title: Azure AD, Angular Spa and Spring Microservice Integration
body: <p>We are using Azure AD for authentication and authorization. Our angular spa has been enabled SSO with Azure AD. We need to secure our backend
  service and only allow API which has a valid jwt token.</p>
  <p>What we have done so far is:</p>
  <ol>
  <li><p>Registered our angular app in Azure AD.</p>
  </li>
  <li><p>We have configured spring microservice as a resource server and
  application properties contain jwt.issuer-uri</p>
  <p><strong>spring.security.oauth2.resourceserver.jwt.issuer-uri=XXXXXXXXXXX-XXXXXXXXX-XXXXXXX-XXXXXXXXXXX</strong></p>
  </li>
  </ol>
  <p>The issue is the token that we get from Azure AD is having an audience as <strong>&quot;00000003-0000-0000-c000-000000000000&quot;</strong> which means the token is generated for the <strong>Microsoft graph</strong>. I also tried accessing graph Api with this token and it worked. But what we want is to verify this token in our own spring microservice and grant permission
  based on jwt provided.</p>
  <p>To solve this issue I had to make some config changes in our Azure registered Angular app. I have added a custom <strong>scope api://&lt;&gt;/app</strong> and use
  this scope while acquiring the token. Now the token is being validated in the backend and API working fine.</p>
  <p>This config somehow works but doesn't seem correct to me. I am new to azure so am not sure how all things tie-up.</p>
  <ol>
  <li>The new token which is now being generated has an audience as our
  angular spa client Id. Is this correct? Shouldn't it be the backend
  service? Any why it's getting validated by the backend with the
  current configuration?</li>
  <li>My understanding is that we don't have to register our spring
  microservice with Azure Ad. I will just act as a resource server and
  will decode the token provided by the angular app using the
  issuer-url.</li>
  <li>In case we need to register our backend services with azure AD then
  would it be difficult to do the same for all microservices?</li>
  </ol>
  <p>I have done all settings by referencing.
  <a href="https://ordina-jworks.github.io/security/2020/08/18/Securing-Applications-Azure-AD.html" rel="nofollow noreferrer">https://ordina-jworks.github.io/security/2020/08/18/Securing-Applications-Azure-AD.html</a></p>
  <p>In some other links, I find a completely different config for setting up backend service. I am not sure which one is correct.
  <a href="https://docs.microsoft.com/en-us/java/api/overview/azure/active-directory-spring-boot-starter-readme?view=azure-java-stable" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/java/api/overview/azure/active-directory-spring-boot-starter-readme?view=azure-java-stable</a></p>