CODEWITHSUNDEEP
azureasp.net-coreazure-active-directoryazure-web-app-serviceasp.net-core-webapi
ameya
ameya

Reputation: 1668

Web API that calls Azure AD Microsoft APIs with user Impersonation

I have asp.net core 3.1 Web API project that needs to call Microsoft Azure API ( for e.g. Storage API on behalf of other user (Impersonation).

I believe this can be achieved by Azure App Registration and then creating Impersonation for user by acquiring token interactive first and then silently with Microsoft.Identity.Client library.

  1. But how do I do this from my API since I don't want to use any interactive authentication from within API.
  2. What is the ASP.NET Core 3.0 friendly version for Web API authentication for Microsoft.Identity.Client .NET library

Any examples would be helpful...

Upvotes: 1

Views: 1677

Answers (2)

Nan Yu
Nan Yu

Reputation: 27588

You can implement getting tokens on behalf of a user (Service to service calls) use on-behalf-of flow (OBO) with MSAL , you can check the document & code snippets from document here using MSAL 2.3 + .

Upvotes: 1

Tony Ju
Tony Ju

Reputation: 15639

If your web api is protected by Azure AD, you can use On behalf of flow. Here is the scenario regarding a web API that calls web APIs.

If your web api is not protected by Azure AD and you want to use user token, you must use interactive authentication or ropc flow to call Azure API.

Reference:

Web API calling Microsoft Graph.

Upvotes: 0

Related Questions