Demystifying Azure AD, JWTs & OIDC
summary
Live coding shows a React SPA (SantaLight) calling backend APIs (SantaWeb) with Azure AD using MSAL not ADAL, demonstrates PKCE end-to-end where a code plus a PKCE code verifier is exchanged for ID and access JWTs, and uses Fiddler and jwt.ms to inspect requests and token claims. Common failures reproduced and fixed: mismatched redirect URI, wrong audience expected by Microsoft libraries, and missing app roles; after correcting redirect, audience setting, and assigning a role the API calls succeed.
AI-written summary · about
chapters (14)
- 0:00Start
- 2:11Oauth 2
- 10:51Authority and the Client Id
- 11:50Client Id
- 21:42Proof Key for Code Exchange
- 23:36Fiddler
- 24:26Scope
- 26:21Code Verifier
- 27:51Authentication Flow
- 31:12Incremental Consent
- 33:52Application Uri
- 42:36Active Directory Groups
- 56:18Private Network Addresses
- 57:23App Registration
related talks
59mDemystifying OAuth, JWTs and Azure AD
53mWeb API Security With Azure Active Directory
50mSecuring a REST API with Azure Active Directory
30mEnable Authentication and Authorization with Azure Active Directory
01h 02mDemystifying Web API Security in Azure
39mSecuring your apps with OAuth2 and OpenID Connect
58mLet's talk Auth
59mThe whirlwind tour of Authentication and Authorization with ASP.NET Core