Examkin

Question

Difficulty: Very hardMicrosoft Identity Platform Authentication

An organization is implementing a multi-tier solution where a mobile client calls a secure Web API. The Web API must call Microsoft Graph to access the user's files. The security policy dictates that the Web API must execute this request using the identity of the signed-in user, rather than using the API's own application identity. The Web API must authenticate to Microsoft Entra ID using a client certificate. You are writing the MSAL.NET code within the Web API to acquire the required token.

Which two code actions must you perform to implement this authentication flow? (Select two.)

  1. Construct the application client using ConfidentialClientApplicationBuilder.Create(clientId).WithClientCertificate(certificate).Build()Answer
  2. Call the AcquireTokenOnBehalfOf(scopes, userAssertion) method on the application client, passing a UserAssertion object created from the incoming user token, and execute it.Answer
  3. C
    Construct the application client using PublicClientApplicationBuilder.Create(clientId).WithAuthority(authority).Build()
  4. D
    Call the AcquireTokenForClient(scopes) method on the application client and execute it.
  5. E
    Construct the application client using ManagedIdentityApplicationBuilder.Create(clientId).Build()

Answer

Construct the application client using ConfidentialClientApplicationBuilder configured with the certificate, and then call AcquireTokenOnBehalfOf passing a UserAssertion object built from the incoming token.
The On-Behalf-Of (OBO) flow is designed for a Web API that needs to propagate the user's identity and permissions to a downstream API. To implement this using MSAL.NET, the Web API must act as a confidential client (configured via ConfidentialClientApplicationBuilder with its own certificate or secret) and request a token using AcquireTokenOnBehalfOf by supplying a UserAssertion derived from the incoming client JWT token.

Step-by-Step Solution

1
Determine the type of client application required.
The application must be configured as a confidential client since it runs on a secure Web API backend and must store a client certificate.
Web APIs are secure backends and must authenticate themselves to the Identity provider as confidential clients.
2
Initialize the confidential client application instance.
Use ConfidentialClientApplicationBuilder with the Client ID and the client certificate.
This establishes the client's identity for the subsequent token exchange process.
3
Extract the incoming JWT token from the client's request headers.
Construct a UserAssertion object using the raw JWT token.
The user assertion is needed to prove the identity of the signed-in user to Microsoft Entra ID.
4
Initiate the token acquisition flow for the downstream resource.
Call AcquireTokenOnBehalfOf(scopes, userAssertion) and execute the request.
This requests a new access token for the downstream API (Microsoft Graph) carrying the user's delegated permissions.

Key Concept

Microsoft Identity Platform On-Behalf-Of (OBO) authentication flow using MSAL.NET.
Estimated Time:3m 0s
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic