Search code examples
azureauthenticationoauth-2.0azure-active-directory

Consent is not showing in Microsoft Identity auth with api://{BackendClientId}/.default scope

I am trying to configure WASM Blazor client with WebAPI server to use Microsoft identity authentication. I dug deep, followed many advice from StackOverflow (thanks for them) and these are the steps I have used for configuration:

Configured a pair of app registrations in Azure:

enter image description here

Configured delegated permissions in the backend registration:

enter image description here

Configured and exposed API scope:

enter image description here

Configured knownClientApplications to point to frontend registration:

enter image description here

Configured permissions in the frontend registration:

enter image description here

I am using Blazor WASM as the client - The configuration of the authentication client is as follows:

enter image description here

When I run the authentication, the proper token is issued (I have checked the content). The problem is, that the consent screen (with backend consents) is not presented to the user. Consents are not there (OBO flow fails with the backend not having consent) - I have also checked in the portal - no consents are there.

Does anyhow have any idea, why the consent screen is not showing? Is there something more I have to do?

Thank you very much.

  1. I have tried different scopes - ".default" - proper consent screen is presented, the token is issued for incorrect scopes (MS Graph ones)
  2. The auth itself is configured properly - when the consent is there, everything works correctly.
Solution

  • Note that: The on behalf of (OBO) flow defines the situation where a web API calls another web API using an identity other than its own.

    Based on your configuration, the frontend application calls the backend Api and using the access token generated it calls the Microsoft Graph API using OBO flow.

    I created an Azure AD Backend Application and added API permissions:

    enter image description here

    Now, I created Azure AD Frontend Application and added permissions:

    enter image description here

    To authorize users, I used below endpoint:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=api://BackendAppID/.default
&state=12345

    Frontend consent:

    enter image description here

    Backend Consent:

    enter image description here

    Auth-code got generated successfully:

    enter image description here

    By using the Frontend Application, I tried to call backend web Api via Postman:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:FrontendAppID
scope:api://BackendAppID/.default
code:code
redirect_uri:https://jwt.ms
grant_type:authorization_code
client_secret:ClientSecret

    enter image description here

    When I decoded the token aud is web Api:

    enter image description here

    Now by passing the above generated access token, I called Microsoft Graph API using OBO flow:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
scope:https://graph.microsoft.com/.default
grant_type:urn:ietf:params:oauth:grant-type:jwt-bearer
assertion:access_token
requested_token_use:on_behalf_of

    enter image description here

    When I decoded the token, aud is Microsoft Graph:

    enter image description here

    By using the above token, you can call Microsoft Graph API.

    • If you want to call only the web Api (api://ClientID/.default) then you can implement Authorization code flow instead of OBO flow.
    • Refer this blog to know more about the consents by John Patrick Dandison.
    • The Backend API doesn't ask consent for API as the web Api is not added in the API permissions.

    References:

    Microsoft identity platform and OAuth2.0 On-Behalf-Of flow - Microsoft Entra

    When to use OBO with Azure - Stack Overflow by Junnas