How to protect APIs using the Microsoft identity platform

In this video, Matthijs Hoekstra explains how developers can use the Microsoft identity platform to implement authorization that protects APIs.


The basics of protecting an API 0:31
Using the Azure portal to setup protection of APIs - 3:42
Using and validating access tokens - 7:00
Enabling application permissions - 9:48
Demo: validating access tokens - 12:50
Why do you need custom validation behavior? - 19:06
Determining effective permissions in your code - 20:58
Example access tokens from different authentication scenarios - 25:55
APIs calling APIs: "on behalf of" flow - 29:26

[yassinesouabni]

Probably the best video about the subject I've ever watched

[martialtech]

Has anybody ACTUALLY managed to get this to work? I've been going in circles with crappy Microsoft documentation and lack of support for .NET 5.0 for days, all I want to do is validate a token: signature, audience, issuer and scopes. I don't get how this is so difficult.

I thought it would be as simple as having my appsettings file containing the tenant and client details, then adding Microsoft.Identity.Web middleware, but depending on how I add it in Startup it either doesn't validate the token at all or tells me to provide a ClientId, which I have. I dearly wish these things worked as easy as they always do in these demos.

[_ityadi]

I have a question for the OBO token flow. I have a middle tier application A which calls APIs of application B. I can generate encrypted tokens for A. For encryption A uses public/private key certificate. So when I want to generate the OBO token, should I be using the public certificate in the call? Or should it be a different one. Also does the OBO call need the token to be decrypted or would it work with encryption

[frankromeo]

Right around the 22:50 mark, he shows us a controller in his API. He has this User object from which he gets the oid and sub. Can anyone tell me what class that User object is? Also, what are all those URL strings? Where do we find them in our Azure app registration?

[vinodcd]

Nicely explained. Thanks for the video!!

[nolimitsREAL]

So I understand correctly the Access token that the API(including custom API) gets, it's verified with Azure AD if it's the correct one ? Or ? Thank you.

[devendrachaudhary]

Hello Sir,
I am able to do authentication and get access token with Angular application now when access token is passed in backend service that need to be validate in backend on java side. Right !
Please confirm.
Also what is the use of resourcesProtectionMap ?

[pauldubois]

Question: How is it secure that the issuer of a token also supplies the public key, albeit through their own interface? To me the only thing securing this is that the URL to lookup the public key is hardcoded in my API application. Thanks for any comments.

[gabrielpaiz]

How do you get keys for token validation in our app middleware?

[ChandraShekharaTN]

Thanks a lots! it was clear and nicely explained...

[camiloandresgomezm.]

Hi, i have an api with appRole created and a Daemon app without that permission assigned and i am able to get an access token for the api using daemon(clientCredentials). Why am i getting access token if the daemon app doesn't have the correct permissions assigned?

[sahilroyal]

Is on behalf of flow supported with Azure B2C? We desperately need this feature.

[jinbaoxin]

Hi, @15:00, I do not see "role" in the token, only "scp" impersonation" was shown, is this right?

[srivishalsangepu]

Hi sir,
Is there any other way of Validating api without registering webapi in azure

[chairmakerPete]

This is great, but boy, do I hate security. It's totally beyond me, but hopefully will get simpler in future iterations. Good job though - all going the right way.

[mhalton]

Don't reguister. Register instead.