Authenticate and Show an Azure AD secured Web App View from an Third Party App

Question

Background I have a MVC 5 Web App and hosted in Azure App Service as Web App and secured with Azure AD ; Anybody with valid AD credentials can authenticate themselves and view all HTML Content in the Web App;

Objective I need to give just one of these MVC-View to outside individuals to view. For such we have already created an User in Azure AD which we will be sharing the details with the outside world. Hence, the thrid party will need to write some code to authenticate to our Azure AD and view this HTML content non interactively (Which means without allowing the third party app to prompt to enter user credentials from Azure AD).

What I have thought about

Assume that I am the third Party, I am going to authenticate to Azure AD from a Console/WinForms/HTML Page and get myself a token; Then I will be using the token, to open up a Browser to view this page.

Challenges I see Session Expiration Session Validity

Putting everything intto a Picture

Please show me some guidence to accomplish the objective.

Answer 1

Hence, the thrid party will need to write some code to authenticate to our Azure AD and view this HTML content non interactively (Which means without allowing the third party app to prompt to enter user credentials from Azure AD).

Per my understanding, you could leverage the OAuth 2.0 Client Credentials Grant Flow by using the client_id and client_secret .

Also, you could use OAuth 2 Resource Owner Password Credentials grant . Note: The resource owner password grant doesn't provide consent and doesn't support MFA either. Detailed tutorial, you could follow here .

Based on the authentication implementation part in your Web App, you could follow the approaches below to implement your scenario:

• For using App Service Authentication / Authorization

  You do not need to modify any code in your Web App project.

• For using Microsoft.Owin.Security.OpenIdConnect middleware

  You could use Microsoft.Owin.Security.ActiveDirectory package in your Web App for supporting AAD bearer token authentication, and this middleware need to be configured before the other authentication middlewares as follows:

app.UseWindowsAzureActiveDirectoryBearerAuthentication(
        new WindowsAzureActiveDirectoryBearerAuthenticationOptions
        {
            Audience = "{the-AAD-clientId}",
            Tenant = "{TenantId}"
        });

//app.UseCookieAuthentication
//app.UseOpenIdConnectAuthentication

For the client (the third Party), they could leverage the above two flows (Client Credentials Grant Flow ,Resource Owner Password Credentials Grant Flow) to retrieve the access token without user interaction. Then they could access the specific view page by using the token as follows:

Get https://{your-app-name}.azurewebsites.net/home/index
Header Authorization:Bearer {the-AAD-accessToken-or-IdToken}

For retrieving the token, you could follow this tutorial for using User Password Credential flow. For Client Credential, you could just construct the ClientCredential instance when invoking AcquireTokenAsync for getting the token.

Additionally, you could create a new AAD application for this scenario or just use the AAD application for your current Web App. Moreover, there may exists risks when exposing the username & password or clientId & ClientSecret to the third Party, I would recommend you expose a new endpoint for generating the token in your Web App backend and return the token to the third party for security consideration.