Can I use Access Tokens and Identity Tokens in my ASP.NET Core 2.0 API?

Question

I am working on an ASP.NET Core 2.0 API. Currently this API supports a Service to Service workflow where the client console application obtains an access token from Azure AD using their console application's Azure AD app registration AppId/AppKey values.

To support this, my API uses...

        // Add Azure AD OAUTH2.0 Authentication Services
        services.AddAuthentication(sharedOptions =>
        {
            sharedOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddAzureAdBearer(options => Configuration.Bind("AzureAd", options));

in Startup.cs ConfigureServices method and...

        app.UseAuthentication();

in the Startup.cs Configure method. And finally the ...

[Authorize]

attribute along with the...

using Microsoft.AspNetCore.Authorization;

using statement in my controllers.

This is all working fine right now.

However, I now have a need to allow an admin web app to access my API. This admin web app will use Azure AD to authenticate the user login and obtain an Identity Token. I want my API to also be able to accept this Identity Token to;

Allow access to the API, and
Allow my API to identify the user and make decisions in the API based upon the user identity's claims.

Can ASP.NET Core 2.0 support both access token and identity token without breaking what I currently have working with the service to service workflow?

Gary Archer · Accepted Answer · 2018-02-12 15:48:03Z

1

That should work fine - your above breakdown needs some minor tweaks though:

THE CONSOLE APP Gets a simple access token based on an API key - the access token is NOT user specific and represents the application identity.

THE ADMIN WEB APP Users login and get an id_token AND an access_token. The id_token is just used by the web app as proof of authentication and never sent anywhere. The access_token is user specific and can be used to call the API and get personalized data.

THE API The job of the API is to receive access tokens and authorize based on claims from the token. For the console app the claims will only contain the application identity via a 'client id' claim. For the web app you will also be able to identify the user - most commonly via a 'sub' claim (there may be other user claims such as email).

answered Feb 12, 2018 at 15:48

Gary Archer

30.2k2 gold badges19 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Can I use Access Tokens and Identity Tokens in my ASP.NET Core 2.0 API?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related