How to authenticate .net core web APIs using Azure AD by using office365

Question

I have .net core 3.1 web api application deployed to Azure App Service. I want to set the authentication for APIs using Azure Active Directory with users logging through their office 365 account.

The architecture is like - I have my office 365 account ready with me. I request for a token to Azure AD. With the JWT, I get from azure AD, I should be able to call all the API endpoints in my web api application deployed in App Service.

Can you please explain what all configuration needs to be done in azure portal and code changes in startup.cs file.

Answer 1

Please refer to Quickstart: Protect an ASP.NET Core web API with Microsoft identity platform.

The Microsoft.AspNetCore.Authentication middleware uses a Startup class that's executed when the hosting process initializes. In its ConfigureServices method, the AddMicrosoftIdentityWebApi extension method provided by Microsoft.Identity.Web is called.

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
               .AddMicrosoftIdentityWebApi(Configuration, "AzureAd");
}

You can protect a controller or controller methods using the [Authorize] attribute.

namespace webapi.Controllers
{
    [Authorize]
    [ApiController]
    [Route("[controller]")]
    public class WeatherForecastController : ControllerBase

Deploying to Azure app service doesn't require more different configurations. Just modify the real API endpoint while calling it.

You can see more details from Scenario: Protected web API.

If you want to call the API from a web app, you could refer to Scenario: A web app that calls web APIs.

Remember that you need to register two Azure AD apps, one is for client app (front) and the other is for API app (backend). In the API app, you need to expose API. Then you need to configure the client app. Add the permission (scope) which is exposed by API app to the client app. These are all mentioned in the links above.

UPDATE:

I assume that you have created the two Azure AD apps on Azure portal and have configured the permissions between them. (if you haven't, please refer to Register the service app (TodoListAPI) and Register the client app (TodoListSPA))

Then you could test your API in Postman like this:

In the second screenshot:

Auth URL: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize

Access Token URL: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Client id and client secret are from the Azure AD app which represents the client app (TodoListSPA).

Scope is the app id uri which is exposed by the Azure AD app which represents the service app (TodoListAPI).