AAD Access token per API

Question

Current Behavior -

From our service-A, we are calling service-B. We are currently using client_credentials as a way to generate access_token for service-B(as shown below).

Service-B is validating token generated at their end and everything is working fine.

Expected behavior -

So, now we are looking per API based whitelisting. So, in above case service-A will be able to call all API of service-B and we want to stop that. So, looking for help to expand our current implementation to support same without changing resource (As resource means service-2 in our team).

Thus, expected behavior will be service-A can call API-1 of service-B, but not API-2.

score 1 · Answer 1 · answered May 12 '23 at 08:35

In your screenshot, you are using Oauth 1.0 which you need to set resource and this makes you can't set API scope inside the authorization, you need to use OAuth 2.0. By the way, client credential flow will make the scope set to xxx/.default, this flow won't contain scope name as well, so you can't use client credential flow as well.

I have a sample here. Firstly, here's the settings in Service-B. I integrated Azure AD into my web api project.

builder.Services.AddMicrosoftIdentityWebApiAuthentication(builder.Configuration);

"AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "ClientId": "client_id",
    "ClientSecret": "client_secret",
    "Domain": "tenant_id",
    "TenantId": "tenant_id"
  },

Then in my web api:

[ApiController]
[Route("[controller]")]
[Authorize]
public class WeatherForecastController : ControllerBase
{

    public WeatherForecastController(){}

    [RequiredScope("Tiny.Read1")]
    [HttpGet]
    public async Task<string> GetAsync()
    {
        return "world";
    }

    [HttpGet("greet")]
    [RequiredScope("Tiny.Read")]
    public string greet() {
        return "hello";
    }
}

I used auth code flow to generate an access token which containing the scope I defined:

Then here's my test result:

About how to expose custom API scope, you can follow this official document. This answer showed how to generate access token by auth code flow. But if you are trying to generate access token in Service-A to call Service-B, you may use on_behalf_flow, this answer contained code snippet with Microsoft identity and use _tokenAcquisition to generate access token, and this answer is for a client call AAD protected API.

If you insist on using client credential flow, then you can only try to authorize the `roles` claim instead of `scp` claim. Then you can have a look at [this section](https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-app-registration#expose-application-permissions-app-roles) to expose roles instead of API scope. And you have to use `[Authorize(Roles = "roles")]` instead of `RequiredScope`. — Tiny Wang, May 12 '23 at 09:09
You can see [this document](https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-verification-scope-app-roles?tabs=aspnetcore) for adjusting code in Service_B. — Tiny Wang, May 12 '23 at 09:09

score 0 · Answer 2 · answered May 12 '23 at 08:42

Note that: In an Azure AD Application, App roles can be defined which represents a service, app or API.

I created two Azure AD Applications ServiceA and ServiceB.

In ServiceB application, I created sample App roles like below:

enter image description here

In ServiceA application, I added required permissions like below:

enter image description here

Now, I generated access token by using below parameters:

GET https://login.microsoftonline.com/TenantID/oauth2/token

client_id:ClientID
client_secret:ClientSecret
resource:api://ServiceBClientID
grant_type:client_credentials

enter image description here

When I decoded the token in the roles claim only the api.read and api2.read is present not api3.read.

enter image description here

This is the possible workaround which can be implemented to achieve your scenario. The App roles can be assigned to Users, groups or Service Principals.

Reference:

Add app roles and get them from a token - Microsoft Entra

AAD Access token per API

2 Answers2