Azure Expose an API vs API permissions

user_1098555 0
Viewed 472

I have a Web API and a frontend application.

In the API permissions of the frontend application, I added a permission to my API (Files.Download).

enter image description here

In the Expose an API of the Web API I have authorized the client application for this scope.

enter image description here

Now, in order to check if the calling application has the required scope, I call the following code from my controller action method :

 public static void VerifyUserHasAnyAcceptedScope(this HttpContext context,
                                                         params string[] acceptedScopes)
        {
            if (acceptedScopes == null)
            {
                throw new ArgumentNullException(nameof(acceptedScopes));
            }
            Claim scopeClaim = context?.User?.FindFirst("http://schemas.microsoft.com/identity/claims/scope");
            if (scopeClaim == null || !scopeClaim.Value.Split(' ').Intersect(acceptedScopes).Any())
            {
                context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
                string message = $"The 'scope' claim does not contain scopes '{string.Join(",", acceptedScopes)}' or was not found";
                throw new HttpRequestException(message);
            }
        }

What I have noticed though, if I don't authorize the frontend application in the Expose an API, then the scope is not part of the claims.

So what is the point of the API Permissions ? I don't get it, it seems redundant and at the same time useless since it has no effetcs;

azure-active-directory azure
1 Answers

so the "authorized client applications" is used when you basically want to preauthorize users without consent to access that api. because of that, I guess it will automatically return the scopes that are preauthorized, if you have them configured in api permissions. If you don't add the preauthorized, then it will behave as normal, where you have to specifically request the scope during your token request. then as it tries to get that token with that webapi scope, it will prompt users for consent if needed.

This is to say, yes, it is not in the claims if you don't request the scope when requesting the token, which is normal. if you want access to the web api, you should be requesting that scope during token call. when you do, it will be in the jwt access token.

user_134708940
Related