Service 2 Service authentication with Azure AD

Question

I'm trying to create service 2 service authentication with Azure AD. I read https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service, I would like to limit access to my Resource Web API, but I have following problems:

in the resource I can put any app which is my Azure AD Directory, so this doesn't work (or I don't know how to limit this)
JWT token only contains GUID of the Client Application, so I have to ask AD once more to find out which app is calling me, and if it has permission to call me (for example is it in proper AD group)

Am I doing something wrong?

My answer here might help: stackoverflow.com/a/47210307/1658906 — juunas
@juunas that's what I did but still I can request any resource from my AAD — Piotr Stapp

Evgeny Evgeny · Accepted Answer · 2019-10-16T21:23:57

Your resource should be under key "aud" in the token that you acquired. Please take a look to the token example in the article https://docs.microsoft.com/ru-ru/azure/active-directory/develop/v1-oauth2-client-creds-grant-flow:

{
"access_token":"eyJhbGciOiJSUzI1NiIsIng1dCI6IjdkRC1nZWNOZ1gxWmY3R0xrT3ZwT0IyZGNWQSIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJodHRwczovL3NlcnZpY2UuY29udG9zby5jb20vIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvN2ZlODE0NDctZGE1Ny00Mzg1LWJlY2ItNmRlNTdmMjE0NzdlLyIsImlhdCI6MTM4ODQ0ODI2NywibmJmIjoxMzg4NDQ4MjY3LCJleHAiOjEzODg0NTIxNjcsInZlciI6IjEuMCIsInRpZCI6IjdmZTgxNDQ3LWRhNTctNDM4NS1iZWNiLTZkZTU3ZjIxNDc3ZSIsIm9pZCI6ImE5OTE5MTYyLTkyMTctNDlkYS1hZTIyLWYxMTM3YzI1Y2RlYSIsInN1YiI6ImE5OTE5MTYyLTkyMTctNDlkYS1hZTIyLWYxMTM3YzI1Y2RlYSIsImlkcCI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzdmZTgxNDQ3LWRhNTctNDM4NS1iZWNiLTZkZTU3ZjIxNDc3ZS8iLCJhcHBpZCI6ImQxN2QxNWJjLWM1NzYtNDFlNS05MjdmLWRiNWYzMGRkNThmMSIsImFwcGlkYWNyIjoiMSJ9.aqtfJ7G37CpKV901Vm9sGiQhde0WMg6luYJR4wuNR2ffaQsVPPpKirM5rbc6o5CmW1OtmaAIdwDcL6i9ZT9ooIIicSRrjCYMYWHX08ip-tj-uWUihGztI02xKdWiycItpWiHxapQm0a8Ti1CWRjJghORC1B1-fah_yWx6Cjuf4QE8xJcu-ZHX0pVZNPX22PHYV5Km-vPTq2HtIqdboKyZy3Y4y3geOrRIFElZYoqjqSv5q9Jgtj5ERsNQIjefpyxW3EwPtFqMcDm4ebiAEpoEWRN4QYOMxnC9OUBeG9oLA0lTfmhgHLAtvJogJcYFzwngTsVo6HznsvPWy7UP3MINA",
"token_type":"Bearer",
"expires_in":"3599",
"expires_on":"1388452167",
"resource":"https://service.contoso.com/"
}

If you check it with jwt.io you will see details:

{
  "aud": "https://service.contoso.com/",
  "iss": "https://sts.windows.net/7fe81447-da57-4385-becb-6de57f21477e/",
  "iat": 1388448267,
  "nbf": 1388448267,
  "exp": 1388452167,
  "ver": "1.0",
  "tid": "7fe81447-da57-4385-becb-6de57f21477e",
  "oid": "a9919162-9217-49da-ae22-f1137c25cdea",
  "sub": "a9919162-9217-49da-ae22-f1137c25cdea",
  "idp": "https://sts.windows.net/7fe81447-da57-4385-becb-6de57f21477e/",
  "appid": "d17d15bc-c576-41e5-927f-db5f30dd58f1",
  "appidacr": "1"
}

To acquire Azure AD token you can use token generator

Service 2 Service authentication with Azure AD

1 Answers