Search code examples
azure-active-directoryasp.net-core-mvc.net-6.0microsoft-identity-platform

why Microsoft Identity platform ignore the client secret created inside the related azure Active Directory App?

I created a new ASP.NET Core 6.0 MVC web application, and I define it to use Azure AD for authentication (Microsoft Identity Platform ), as follows:

enter image description here

enter image description here

Then I was asked to create an owned application, so I created one named "ad" as follows:

enter image description here

enter image description here

Inside my application's appsetting.json I have these settings:

{
    "AzureAd": {
        "Instance": "https://login.microsoftonline.com/",
        "Domain": "*****",
        "TenantId": "***",
        "ClientId": "***",
        "CallbackPath": "/signin-oidc"
    },
    ....
}

It seems Visual Studio did all the work for us.

Then i went to the generated Azure Active Directory App >> and created a client secret for it as follow:-

enter image description here

then i thought that since i am not passing the newly generated Client secret from my asp.net core mvc users will not be able to login to the asp.net core mvc web application,, but what is happening is that they can login without any issue.. so my question is why Microsoft Identity platform ignore the client secret created inside the related azure Active Directory App?

Thanks

Solution

  • Client secret is only used with authentication flows that require it.

    I think the VS generated solution will use hybrid flow by default, which results in the ID token being returned to the app in the authentication response. The client secret is not involved in this flow.

    Now if your application needed to get access tokens to other APIs, you would need a client secret/certificate. Or if you change to use for example authorization code flow.