title: Service to service authentication using Azure AD and WebAPI
body: <p>Ive created a .NET core web app which is using Azure AD for the identity. This is all working fine as expected and anything I decorate using [Authroize] is protected.</p>
  
  <p>I am now wanting to secure one of my API controllers to be accessible from an external service.</p>
  
  <p>I followed this tutorial which explains service-service authentication.</p>
  
  <p><a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service" rel="nofollow noreferrer">Service to service auth with Azure AD</a></p>
  
  <p>Using this I have managed to request a token </p>
  
  <pre><code>POST https://login.microsoftonline.com/{TENANTID}/oauth2/token
  grant_type=client_credentials
  &amp;client_id={CLIENTID}
  &amp;client_secret={CLIENTSECRET}
  &amp;resource=https%3A%2F%mydirectory.onmicrosoft.com/myappname
  </code></pre>
  
  <p>Running this with postman, I get the Bearer access_token so looks good.</p>
  
  <p>Now if I call my web app in Postman with this bearer token on the header, </p>
  
  <pre><code>GET https://localhost:44392/api/booking
  Authorization Bearer {access_token}
  </code></pre>
  
  <p>I get a HTML response from one the Microsoft dialogues. So it seems it is just going into the redirect loop, so I am now confused on whether I have a configuration problem in the token request, or whether my web app needs to be setup in a different way. The article here mentions something about permissions in the manifest file, but I am confused why this would be necessary? </p>
  
  <p><a href="http://bitoftech.net/2014/09/12/secure-asp-net-web-api-2-azure-active-directory-owin-middleware-adal/" rel="nofollow noreferrer">enter link description here</a></p>
  
  <p><a href="http://bitoftech.net/2014/09/12/secure-asp-net-web-api-2-azure-active-directory-owin-middleware-adal/" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jvZHG.png" alt="enter image description here"></a></p>
  
  <p>Some additional points</p>
  
  <ul>
  <li>My web app and the POST for the token use the same AD ClientID</li>
  <li>I tried different AD Apps for each feature (Web and Service-to-Service) but didnt seem to make any difference</li>
  <li>If I just perform a standard login on the browser, the API endpoint resolves as expected.</li>
  </ul>
  
  <p>Any assistance appreciated!</p>
  
  <h2>Updates:</h2>
  
  <p>I managed to try the Daemon .NET 4.5 app and this worked flawlessly using the UseWindowsAzureActiveDirectoryBearerToken</p>
  
  <p><a href="https://github.com/Azure-Samples/active-directory-dotnet-daemon" rel="nofollow noreferrer">Daemon Service to service auth on .NET 4.5</a></p>
  
  <p>However in my .NET Core app, this middleware isn't available so I tried using JwtBearer middleware but I still get the login prompt.</p>
  
  <pre><code>app.UseJwtBearerAuthentication(new JwtBearerOptions
              {
                  Audience = "https://localhost:44392",
                  Authority = "https://login.microsoftonline.com/{TENANTNAME}.onmicrosoft.com"
              });
  </code></pre>
  
  <p>As you can see, I have only set 2 properties in the BearerOptions but I believe they should have been enough to [Authorize] my API endpoint.</p>