Examkin

Question

Difficulty: MediumMicrosoft Identity Platform Authentication

You are designing an ASP.NET Core Web API that is called by a web-based front-end client application. The Web API needs to request data from a downstream reporting database service. To comply with data privacy policies, the requests to the downstream service must execute under the security context of the specific user who logged into the front-end application, allowing the reporting service to audit access by individual user accounts. Which authentication flow and client application type should you implement in the Web API to meet these requirements?

  1. A
    A system-assigned managed identity configured on the Web API host
  2. B
    The client credentials flow using a confidential client application
  3. The OAuth 2.0 On-Behalf-Of flow using a confidential client applicationAnswer
  4. D
    The authorization code flow using a public client application

Answer

The OAuth 2.0 On-Behalf-Of flow using a confidential client application
The OAuth 2.0 On-Behalf-Of flow is specifically designed for Web APIs that need to call downstream APIs while propagating the original user's identity and permissions. Because a Web API runs on a server and can protect credentials, it must be implemented as a confidential client application.

Step-by-Step Solution

1
Evaluate the context propagation requirement.
Identify that requests to the downstream service must run under the user's security context to allow individual user auditing.
This rules out authentication flows that use application-only identities, such as client credentials or managed identities.
2
Determine the application type and trust level of the Web API.
Since the Web API runs on a server and can safely hold credentials, it is classified as a confidential client application.
This requires using ConfidentialClientApplication in MSAL.NET rather than PublicClientApplication.
3
Match the flow to the multi-tier API authentication scenario.
Select the OAuth 2.0 On-Behalf-Of (OBO) flow.
The OBO flow is the standard mechanism in the Microsoft Identity Platform for a Web API to exchange the user's incoming assertion token for a token to access a downstream API on their behalf.

Key Concept

OAuth 2.0 On-Behalf-Of flow for user context propagation in Web APIs
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic