Service-to-Service Authentication

using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = builder.Configuration["Auth:Authority"];
        options.Audience = "api://inventory-api";
        options.MapInboundClaims = false;
    });

builder.Services.AddAuthorizationBuilder()
    // Entra ID puts application permissions in "roles". An app-only token has no "scp" claim;
    // idtyp=app is only emitted when added as an optional claim on the app registration.
    .AddPolicy("reserve-stock", policy => policy.RequireAssertion(ctx =>
        ctx.User.HasClaim("roles", "Inventory.Reserve") && !ctx.User.HasClaim(c => c.Type == "scp")));

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

app.MapPost("/stock/{sku}/reservations", (string sku, ReservationRequest body) =>
        TypedResults.Ok(new { sku, body.OrderId, body.Quantity, reserved = true }))
    .RequireAuthorization("reserve-stock");

app.Run();

record ReservationRequest(Guid OrderId, int Quantity);

using System.Net.Http.Headers;
using System.Text.Json.Serialization;

var builder = WebApplication.CreateBuilder(args);

// Env vars injected by the workload identity webhook: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE.
var tenant = builder.Configuration["AZURE_TENANT_ID"];

// Same shape as the client secret version: only the credential inside TokenProvider changes.
builder.Services.AddSingleton<TokenProvider>();
builder.Services.AddTransient<BearerTokenHandler>();
builder.Services.AddHttpClient("identity", http => http.BaseAddress = new Uri($"https://login.microsoftonline.com/{tenant}/"));
builder.Services.AddHttpClient("inventory", http => http.BaseAddress = new Uri("https://inventory.internal.example.com/"))
    .AddHttpMessageHandler<BearerTokenHandler>();

var app = builder.Build();
app.MapPost("/orders/{id:guid}/reserve", async (Guid id, IHttpClientFactory clients, CancellationToken ct) =>
{
    using var response = await clients.CreateClient("inventory")
        .PostAsJsonAsync("stock/KETTLE-BLUE-1L/reservations", new { orderId = id, quantity = 1 }, ct);
    return Results.StatusCode((int)response.StatusCode);
});
app.Run();

public sealed class BearerTokenHandler(TokenProvider tokens) : DelegatingHandler
{
    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
    {
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", await tokens.GetTokenAsync(ct));
        return await base.SendAsync(request, ct);
    }
}

public sealed class TokenProvider(IHttpClientFactory factory, IConfiguration config, TimeProvider? clock = null)
{
    private const string Scope = "api://inventory-api/.default";
    private readonly TimeProvider time = clock ?? TimeProvider.System;
    private readonly SemaphoreSlim refreshLock = new(1, 1);
    private string? token;
    private DateTimeOffset refreshAt;

    public async ValueTask<string> GetTokenAsync(CancellationToken ct)
    {
        if (token is not null && time.GetUtcNow() < refreshAt) return token;

        await refreshLock.WaitAsync(ct);
        try
        {
            if (token is not null && time.GetUtcNow() < refreshAt) return token;

            // Re-read the projected token on every refresh: kubelet rotates the file.
            var assertion = await File.ReadAllTextAsync(config["AZURE_FEDERATED_TOKEN_FILE"]!, ct);
            using var response = await factory.CreateClient("identity").PostAsync("oauth2/v2.0/token",
                new FormUrlEncodedContent(new Dictionary<string, string>
                {
                    ["grant_type"] = "client_credentials",
                    ["client_id"] = config["AZURE_CLIENT_ID"]!,
                    ["client_assertion_type"] = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
                    ["client_assertion"] = assertion.Trim(),
                    ["scope"] = Scope,
                }), ct);
            response.EnsureSuccessStatusCode();
            var issued = (await response.Content.ReadFromJsonAsync<TokenResponse>(ct))!;

            token = issued.AccessToken;
            refreshAt = time.GetUtcNow().AddSeconds(issued.ExpiresIn - 300);
            return token;
        }
        finally
        {
            refreshLock.Release();
        }
    }
}

public sealed record TokenResponse(
    [property: JsonPropertyName("access_token")] string AccessToken,
    [property: JsonPropertyName("expires_in")] int ExpiresIn);

using System.Security.Cryptography.X509Certificates;
using Microsoft.AspNetCore.Server.Kestrel.Https;

var builder = WebApplication.CreateBuilder(args);

// Thumbprints of the partner certificates this endpoint accepts, from configuration.
var allowed = builder.Configuration.GetSection("Mtls:AllowedThumbprints").Get<string[]>() ?? [];

builder.WebHost.ConfigureKestrel(kestrel =>
{
    kestrel.ConfigureHttpsDefaults(https =>
    {
        https.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
        https.ClientCertificateValidation = (certificate, chain, errors) =>
            errors == System.Net.Security.SslPolicyErrors.None
            && allowed.Contains(certificate.GetCertHashString(System.Security.Cryptography.HashAlgorithmName.SHA256), StringComparer.OrdinalIgnoreCase);
    });
});

var app = builder.Build();

app.MapPost("/partner/invoices", (HttpContext context, InvoiceUpload upload) =>
{
    X509Certificate2? certificate = context.Connection.ClientCertificate;
    return TypedResults.Ok(new { received = upload.Number, from = certificate?.GetNameInfo(X509NameType.SimpleName, forIssuer: false) });
});

app.Run();

record InvoiceUpload(string Number, decimal Amount);