如何使用不记名令牌授权一个 Azure Active Directory 应用程序访问不同的 AAD 应用程序服务 Web API？

Question

I've been searching for a couple days, and I can't seem to find a straightforward guide on how to set up Authorization (AuthZ) between an AAD App and my AAD Web API set up in App Service. I've tried things like this official guide , but I can't seem to get calls with a Bearer token from the client app to work.

Has anyone done this successfully? Is there a step by step guide out there that could help?

Please let me know if there are any questions!

Answer 1

To implement your requirements, you need to expose an api in your AAD Web API first.

Then go to your AAD App which used to request the token, add the permission to it.

Click "Grant admin consent for *" button.

After that, we can request the access token successfully (below I provide a sample use password flow for your reference)

In your Web API app, you need to parse the access token and get the scope permission from the access token. And then determine whether the request has permission.