Authenticating Xamarin Forms app with Azure Active Directory for accessing a protected Azure AAD Web API app

0
votes

Not sure how to go about doing this; I'm not looking for B2C, I don't want my users to sign in. I just want my Xamarin app to be able to access an Azure AAD protected API. In other words, I want to authenticate the app itself with the Azure Active Directory, to access an Azure AAD protected API. From what I've found on the internets, service principal to service principal auth is discouraged when using mobile apps and I've not really found a way to do it service to service anyhow. Any suggestions on how to properly do this? Links with tutorials would be great.

Thanks!

1
authenticationxamarinazure-active-directoryservice-principal
The problem with that is that you would need to send some credentials from the native app to authenticate it against Azure AD. Native apps run in an environment which is outside the control of an app's developer. I doubt this is possible to do securely. – juunas

1 Answers

1
votes

Azure does provide the ability to generate a client ID which you could have sent from your application and checked. Microsoft talk about this in this article. You will want to be careful with how you store this ID in your app as if someone were to steal this they would be able to access your API. Along with that you'd also want to make sure that your connection between your app and server is secured with a pinned SSL certificate so it cannot be man-in-the-middle'd.

Another interesting approach is software attestation where some service checks various aspects of your app to ensure that it is your app. Full disclosure, I work for a company which does this. See Approov. We take a fingerprint of your app and our SAAS checks that this matches at run time. We then issue a token which your app can use to prove that it is the real app.