Am I doing authorization and authentication With Azure Properly?
Hi All, Currently in my project, I am trying to do AZURE AD based authorization using access token I am trying to use auth code flow (with PKCE). For that I have followed this ( https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-spa-app-registration#redirect-uri-msaljs-20-with-auth-code-flow { for setting our spa client app in azure}). Along with this I exposed my own custom API for having a scope url, I just want to secure my spring boot APIs & I am trying to use JWT access token and allowing a jwk issuer uri to validate the same using the link ( https://login.microsoftonline.com/{my_tenant}/v2.0 ) Am I doing it correctly?
In backend API, validate the JWT token (signature, nbf, exp, etc) to and make sure audience 'aud' field match to your client ID