...
| Direction | Client ID (Who's calling) | Client Secret (Who's calling) | Audience (Who's being called) |
|---|---|---|---|
| ApiService → Integration | ApiService ID | ApiService secret | IntegrationServiceAPI ID |
| Integration → ApiService | IntegrationServiceAPI ID | IntegrationServiceAPI secret | ApiService ID |
Why Bidirectional?
ApiService calls IntegrationServiceAPI when:
- Sending work order to external system
- Sending completion notification
- Sending cancellation notice
IntegrationServiceAPI calls ApiService when:
- Receiving work order from external system
- Receiving instruction from external system
- Updating work order status
Each service authenticates itself when making the call, proving its identity to the other service.
...
Step-by-Step Authentication Process
...
- ✅ Use environment variables (or in Key Vault)
- ✅ Rotate periodically (every 6-12 months)
- ❌ Never commit to git
- ❌ Never hardcode in source files
...
Token Validation
How IntegrationServiceAPI validates tokens:
Signature Validation
- Uses Azure AD's public keys
- Proves token was issued by Azure AD
- Prevents forged tokens
Issuer Validation
- Checks token came from correct Azure AD tenant
- Prevents tokens from other organizations
Audience Validation
- Ensures token is for IntegrationServiceAPI
- Prevents token reuse across different APIs
Expiration Validation
- Checks token hasn't expired (1 hour)
- Includes 5-minute clock skew tolerance
Permission Validation
- Checks ApiService has required permissions
- Based on Azure AD app role assignments
...
Configuration
ApiService Configuration
What's needed:
| Setting | Description | Example Value |
|---|---|---|
| Client ID | ApiService's application ID | 4dad5d62-dc8c-4378-8bd0-ae736a4d73fe |
| Client Secret | ApiService's secret key | abc123~XYZ789-VerySecret |
| Tenant ID | Azure AD tenant | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |
| Scope | IntegrationServiceAPI scope | api://bd5100ee-af63-4880-8c60-47d4207d60c1/.default |
Where configured:
- Environment variables (recommended)
appsettings.json(development only, with secrets.json)
...
IntegrationServiceAPI Configuration
What's needed:
| Setting | Description | Example Value |
|---|---|---|
| Client ID | IntegrationServiceAPI's ID | bd5100ee-af63-4880-8c60-47d4207d60c1 |
| Client Secret | IntegrationServiceAPI's secret key | xyz789~ABC123-VerySecret |
| Tenant ID | Azure AD tenant | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |
| Scope | ApiService scope | api://4dad5d62-dc8c-4378-8bd0-ae736a4d73fe/.default |
Where configured:
- Environment variables (recommended)
appsettings.json(development only, with secrets.json)
...
Quick Reference
ApiService
| Property | Value |
|---|---|
| Client ID | 4dad5d62-dc8c-4378-8bd0-ae736a4d73fe |
| Needs Client Secret | ✅ Yes (calls IntegrationServiceAPI and validates tokens) |
| Tenant ID | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |
...
IntegrationServiceAPI
| Property | Value |
|---|---|
| Client ID | bd5100ee-af63-4880-8c60-47d4207d60c1 |
| Needs Client Secret | ✅ Yes (calls ApiService and validates tokens) |
| Tenant ID | 6073ce8b-73f3-4df4-9b80-5e40cdc6965f |