Web API authentication using OAuth 2.0 token and Azure Active Directory (Without Authentication Server)

Question

Is there a way to authenticate the Microsoft or google OAuth token in active directory without using an authentication server?

Here is the scenario:

A client app gets an Microsoft access_token from some external service.
Client app will make a call to some secured web API and pass that access_token along with the request header
If the access_token passed by client is valid then API will provide response to the client.

Is there a way to validate that access_token on API side?

My normal understanding about OAuth 2.0 is there needs to be an authentication server to which both the client and API would talk to as shown in the figure below:

But if the token is provided by some external service, Can we use it to validate our web API. Are there any ways to implement such authentication?

In the diagram you are showing, the External Authorization Server is owned and run by Microsoft. You want to cut that out of the picture? Is there confusion where you think you need to own and run the auth server? — Shawn Tabrizi
– Shawn Tabrizi, Commented Mar 1, 2017 at 5:01
Hi @ShawnTabrizi , My requirement is not what the above image shows. I wanted to know, if I pass a Microsoft OAuth 2.0 token with a request to call a web API, is there a way to validate that token regardless of the source of creation of that token without using Authentication Service as shown in the diagram? — Diwas
– Diwas, Commented Mar 1, 2017 at 5:07
When you validate a token, you simply need to check if the token is signed by Microsoft, by looking at the public key that MS exposes, and comparing it to the signature on the token. As long as you can query for the signing key, you should be able to authenticate the token anywhere... maybe I misunderstand. — Shawn Tabrizi
– Shawn Tabrizi, Commented Mar 1, 2017 at 5:10
To add on to what @ShawnTabrizi said: You can check the signature of the JWT token. It is signed using one of AAD¨s private keys. You can download the public keys which you need for signature verification. Note that the public keys change sometimes, and your application would need to periodically download new ones. — RasmusW
– RasmusW, Commented Mar 1, 2017 at 7:22

Shawn Tabrizi · Accepted Answer · 2017-03-01 07:42:14Z

1

You can learn more about AAD Signing Keys and handling Key Rollover using this page: Signing key rollover in Azure Active Directory

Validation of the token, once you have the signing key, can be done using existing libraries like OWIN. You can also try following instructions like this (although it seems the document isn't 100% complete yet): Manually validating a JWT access token in a web API

This library is also available, but I think OWIN is supposed to have replaced it in general.

Also check out this blog post, which has a pretty great deep dive into token validation.

answered Mar 1, 2017 at 7:42

Shawn Tabrizi

12.5k2 gold badges43 silver badges73 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Web API authentication using OAuth 2.0 token and Azure Active Directory (Without Authentication Server)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related