A user impersonating as an Azure app registration without client secret

Question

I have a C# application that needs to impersonate as an Azure app registration to access some resources.
I have set up federated credential to allow a managed identity to impersonate as the app. Therefore, I can use the code like below on a VM to impersonate as an app registration using managed identity credential:

var clientAssertionCredential = new ClientAssertionCredential(
            tenantId, clientId, new ManagedIdentityClientAssertion(miClientId).GetSignedAssertion);

However, during development, I want to run the code locally.
Although I can create a client secret, store it in a KeyVault, and use it to authenticate as the app, I don't want to use this approach for security concerns.
Is it possible to impersonate as the app using a credential for a user account such as AzureCliCredential or VisualStudioCredential?

Answer 1

Although I can create a client secret, store it in KeyVault, and use it to authenticate as the app, I don't want to use this approach for security concerns. Is it possible to impersonate as the app using a credential for a user account, such as AzureCliCredential or VisualStudioCredential?

Based on scenario, You can use the ROPC flow to authenticate with a user account and with an app to call an API.

Note:

• Microsoft does not recommend this ROPC flow for such scenarios and security.
• Accounts with MFA enabled and personal Microsoft accounts are not supported in this method.
• You have to use other interactive flows, like the Authorization Code Flow, which directs the user to the browser for login.

Request:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id: ClientID
scope: https://graph.microsoft.com/.default offline_access openid
username: User@XXX.onmicrosoft.com
password: UserPassword
grant_type: password
client_secret: Clientsecret

From the above, you will get the token, and using the token, you can call the Microsoft Graph API.

Request:

GET https://graph.microsoft.com/v1.0/me

Authorization: 
Bearer <token>

To avoid passing the client_secret, enable public client flows as shown below.

Portal:

Reference:

Microsoft identity platform and OAuth 2.0 Resource Owner Password Credentials - Microsoft identity platform | Microsoft Learn