How to configure Microsoft.Identity.Web when Web App and Web API exist in the same project.

[levi106]

I looked at the document but couldn't figure out how to configure the following project.

• The project is an ASP.NET Core MVC project with API controller.
• Both Web App and Web API call backend API (e.g. Microsoft Graph)

Do I need to call AddMicrosoftIdentityWebAppAuthentication and also AddMicrosoftIdentityWebApiAuthentication?

[jmprieur]

yes @levi106 : you need to call both.

[levi106]

Does the call order matter? Calling AddMicrosoftIdentityWebApiAuthentication after AddMicrosoftIdentityWebAppAuthentication resulted in a 401 error.

services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
           .EnableTokenAcquisitionToCallDownstreamApi()
           .AddInMemoryTokenCaches();
services.AddMicrosoftIdentityWebApiAuthentication(Configuration)
           .EnableTokenAcquisitionToCallDownstreamApi()
           .AddInMemoryTokenCaches();

[jmprieur]

@levi106, it does not but I think that you need to use the non-contracted from (AddAuthentication, AddMicrosoftIdentityWebApp, AddAuthenticationAddMicrosoftIdentityWebApi, and decide of which scheme (OpenIdConnect or JWT has the priority), and specify which scheme to use for which page / controller action.

See details in https://github.com/AzureAD/microsoft-identity-web/wiki/adding-call-api-to-web-app https://github.com/AzureAD/microsoft-identity-web/wiki/Web-APIs#using-multiple-authentication-schemes

The problematics is similar to this one:
#429

[levi106]

I tried to specify the scheme name for the Web API, but I got the same result.

            services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
                    .EnableTokenAcquisitionToCallDownstreamApi()
                    .AddInMemoryTokenCaches();

            services.AddMicrosoftIdentityWebApiAuthentication(Configuration, jwtBearerScheme:"Bearer2")
                    .EnableTokenAcquisitionToCallDownstreamApi()
                    .AddInMemoryTokenCaches();

[jmprieur]

@levi106 did you decorate the [Authorize] attribute for your HTML pages (Web app) and your api pages (web api) with the scheme ? did you read this article? Authorize with a specific scheme in ASP.NET Core

[jmprieur]

See also https://github.com/AzureAD/microsoft-identity-web/wiki/Mixing-web-app-and-web-api-in-the-same-ASP.NET-core-app
Closing as answered