Daemon app that calls web APIs - call a web API from the app
.NET daemon apps can call a web API. .NET daemon apps can also call several pre-approved web APIs.
Calling a web API from a daemon application
Here's how to use the token to call an API:
AuthenticationResult properties in MSAL.NET
The methods to acquire tokens return
AuthenticationResult. For async methods,
AccessTokenfor the web API to access resources. This parameter is a string, usually a Base-64-encoded JWT. The client should never look inside the access token. The format isn't guaranteed to remain stable, and it can be encrypted for the resource. Writing code that depends on access token content on the client is one of the biggest sources of errors and client logic breaks. For more information, see Access tokens.
IdTokenfor the user. This parameter is an encoded JWT. For more information, see ID tokens.
ExpiresOntells the date and time when the token expires.
TenantIdcontains the tenant in which the user was found. For guest users in Azure Active Directory (Azure AD) B2B scenarios, the tenant ID is the guest tenant, not the unique tenant. When the token is delivered for a user,
AuthenticationResultalso contains information about this user. For confidential client flows where tokens are requested with no user for the application, this user information is null.
Scopesfor which the token was issued.
- The unique ID for the user.
MSAL.NET defines the notion of an account through the
IAccount interface. This breaking change provides the right semantics. The same user can have several accounts, in different Azure AD directories. Also, MSAL.NET provides better information in the case of guest scenarios because home account information is provided.
The following diagram shows the structure of the
AccountId class identifies an account in a specific tenant with the properties shown in the following table.
||A string representation for a GUID, which is the ID of the tenant where the account resides.|
||A string representation for a GUID, which is the ID of the user who owns the account in the tenant.|
||Unique identifier for the account.
IAccount interface represents information about a single account. The same user can be present in different tenants, which means that a user can have multiple accounts. Its members are shown in the following table.
||A string that contains the displayable value in UserPrincipalName (UPN) format, for example, email@example.com. This string can be null, unlike HomeAccountId and HomeAccountId.Identifier, which won't be null. This property replaces the
||A string that contains the identity provider for this account, for example,
||The account ID of the home account for the user. This property uniquely identifies the user across Azure AD tenants.|
Use the token to call a protected API
AuthenticationResult is returned by MSAL in
result, add it to the HTTP authorization header before you make the call to access the protected web API.
httpClient = new HttpClient(); httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken); // Call the web API. HttpResponseMessage response = await _httpClient.GetAsync(apiUri); ... }
Calling several APIs
For daemon apps, the web APIs that you call need to be pre-approved. There's no incremental consent with daemon apps. (There's no user interaction.) The tenant admin needs to provide consent in advance for the application and all the API permissions. If you want to call several APIs, acquire a token for each resource, each time calling
AcquireTokenForClient. MSAL will use the application token cache to avoid unnecessary service calls.
Move on to the next article in this scenario, Move to production.
Submit and view feedback for