Demystifying OAuth, JWTs and Azure AD
summary
Live code debugging of Azure AD flows with concrete fixes: an SPA using MSAL vs ADAL demonstrates a wrong redirect URI and an audience mismatch that breaks JWT validation, then shows the PKCE code flow and back‑channel token exchange. Tools used are jwt.ms and Fiddler to inspect id/access tokens and claims; guidance covers app registration vs service principal, how scopes are just consent labels (not permissions), exposing an API, and using roles (and the gotcha with nested groups).
AI-written summary · about
chapters (10)
- 0:00Introduction
- 5:58OAuth and JWT challenges
- 7:02PKCE flow for native apps
- 11:58Redirect URI mismatches
- 22:09Authentication with Fiddler
- 33:49Decoding and validating JWTs
- 41:11API authorization with scopes
- 47:10Audience mismatches fix
- 51:25Authorization roles and groups
- 58:29Summary and Q&A
related talks
01h 02mDemystifying Azure AD, JWTs & OIDC
50mSecuring a REST API with Azure Active Directory
30mEnable Authentication and Authorization with Azure Active Directory
20mIdentity providers, your app, and everything in-between
53mWeb API Security With Azure Active Directory
39mSecuring your apps with OAuth2 and OpenID Connect
01h 02mModern Authentication
54mWho's your user? OpenID from the ground-up