<commit_before># Microsoft Azure Container Service Engine - Kubernetes AAD integration Walkthrough

This is walkthrough is to help you get start with Azure Active Directory(AAD) integeration with an ACS-Engine Kubernetes cluster.

[OpenID Connect](http://openid.net/connect/) is a simple identity layer built on top of the OAuth 2.0 protocol, and it is supported by both AAD and Kubernetes. Here we're going to use OpenID Connect as the communication protocol.

Please also refer to [Azure Active Directory plugin for client authentication](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/client-go/plugin/pkg/client/auth/azure/README.md) in Kubernetes repo for more details abount OpenID Connect and AAD support in upstream.

## Prerequisites
1. An Azure Active Directory tenant, will refer as `AAD Tenant`. You can use the tenant for your Azure subscription;
2. A `Web app / API` type AAD application, will refer as `Server Application`. This application represents the `apiserver`;  For groups to work properly, you'll need to edit the `Server Application` Manifest and set `groupMembershipClaims` to either `All` or `SecurityGroup`.
3. A `Native` type AAD application, will refer as `Client Application`. This application is for user login via `kubectl`. You'll need to add delegated permission to `Server Application`, please see [troubleshooting](#loginpageerror) section for detail.

You also need to delegate permission to the application as follows:

1. Go to Azure Portal, navigate to `Azure Active Directory` -> `App registrations`.
2. Select the `Client Application`, Navigate to `Settings` -> `Required permissions`
3. Choose `Add`, select the `Server Application`. You may need to enter the Server Application's name into the search field and search for it.
   In permissions tab, select `Delegated permissions` -> `Access {Server Application}`


## Deployment
Follow the [deployment steps](../kubernetes.md#deployment). In step #4, add the following under 'properties' section:
```json
"aadProfile": {
    "serverAppID": "",
    "clientAppID": "",
    "tenantID": ""
}
```<commit_msg>fix typo in aad doc (#2714)<commit_after># Microsoft Azure Container Service Engine - Kubernetes AAD integration Walkthrough

This is walkthrough is to help you get start with Azure Active Directory(AAD) integeration with an ACS-Engine Kubernetes cluster.

[OpenID Connect](http://openid.net/connect/) is a simple identity layer built on top of the OAuth 2.0 protocol, and it is supported by both AAD and Kubernetes. Here we're going to use OpenID Connect as the communication protocol.

Please also refer to [Azure Active Directory plugin for client authentication](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/client-go/plugin/pkg/client/auth/azure/README.md) in Kubernetes repo for more details about OpenID Connect and AAD support in upstream.

## Prerequisites
1. An Azure Active Directory tenant, will refer as `AAD Tenant`. You can use the tenant for your Azure subscription;
2. A `Web app / API` type AAD application, will refer as `Server Application`. This application represents the `apiserver`;  For groups to work properly, you'll need to edit the `Server Application` Manifest and set `groupMembershipClaims` to either `All` or `SecurityGroup`.
3. A `Native` type AAD application, will refer as `Client Application`. This application is for user login via `kubectl`. You'll need to add delegated permission to `Server Application`, please see [troubleshooting](#loginpageerror) section for detail.

You also need to delegate permission to the application as follows:

1. Go to Azure Portal, navigate to `Azure Active Directory` -> `App registrations`.
2. Select the `Client Application`, Navigate to `Settings` -> `Required permissions`
3. Choose `Add`, select the `Server Application`. You may need to enter the Server Application's name into the search field and search for it.
   In permissions tab, select `Delegated permissions` -> `Access {Server Application}`


## Deployment
Follow the [deployment steps](../kubernetes.md#deployment). In step #4, add the following under 'properties' section:
```json
"aadProfile": {
    "serverAppID": "",
    "clientAppID": "",
    "tenantID": ""
}
```
{'fraction_non_alphanumeric': 0.08664005635125617, 'fraction_numerical': 0.005635125616341864, 'mean_word_length': 4.867768595041323, 'pattern_counts': {'":': 8, '<': 3, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7353797', 'n_tokens_mistral': 1125, 'n_tokens_neox': 1076, 'n_words': 541}