authenticate webapi against azure AD without internet connection

Question

This may sound a silly question...

I want to authenticate an end user that connects to a webapi service against Azure AD. The Web Server (where the webapi service is hosted) is located in a zone without internet connection due to security reasons, behind a reverse proxy.

The client (end user) is at home with internet (of course) and connects to the webApi service through the reverse proxy.

Does all/any of the available authentication methods against AZURE AD require that the server that hosts the webapi service has Internet connection?

Thanks

Answer 1

You can do this! :) As long as there is internet between the client and the identity provider (AD), you can always obtain a token and send it to the API - the API does not need a live connection to authenticate, it just needs to validate the token supplied by the client in the call. The only tricky part is that today's OWIN middleware automates the acquisition of the token validation parameters by reading a discovery document hosted on Azure AD. That is clearly not an option in your case, but what you can do is to acquire that document out of band and use the info you find in there to initialize the middleware manually. Unfortunately we don't have samples that show how to do this, but let me see if I can get a snippet to post here.