dotnet core 2 API和守护程序应用程序中的Azure AD身份验证

Question

I'm struggling to determine the best route to authenticate using Azure Active Directory for my dotnet core web API.

Here is the situation:

• An application created in Azure Active Directory that the Web API authenticates users. It has multiple application roles associated with it.
• A daemon application that needs to authenticate to the Web API.

What is the best solution to solve the authentication situation? It's difficult to find clear documentation on how to actually solve this.

Thank you for your advice and help!

Answer 1

Your daemon app will need to use application permissions (app roles with member type = Application) to call the API. You can see how to define those here: https://joonasw.net/view/defining-permissions-and-roles-in-aad .

For example, this is how one looks like in the manifest:

{
  "appRoles": [
  {
    "allowedMemberTypes": [
      "Application"
    ],
    "displayName": "Read all todo items",
    "id": "f8d39977-e31e-460b-b92c-9bef51d14f98",
    "isEnabled": true,
    "description": "Allow the application to read all todo items as itself.",
    "value": "Todo.Read.All"
  }
  ]
}

Then you assign the app permission to your daemon app.

After that it's a simple matter of authenticating with client credentials from the daemon app. With ADAL.NET for example, you would acquire a token with ClientCredential + the resource URI of the API. You can find the URI from your API's app registration (Properties blade, App ID URI).

You can then attach the resulting access token to HTTP requests and the API can find from the appid claim who the calling app is, and from the roles claim what app permissions they have.