How to use MSI instead of Service Principal to call Authenticate web api deployed on Azure

Question

Currently I am new to concept MSI with API. I have an Azure App Service consist of Web Job and Authenticated Web API deployed. Also I do have Azure AD Application used for authentication. But I am using AuthenticationContext and ClientCredentical to acquire Token which is further used in Authentication Header value. Now I have to remove ClientCredentical and add MSI to get authentication token or to authenticate the web api. Here I add some sample code I am using.

var authContext = new AuthenticationContext(authority);
var clientCred = new ClientCredentical(clientID, clientKey);
var token = authContext.AcquireTokenAsync(clientId, clientCred).Result.Token;
httpClient.DefaultRequestHeaders.Autheorization = new AuthenticationHeaderValue('Bearer',token);

I had been through some of the offical documemts but couldn't get it clearly. I tried using DefaultAzureCredential as well.

new DefaultAzureCredntial().GetTokenAsync(scope).Result.Token I have to implement some solution which could work locally as well as in deployed version also. DefaultAzureCredential Changes the access method as per environment but still that is also not working for visual studio.

You'll need to post the error that you're getting. It would be good for you to deserialize the auth token that you're sending to check the resource and user to ensure it's correct for the endpoint. — Matt Small

udayxhegde udayxhegde · Accepted Answer · 2021-08-05T15:50:29

You need to use the Azure Identity SDK if you want to get tokens for ManagedIdentities. https://docs.microsoft.com/en-us/dotnet/api/azure.identity?view=azure-dotnet

DefaultIdentityCredential is a good option if you want to test this both in Azure as well as your local environment. If you want more control over this, you can use ChainedTokenCredential with just the credential types you want to be tried. (in your case, managed identity credential, visualstudiocode credential, azure cli credential). For a very rudimentary example in Node, see https://github.com/udayxhegde/keyvault_managedid_node

How to use MSI instead of Service Principal to call Authenticate web api deployed on Azure

1 Answers