Can I use auth token from one Azure AD app to allow access to another app?

Question

I have two applications registered in a Azure AD tenant.

1. Web API App
2. Frontend app The Frontend app is secured via SSO and can generate an ID token. I would like to secure access to the web API as well, ie, check if the user making the API call is signed into AD etc. So, I plan on making API calls from Frontend app to Web API with the token (in request Header) that is generated when user logs into the Frontend app. One the backend, I can use the jwt parser to decode the token and look up various attributes. The tokens have an attribute called "aud" which corresponds to application id or client id. When the backend decodes the token and sees that the token has an "aud" which is different from its own "aud" but the tenant id (tid) is the same, can it accept it as a valid logged in user? I am trying to understand what a good industry practice is when making calls from frontend to backend with respect to SSO tokens. Thanks!

Answer 1

Hello @Sandeep Chinni , you can use the same app registration for both front-end and web api applications. You will issue an ID token to authenticate against the former and an access token to get authorized by the latter. For this you need your app registration to expose a web API. Aud claim remains the same for both tokens. SSO applies only between clients like your front-end app, once logged in your frontend app you will acquired an access token for your API.

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.

Answer 2

The answer is no, per this doc from Microsoft:

https://learn.microsoft.com/en-us/azure/active-directory/develop/id-tokens The text that explains it: "aud" in a IdToken Identifies the intended recipient of the token. In id_tokens, the audience is your app's Application ID, assigned to your app in the Azure portal. This value should be validated. The token should be rejected if it fails to match your app's Application ID.