...
Each service authenticates itself when making the call, proving its identity to the other service.
...
Step-by-Step Authentication Process
Note: The steps below show ApiService calling IntegrationServiceAPI, but the process is identical in reverse (IntegrationServiceAPI calling ApiService) - just swap the service names and credentials.
Step 1: ApiService Needs to Call IntegrationServiceAPI
What happens:
- ApiService needs to send data to IntegrationServiceAPI
- Example: Sending an XML message to external system
- Makes HTTP request to IntegrationServiceAPI endpoint
Who's involved:
- ApiService
- ServiceTokenHandler (automatically intercepts)
Result:
- Request intercepted by ServiceTokenHandler
- Handler recognizes authentication is needed
...
Step 2: ServiceTokenHandler Requests Token
What happens:
- ServiceTokenHandler checks if it has a valid cached token
- If no valid token, requests new one from Azure AD
- Sends client credentials to Azure AD token endpoint
Who's involved:
- ServiceTokenHandler
- Microsoft Entra ID
What's sent to Azure AD:
- Client ID: ApiService's application ID
- Client Secret: ApiService's secret key (stored securely)
- Scope:
.default(all permissions the app has) - Grant Type:
client_credentials
Result:
- Request sent to Azure AD for authentication
...
Step 3: Azure AD Validates Client Credentials
What happens:
- Azure AD receives the token request
- Validates the client ID exists in the tenant
- Validates the client secret matches what's registered
- Checks if the app has permission to access IntegrationServiceAPI
Who's involved:
- Microsoft Entra ID
What Azure AD checks:
- ✅ Does this client ID exist?
- ✅ Does the client secret match?
- ✅ Does this app have permission to call IntegrationServiceAPI?
Result:
- If all valid → Proceed to Step 4
- If any invalid → Return error (401 Unauthorized)