EG Zynergy Partners uses four different authentication approaches depending on the client and use case.
To accomplish this flow, four different Entra ID app registrations are used .
...
1. User Authentication (CIAM)
...
- Service authenticates using client ID and client secret (no user involved)
- Requests token from Azure AD Entra ID using client credentials
- Token cached for 1 hour (with 5-minute buffer)
- ServiceTokenHandler automatically attaches token to outgoing requests
- Receiving service validates token using Azure AD Entra ID public keys
Key Details:
ApiService → IntegrationServiceAPI:
...
Documentation: Service-to-service authentication
...
4. Static Token Authentication (WCF Service)
Used by: Legacy WCF service sending work order messages to IntegrationServiceAPI
Authentication Method: Static JWT token with symmetric key signing
Identity Provider: None (self-issued token)
How it works:
- WCF service has pre-configured static JWT token
- Token signed with HS256 (HMAC-SHA256) using shared secret key
- Token stored in Azure environment variable
- Token attached to every request
- IntegrationServiceAPI validates signature using same secret key
- Only valid for specific endpoint
Key Details:
- Token Issuer:
"PartnerPortal" - Token Audience:
"EGU.PartnerPortal" - Service Name Claim:
"WCFservice" - Signing Algorithm: HS256 (symmetric)
- Token Lifetime: Long-lived (typically years)
- Allowed Endpoint:
/api/ReceiveWCFIncomingMessageonly - Secret Key Storage:
- WCF: Azure environment variable
- IntegrationServiceAPI:
appsettings.json(AccessToken:SecretKey)
Security Note: Path restriction prevents token misuse on other endpoints. Token only works for receiving WCF incoming messages.
Documentation: WCF Static Token Authentication