I am trying to
- validate a Azure AD B2C access token in my Flask web API
- use scopes from that access token to authorize calling protected resources
- use timely and secure solutions such as PKCE for OAuth 2.0.
what already works:
[ client app ] -- authenticate & get access token for api --> [ Azure AD B2C ] OK
[ client app ] -- send access token to backend api (resource server) --> [ flask api ] OK
where this question looks for help:
[ flask api ] -- verify if token is valid --> [ ... ]
[ flask api ] -- verify if scopes of access token are valid to access protected resource --> [ ... ]
What is the best way to accomplish this within Flask (commonly used libraries, workflows)?
Please read for context:
I am new to authenticating webapps with Azure AD B2C. I have previously used flask-jwt-extended library to authorize and authenticate my Flask web apis where the user database was on my own server (I believe this is called 'implicit flow').
The whole 'modern' identity ecosystem is quite overwhelming and the documentation from Microsoft on using their solutions is very demanding. I have gone through most of their articles and tutorials thoroughly but some things seem still unclear.
My client app (Vue.js SPA application) fetches an access token from Azure and then sends it in the header of a HTTP request to my flask API (=resource server). There I need to validate if the token is valid and unmodified. Then I need to check if the scopes of the access token authorize calling a specific endpoint / resource. Below is the architecture.
Microsoft has written a tutorial to accomplish this, but it is only available through .NET or node. I am looking for a Python solution.
I am looking for a secure and sustainable solution for this problem and I am really suprised that this workflow seems not very prominent. Of course it is possible that I miss an important concept or maybe I am making things too complicated. This is exactly why I wrote this question, to get insight on a complex topic for myself and all Flask users who need to address this in the future.
Thank you for sharing your advice or solution.
Other solutions I have looked at:
https://github.com/RobertoPrevato/PythonJWTDemo --> a frequently referenced solution using cryptography, but it lacks the implementation of scopes.
https://github.com/cljung/py-rest-api --> builds on Roberto Prevatos solution and also includes scopes. The problem here is that this seems to rely in implicit flow, but on the Azure resources everybody talks about using PKCE and to avoid implicit flow.