...
- Request intercepted by ServiceTokenHandler
- Handler recognizes authentication is needed
...
Step 2: ServiceTokenHandler Requests Token
What happens:
- ServiceTokenHandler checks if it has a valid cached token
- If no valid token, requests new one from Azure AD
- Sends client credentials to Azure AD token endpoint
Who's involved:
- ServiceTokenHandler
- Microsoft Entra ID
What's sent to Azure AD:
- Client ID: ApiService's application ID
- Client Secret: ApiService's secret key (stored securely)
- Scope:
.default(all permissions the app has) - Grant Type:
client_credentials
Result:
- Request sent to Azure AD for authentication
...
Step 3: Azure AD Validates Client Credentials
What happens:
- Azure AD receives the token request
- Validates the client ID exists in the tenant
- Validates the client secret matches what's registered
- Checks if the app has permission to access IntegrationServiceAPI
Who's involved:
- Microsoft Entra ID
What Azure AD checks:
- ✅ Does this client ID exist?
- ✅ Does the client secret match?
- ✅ Does this app have permission to call IntegrationServiceAPI?
Result:
- If all valid → Proceed to Step 4
- If any invalid → Return error (401 Unauthorized)
...
Step 4: Azure AD Issues Access Token
What happens:
- Azure AD generates an access token
- Token valid for 1 hour
- Token contains app identity (not user identity)
- Token returned to ServiceTokenHandler
Who's involved:
- Microsoft Entra ID
- ServiceTokenHandler
What's in the token:
- Issuer: Microsoft Entra ID
- Audience: IntegrationServiceAPI (who the token is for)
- App Identity: ApiService's application ID
- Permissions: What ApiService can do
- Expiration: 1 hour from now
- Signature: Cryptographic proof of authenticity
Result:
- ServiceTokenHandler receives access token
- Token cached for future requests (1 hour)
...
Step 5: Token Attached to Request
What happens:
- ServiceTokenHandler attaches token to the original request
- Token added as Authorization header:
Bearer {token} - Request continues to IntegrationServiceAPI
Who's involved:
- ServiceTokenHandler
- ApiService
Result:
- Request sent to IntegrationServiceAPI with authentication proof
Step 6: IntegrationServiceAPI Validates Token
What happens:
- IntegrationServiceAPI receives request with token
- Authentication middleware examines the token
- Validates token is authentic and valid (using cached Azure AD public keys - no Azure AD call needed)
Who's involved:
- IntegrationServiceAPI
- JWT Authentication Middleware
- Azure AD public keys (cached locally, refreshed every 30 minutes)
What's validated:
- Signature: Proves token came from Azure AD
- Issuer: Confirms it's from the correct Azure AD tenant
- Audience: Ensures it's for IntegrationServiceAPI
- Expiration: Checks it hasn't expired (1-hour lifetime)
- App Permissions: Verifies ApiService has permission
Result:
- ✅ Valid token → Request proceeds to controller
- ❌ Invalid token → Return 401 Unauthorized
...