select “Public client/native (mobile & desktop)” (Do not select "Web")

    Enter this URI:     https://businesscentral.dynamics.com/



    Select “Register” 


5. Configuring the Application Registration


  1. Navigate to “API permissions”
  2. Select “Add a permission”



  3. Select "Dynamics 365 Business Central"




  4. Select "Delegated permissions"



  5. Select “user_impersonation” 


6. Gathering Information

This section outlines how to gather the data required for the mobile devices to connect using AAD.


Tasklet Factory needs the following data from you: 

  1. TenantId

  2. ClientId

  3. Soap URL

Please Note

If TenantId is not a part of the Soap URL, ite means that the App Registration has been set up in the wrong AAD


Get ID's

  1. Navigate to "Azure active directory"
  2. Select "Manage"
  3. Select "App registration"
  4. Select the new "Mobile WMS" registration
  5. Please copy and save the values marked in red


Get Application (client) ID


Get the Directory (tenant) ID



Get SOAP URL

  1. Log into Business Central
  2. Go to Web services page and
  3. Find the entry for MOB WS Dispatcher
  4. Please copy the SOAP URL field


7. Configure the Service Tier

Only OnPrem

Note that this section is only for OnPrem Installations.


On the service tier that you are using for the Mobile Devices, find the section called Azure Active Directory (Azure AD) - see below.

In the Valid Audiences field enter https://api.businesscentral.dynamics.com

It is possible to have several inputs in this field, they can be separated by a semicolon.

The value is a semicolon-separated list of audiences.


8. Updating Mobile Configuration

Using the Service Desk please send us the TenantId, ClientId and Soap URL on the project ticket or raise a new ticket 

 or

if this is for your own partner device, see below and just fill in the info in the placeholders for Tenant ID, Client Id + Soap URL.



Example and Template for Start.cfg -file

Modify in the red marked sections with the gathered information.

<!-- ENDPOINTS -->
<endpoints>

    <endpoint id="01" displayName="D365BC" protocol="classic" type="D365BC" address="Soap URL">
      <azureConfiguration authority="https://login.microsoftonline.com/TenantId/oauth2/v2.0/authorize" scopes="https://api.businesscentral.dynamics.com/user_impersonation" clientId="ClientId" returnUri="https://businesscentral.dynamics.com/"/>
    </endpoint>

</endpoints>

9. Define Scopes if connecting to OnPrem installation or different product family (e.g. LS Central or Wiise)

Prerequisites

Android App 1.6.0.1

When connecting to OnPrem installation or a different product family like LS Central or Wiise, we will use the standard scope of Business Central to authenticate against in Azure AD. For this we will need to add the scopes attribute as shown below to the start.cfg file.

Modify in the red marked sections with the gathered information.

<!-- ENDPOINTS -->
<endpoints>

    <endpoint id="01" displayName="D365BC" protocol="classic" type="D365BC" address="Soap URL">
      <azureConfiguration authority="https://login.microsoftonline.com/TenantId/oauth2/v2.0/authorize" scopes="https://api.businesscentral.dynamics.com/user_impersonation" clientId="ClientId" returnUri="https://businesscentral.dynamics.com/"/>
    </endpoint>

</endpoints>

10. Troubleshooting Login Issues


Next

Basic configuration (3/3)


Overview


  • No labels