(Our environment is Azure and we have our services hosted in Azure App Service.)

We have a legacy React app hosted inside a MVC .Net Core web app.

All the web app is doing is once it grabs the access token (we are using the Microsoft.Identity.Web package)

our program.cs roughly looks like:

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
.EnableTokenAcquisitionToCallDownstreamApi(new string[] {"api://{Guid API}/Users.ReadWrite.All"})
.AddInMemoryTokenCaches();

Then the home controller acquires the access token:

var token = await _tokenAcquisition.GetAccessTokenForUserAsync(new string[] {"api://{uri}/Users.ReadWrite.All"});

Controller then passes this access token to the request header and the header is passed down to the React app to use.

React app will use the tokens to access another API (which we own).

We have been using Client Credential Flow (client id, client secret.. etc) to get access tokens and it’s been working fine. But we are now asked to get rid of all client secrets and certs, instead use Managed Identity. Guidance we’ve been given was to use Federated Credentials (User Managed Identity)

Any thoughts?

I’ve been going through so many different repos and blogs. My mind is racing and spinning because it feels like a hazy puzzle I am piecing it together. I wanted to just level set and ask the fine folks here to get some ideas.

Thanks in advance!