An identity provider authenticates users and supplies identity and authorization metadata to client applications. OpenID Connect lets an API delegate account management to an external provider, then verify the token presented with each request. Tokens usually use JSON Web Token (JWT) format, so the API avoids storing another username-and-password database and associated personal data. section 9.5
A production integration typically follows these steps:
- Register the API or client with an identity provider and configure its client ID, tenant, scopes, and endpoints. section 9.5.2
- Add Microsoft.AspNetCore.Authentication.JwtBearer, select the JWT bearer scheme, and enable authentication before authorization in the request pipeline. section 9.5
- Protect API endpoints with authorization, then validate bearer tokens rather than trusting identity claims supplied by the caller. section 9.7
- Configure Swagger UI with OAuth settings so it can authenticate a user, obtain a token, and send it to the API. section 9.5.2
ASP.NET Core API with JWT authentication
Register JwtBearer authentication, call UseAuthentication and UseAuthorization, and apply [Authorize] to CatalogController. Swagger UI can then authenticate against Azure AD; a successful authorized request returns 200 instead of 401. section 9.5.2
