Login to my API using an Azure AD JWT (id_token)

Question

My client side application is using Azure ad for authentication, but to authorize the user (check if the user is allowed to use my application) I need to go through my REST API. Is it ok, security wise to create an endpoint in my REST API where I can post a JWT and validate it, and then give back an access_token that is used for further calls to the API? I'm the developer of both the client application and the rest api, but only the client application is registered in Azure AD

Does this look ok? Or is there a better way of doing it?

Please add this information into your question: `1.` are you an owner of both `My Application` and `REST API`? `2.` are both applications registered in AzureAD? — mtkachenko, Apr 13 '20 at 17:55
Yes, I'm the developer of both the client application and the rest api. Only the client application is registered in Azure AD. — rgullhaug, Apr 13 '20 at 18:04
Are these applications just parts of the same application or you want to keep them absolutely separate? — mtkachenko, Apr 13 '20 at 18:38
I would like to keep them seperate, as there are many other users of the REST api as well (mobile applications, web shops, portals ++). — rgullhaug, Apr 13 '20 at 19:24
How do all these applications (mobile apps, web shops) acquire tokens to consume REST API currently? Do you consider an option to register REST API in Azure AD? — mtkachenko, Apr 13 '20 at 19:33
The rest api provides oauth 2.0 authentication, so the user can login using oauth and retrieve an access_token. The login is then checking against a username/password in our system and not Azure AD. I still need to provide that functionality. It seems like an easy solution to just accept an Azure AD JWT, validate it and generate an access_token that can be used for all later calls to the api, but maybe it is not a good idea? Can I still offer my own authentication in adittion to Azure AD if I register both the client applicaiton and rest api in AD? — rgullhaug, Apr 13 '20 at 19:42

mtkachenko · Answer 1 · 2020-04-14T16:47:26.663

As I understand REST API is an identity provider (IDP) and authorization provider (AuthZ provider) for itself: it authenticates users, issues tokens and hosts api protected with those tokens.

I would say that you want to consume REST API using access_tokens issued by REST API AuthZ provider and by AzureAD AuthZ provider. You can achieve it like this:

register both REST API and MyApplication in AzureAD
add required scopes into REST API app registered in AzureAD (scopes should be the same as in REST API itself)
configure AzureAD middleware in MyApplication to ask for both id_token and authorization code (read https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent , especially part about offline_access, and this sample https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/2-WebApp-graph-user/2-2-TokenCache and my simplified sample https://github.com/MaximTkachenko/microservices-communication/blob/master/src/Portal/Startup.cs)
then with this authorization code you can get access_token and refresh_token from AzureAD at the moment when user is logged in MyApplication (more about authorization code https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow )
configure two JWT authorization schemes in REST API for both types of tokens (REST API AuthZ provider and AzureAD AuthZ provider, like this Use multiple JWT Bearer Authentication )
finally you will be able to consume REST API with access_tokens issued by multiple AuthZ providers.

score 0 · Answer 2 · answered Apr 17 '20 at 09:06

In your case, you could use the On-Behalf-Of flow, register the client app, middle-tier web API and downstream web API in Azure AD.

Assume that the user has been authenticated on an application using the OAuth 2.0 authorization code grant flow or another login flow. At this point, the application has an access token for API A (token A) with the user’s claims and consent to access the middle-tier web API (API A). Now, API A needs to make an authenticated request to the downstream web API (API B).

For more details, see - Microsoft identity platform and OAuth 2.0 On-Behalf-Of flow.

Login to my API using an Azure AD JWT (id_token)

2 Answers2