API Authentication with OAuth using Azure AD

Summary

In this Azure Power Lunch session, Senior Cloud Solutions Architect Molex Sony explores API authentication using OAuth with Azure AD. The presentation delves into key OAuth 2.0 concepts, OpenID Connect, JWT tokens, and Azure AD's role as an identity provider. It demonstrates the client credential flow for non-interactive applications and guides through app registration, role assignment, and token acquisition. The session also covers token validation in APIs and highlights the importance of admin consent for permissions, concluding with a practical demo on securing a file upload API.

Takeaways

• 😀 The session is about API authentication with OAuth using Azure AD, presented by a senior cloud solutions architect at Microsoft.
• 🔐 OAuth 2.0 is an industry standard protocol for authorization that allows users to grant limited access to their protected resources.
• 📚 OpenID Connect (OIDC) is an authentication and authorization layer built on top of OAuth 2, and Azure Active Directory supports OIDC.
• 🔑 JSON Web Tokens (JWT) are the standard for exchanging user authentication and authorization information, used as bearer tokens to access protected resources.
• 👤 Azure Active Directory acts as an identity provider, controlling and managing user identities, permissions, and access to resources.
• 📝 The concept of app registration in Azure AD is essential for providing authentication and authorization services for users.
• 🔄 OAuth and OIDC support various flows, with the client credential flow being useful for non-interactive applications that cannot enter credentials.
• 🤖 Azure Ready Admin Consent is required for permissions and roles in Azure AD applications, which can be granted by a global admin or an application owner.
• 📈 The authentication flow involves a token endpoint for obtaining an OAuth bearer token and a discovery endpoint for token validation.
• 📑 The presenter demonstrates a use case for securing a file upload API with OAuth and Azure AD, allowing control over individual vendors' access and the ability to rotate credentials.
• 🛠️ The demo includes registering AAD applications, generating client secrets, granting consent, requesting a token with Postman, and validating the token with sample code.

Q & A

What is the main topic of the session presented by Molex Sony?

The main topic of the session is API authentication with OAuth using Azure AD.

What does OAuth 2.0 protocol stand for, and what is its purpose?

OAuth 2.0 is an industry standard protocol for authorization. Its purpose is to allow users to grant limited access to their protected resources and is designed to work specifically with HTTP.

What is OpenID Connect (OIDC), and how is it related to OAuth 2.0?

OpenID Connect is an authentication and authorization layer built on top of OAuth 2.0. It uses Azure Active Directory to allow the OIDC protocol on top of OAuth.

What are JSON Web Tokens (JWT), and how are they used in the context of OAuth and Azure AD?

JSON Web Tokens are an industry standard for exchanging information about users on authentication and authorization. They are lightweight security tokens used to access protected resources, and in the context of OAuth and Azure AD, they are used to prove access rights to a server.

What is the role of Azure Active Directory (AD) in OAuth security?

Azure Active Directory acts as an identity provider in OAuth security. It ensures that users' identities, permissions, and access to resources are controlled and managed by Azure AD.

What is the client credential flow in OAuth 2.0 and OpenID Connect?

The client credential flow is used in scenarios where a client application, which is non-interactive, needs to access a resource without impersonating a user. It permits a web service to use its own credentials to obtain a token.

What is Azure AD App Registration, and why is it necessary?

Azure AD App Registration is a process where an application owner registers an application in Azure Active Directory to provide authentication and authorization services for users. It is necessary to interact with permissions and roles within the application.

What is the significance of the 'admin consent' in the context of Azure AD applications?

Admin consent is required for the API permissions to be used within an Azure AD application. It must be granted by either a global admin for the entire tenant or by an application owner for a specific application scope.

Can you explain the authentication flow using Azure AD for a protected API?

The authentication flow involves the client requesting an OAuth bearer token from the token endpoint using the client ID and secret. If validated, the token endpoint returns a token. The client then calls the protected API with an access token in the authorization header. The API validates the token and, if valid, returns the requested data.

How can an API validate the roles and permissions of a client using a JWT token?

An API can validate the roles and permissions by inspecting the authorization header, extracting the JWT token, and using a JWT security token handler to validate the token's claims, including the roles claim, against the expected values for the application.

What is the purpose of Microsoft Graph Explorer, and how can it be used in the context of granting permissions?

Microsoft Graph Explorer provides a way to interact with the Microsoft Graph API. In the context of granting permissions, it can be used to perform app role assignments, which automatically provides consent for the application scope, without requiring global admin intervention.