Page History

...

• External system integration API
• Location: Source/EGU.PartnerPortal.IntegrationServiceAPI
• Swagger URL: http://localhost:7098/swagger (local)
• Client ID: bd5100ee-af63-4880-8c60-47d4207d60c1
• Scope: api://bd5100ee-af63-4880-8c60-47d4207d60c1/access_as_user

...

High-Level Authorization Flows

Flow 1: Developer Opens Swagger & Authenticates (Steps 1-6)

┌─────────────────────────────────────────────────────────────────┐
│         SWAGGER AUTHENTICATION FLOW (Steps 1-6)                 │
└─────────────────────────────────────────────────────────────────┘

    ┌──────────────┐
    │  Developer   │
    │   Browser    │
    └──────┬───────┘
           │
           │ Step 1: Navigate to Swagger UI
           │ (http://localhost:7532/swagger)
           ▼
    ┌──────────────────────┐
    │   Swagger UI Page    │
    │   (Unauthenticated)  │
    └──────┬───────────────┘
           │
           │ Step 2: Click "Authorize" button
           │ Select oauth2 security scheme
           ▼
    ┌──────────────────────────────┐
    │  Swagger Authorization Modal │
    │  Shows required scopes       │
    └──────┬───────────────────────┘
           │
           │ Step 3: Click "Authorize"
           │ → Redirect to Microsoft login
           ▼
    ┌──────────────────────────────┐
    │  Microsoft Entra ID          │
    │  Login Page                  │
    └──────┬───────────────────────┘
           │
           │ Step 4: User enters
           │ email + password + MFA
           ▼
    ┌──────────────────────────────┐
    │  Microsoft Entra ID          │
    │  Validates Credentials       │
    └──────┬───────────────────────┘
           │
           │ ✅ Valid credentials
           │
           │ Step 5: Returns
           │ authorization code
           ▼
    ┌──────────────────────┐
    │  Swagger UI          │
    │  (PKCE exchange)     │
    └──────┬───────────────┘
           │
           │ Step 6: Exchange code
           │ for access token
           ▼
    ┌──────────────────────────────┐
    │  Microsoft Entra ID          │
    │  Token Endpoint              │
    └──────┬───────────────────────┘
           │
           │ Returns access token (1h)
           ▼
    ┌────────────────────────────────┐
    │   ✅ SWAGGER AUTHORIZED         │
    │   Can test API endpoints       │
    └────────────────────────────────┘

Flow 2: Testing API Endpoint with Token (Steps 7-8)

┌─────────────────────────────────────────────────────────────────┐
│          API TEST & VALIDATION FLOW (Steps 7-8)                 │
└─────────────────────────────────────────────────────────────────┘

    ┌────────────────────────────────┐
    │   Developer clicks "Try it out"│
    │   on an API endpoint           │
    └────────────┬───────────────────┘
                 │
                 │ Step 7: Swagger adds token to request
                 ▼
    ┌──────────────────────────────────┐
    │  HTTP Request                    │
    │  GET /api/v1/WorkOrder/Overview  │
    │  Authorization: Bearer eyJ...    │
    └──────┬───────────────────────────┘
           │
           │ Step 8: Request received
           ▼
    ┌──────────────────────────────────────┐
    │  ApiService/IntegrationServiceAPI    │
    │  JWT Authentication Middleware       │
    └──────┬───────────────────────────────┘
           │
           │ Token Validation:
           │ ✓ Issuer (Azure AD tenant)
           │ ✓ Audience (this API)
           │ ✓ Signature (Azure AD keys)
           │ ✓ Expiration (not expired)
           │
           ├─── ✅ Valid ────┐    ❌ Invalid ───┐
           │                 │                   │
           ▼                 ▼                   ▼
    ┌──────────────┐  ┌──────────────┐  ┌──────────────┐
    │  Controller  │  │  200 OK      │  │  401/403     │
    │  Executes    │  │  Returns     │  │  Unauthorized│
    │  Endpoint    │  │  Data        │  │  Forbidden   │
    └──────────────┘  └──────────────┘  └──────────────┘

...

Step-by-Step Authorization Process

Step 1: Developer Opens Swagger UI

What happens:

• Developer navigates to Swagger UI endpoint
  • ApiService: http://localhost:7532/swagger (local dev)
  • IntegrationServiceAPI: http://localhost:7098/swagger (local dev)
• Swagger UI loads, showing all available API endpoints
• All endpoints show a lock icon 🔒 indicating authorization required

Who's involved:

• Developer (Browser)
• Swagger UI

What you see:

• List of all API endpoints organized by controller
• Open lock icons (grayed out) indicating authentication required
• "Authorize" button in the top-right corner

Result:

• Swagger UI is loaded but cannot test endpoints yet
• Need to authenticate first

...

Step 2: Click "Authorize" Button

What happens:

• Developer clicks the "Authorize" button (or clicks a lock icon)
• Modal dialog appears showing available security schemes
• Shows OAuth2 (Authorization Code with PKCE) security scheme
• Displays the required scope for the API

Who's involved:

• Developer
• Swagger UI

Authorization modal shows:

For ApiService:

oauth2 (OAuth2, authorizationCode with PKCE)
Scopes:
  api://4dad5d62-dc8c-4378-8bd0-ae736a4d73fe/access_as_user - Access API as user

For IntegrationServiceAPI:

oauth2 (OAuth2, authorizationCode with PKCE)
Scopes:
  api://bd5100ee-af63-4880-8c60-47d4207d60c1/access_as_user - Access Integration API as user

Result:

• Developer sees what permissions will be requested
• Ready to start OAuth2 flow

...

Step 3: Initiate OAuth2 Flow

What happens:

• Developer clicks "Authorize" in the modal
• Swagger UI starts the OAuth2 Authorization Code flow
• Browser redirects to Microsoft Entra ID login page
• Security code (PKCE) generated automatically

Who's involved:

• Swagger UI
• Microsoft Entra ID

What's sent to Microsoft:

• Swagger client ID
• Which API scope is needed
• Security challenge code (PKCE)
• Where to redirect back after login

Result:

• Browser redirected to Microsoft login page

...

Step 4: Developer Enters Credentials

...