Microsoft Identity Platform Microsoft Identity Platform

Entwicklerreferenz zur Microsoft Identity Platform mit MSAL für JavaScript, .NET, Python, Java, Go und Node, Azure.Identity, Tokenvalidierung, Claims, Conditional Access und OAuth-Flows. Developer reference for the Microsoft Identity Platform with MSAL for JavaScript, .NET, Python, Java, Go, and Node, Azure.Identity, token validation, claims, Conditional Access, and OAuth flows.

Überblick: v2.0 Endpoint und Application Model Overview: v2.0 endpoint and application model

Die Microsoft Identity Platform verwendet den v2.0-Endpoint für OAuth 2.0 und OpenID Connect. Er unterstützt Organisationskonten, persönliche Microsoft-Konten und Multi-Tenant-Szenarien, sofern die App-Registrierung korrekt auf supported account types, Redirect URIs und Permissions abgestimmt ist. The Microsoft Identity Platform uses the v2.0 endpoint for OAuth 2.0 and OpenID Connect. It supports organizational accounts, personal Microsoft accounts, and multi-tenant scenarios if the app registration is aligned correctly for supported account types, redirect URIs, and permissions.

MSAL.js für Browser und SPAs MSAL.js for browsers and SPAs

MSAL.js abstrahiert Auth Code Flow mit PKCE, Token Cache, Multi-Tab-Koordination und Claims-Challenges im Browser. Entscheidend sind Cache-Strategie, Redirect-Modell und robustes Error Handling. MSAL.js abstracts the auth code flow with PKCE, token cache, multi-tab coordination, and claims challenges in the browser. The key decisions are cache strategy, redirect model, and robust error handling.

import { PublicClientApplication } from '@azure/msal-browser';

const msal = new PublicClientApplication({
  auth: {
    clientId: '11111111-1111-1111-1111-111111111111',
    authority: 'https://login.microsoftonline.com/common',
    redirectUri: 'http://localhost:3000'
  },
  cache: {
    cacheLocation: 'sessionStorage'
  }
});

await msal.initialize();

const account = msal.getActiveAccount() ?? msal.getAllAccounts()[0];
try {
  const token = await msal.acquireTokenSilent({ account, scopes: ['User.Read'] });
  console.log(token.accessToken);
} catch (err) {
  if (err.name === 'InteractionRequiredAuthError') {
    await msal.acquireTokenRedirect({ scopes: ['User.Read'] });
  }
}

window.addEventListener('storage', () => {
  const accounts = msal.getAllAccounts();
  if (!accounts.length) {
    window.location.assign('/signed-out');
  }
});

MSAL.NET MSAL.NET

MSAL.NET deckt PublicClientApplication für interaktive Clients und ConfidentialClientApplication für Web-Apps, APIs und Daemons ab. Zertifikatsauthentifizierung, Token Cache Serialization und OBO sind die prägenden Enterprise-Szenarien. MSAL.NET covers PublicClientApplication for interactive clients and ConfidentialClientApplication for web apps, APIs, and daemons. Certificate authentication, token cache serialization, and OBO are the defining enterprise scenarios.

using Microsoft.Identity.Client;

var app = ConfidentialClientApplicationBuilder
    .Create(clientId)
    .WithAuthority($"https://login.microsoftonline.com/{tenantId}")
    .WithCertificate(cert)
    .Build();

var result = await app.AcquireTokenForClient(new[] { "https://graph.microsoft.com/.default" }).ExecuteAsync();

var pca = PublicClientApplicationBuilder
    .Create(clientId)
    .WithAuthority(AzureCloudInstance.AzurePublic, tenantId)
    .WithRedirectUri("http://localhost")
    .Build();

var result = await pca.AcquireTokenInteractive(new[] { "User.Read" }).ExecuteAsync();

var userAssertion = new UserAssertion(incomingAccessToken);
var result = await app.AcquireTokenOnBehalfOf(new[] { "api://downstream-api/.default" }, userAssertion)
    .ExecuteAsync();

MSAL für Python, Java, Go und Node MSAL for Python, Java, Go, and Node

Die Sprachfamilien folgen denselben Mustern: Public vs. Confidential Client, Silent Cache zuerst, Device Code für headless Interaktion und Zertifikat oder Managed Identity für nicht-interaktive Workloads. Unterschiede liegen vor allem im Laufzeitmodell und in der Cache-Integration. The language families follow the same patterns: public versus confidential client, silent cache first, device code for headless interaction, and certificate or managed identity for non-interactive workloads. Differences are mostly in runtime model and cache integration.

import msal
app = msal.ConfidentialClientApplication(
    client_id=client_id,
    authority=f'https://login.microsoftonline.com/{tenant_id}',
    client_credential=client_secret
)
result = app.acquire_token_for_client(scopes=['https://graph.microsoft.com/.default'])

app = msal.PublicClientApplication(client_id, authority=f'https://login.microsoftonline.com/{tenant_id}')
flow = app.initiate_device_flow(scopes=['User.Read'])
print(flow['message'])
result = app.acquire_token_by_device_flow(flow)

ConfidentialClientApplication app = ConfidentialClientApplication
    .builder(clientId, ClientCredentialFactory.createFromSecret(secret))
    .authority("https://login.microsoftonline.com/" + tenantId)
    .build();
IAuthenticationResult result = app.acquireToken(ClientCredentialParameters
    .builder(Set.of("https://graph.microsoft.com/.default"))
    .build()).get();

app, _ := confidential.New(clientID, cred)
result, err := app.AcquireTokenByCredential(context.Background(), []string{"https://graph.microsoft.com/.default"})
if err != nil { panic(err) }
fmt.Println(result.AccessToken)

const { ConfidentialClientApplication } = require('@azure/msal-node');
const cca = new ConfidentialClientApplication({
  auth: { clientId, authority: `https://login.microsoftonline.com/${tenantId}`, clientSecret }
});
const token = await cca.acquireTokenByClientCredential({ scopes: ['https://graph.microsoft.com/.default'] });

Azure.Identity und DefaultAzureCredential Azure.Identity and DefaultAzureCredential

Azure.Identity standardisiert Authentifizierung für Azure-SDKs. DefaultAzureCredential bildet eine Credential Chain aus EnvironmentCredential, ManagedIdentityCredential, AzureCliCredential und weiteren Quellen. In Azure ist Managed Identity fast immer vorzuziehen. Azure.Identity standardizes authentication for Azure SDKs. DefaultAzureCredential forms a credential chain out of EnvironmentCredential, ManagedIdentityCredential, AzureCliCredential, and other sources. In Azure, managed identity is almost always preferable.

using Azure.Identity;
using Azure.Storage.Blobs;

var credential = new DefaultAzureCredential();
var client = new BlobServiceClient(new Uri(storageUrl), credential);
var containers = client.GetBlobContainers();

const { DefaultAzureCredential } = require('@azure/identity');
const credential = new DefaultAzureCredential();
const token = await credential.getToken('https://graph.microsoft.com/.default');
console.log(token.token);

Tokenarten, Claims und Validierung Token types, claims, and validation

Entwickler müssen Access Tokens, ID Tokens und Refresh Tokens strikt unterscheiden. Genauso wichtig sind Claim-Interpretation, Lifetime-Verhalten, Signing Keys, Issuer-Prüfung und optionale Claims wie acct, ctry, email oder onprem_sid. Developers must clearly separate access tokens, ID tokens, and refresh tokens. Equally important are claim interpretation, lifetime behavior, signing keys, issuer validation, and optional claims such as acct, ctry, email, or onprem_sid.

{
  "aud": "api://contoso-api",
  "iss": "https://login.microsoftonline.com/contoso/v2.0",
  "sub": "AAAAAAAAAAAAAAAAAAAAAA",
  "exp": 1735689600,
  "xms_cc": ["cp1"],
  "roles": ["Invoice.Read.All"]
}

const jwksClient = require('jwks-rsa');
const jwt = require('jsonwebtoken');
const client = jwksClient({ jwksUri: `${authority}/discovery/v2.0/keys` });
function getKey(header, callback) { client.getSigningKey(header.kid, (err, key) => callback(err, key.getPublicKey())); }
jwt.verify(token, getKey, { audience: apiAudience, issuer: expectedIssuer });

Conditional Access, CAE und Proof of Possession Conditional Access, CAE, and proof of possession

Moderne Clients und APIs müssen Claims-Challenges verstehen. Conditional Access kann Step-up Authentication oder Auth Context erzwingen, CAE signalisiert vorzeitige Token-Invalidierung, und PoP bindet Tokens zusätzlich an Anfragen oder Schlüsselmaterial. Modern clients and APIs must understand claims challenges. Conditional Access can force step-up authentication or auth context, CAE signals early token invalidation, and PoP additionally binds tokens to requests or key material.

try {
  await callApi(accessToken);
} catch (err) {
  const claims = err?.claims;
  if (claims) {
    await msal.acquireTokenRedirect({ scopes: ['api://contoso-api/access'], claims });
  }
}

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer authorization_uri="https://login.microsoftonline.com/common/oauth2/v2.0/authorize", error="insufficient_claims", claims="{...}"

Scopes, App Roles, Protokolle und Best Practices Scopes, app roles, protocols, and best practices

OAuth 2.0, OIDC, Device Code, Client Credentials, OBO, ROPC, SAML Bearer und Well-Known Endpoints gehören zum Werkzeugkasten. Sichere Implementierungen bevorzugen moderne Flows, Managed Identity, strikte Tokenvalidierung und klare Autorisierung über Scopes oder Rollen. OAuth 2.0, OIDC, device code, client credentials, OBO, ROPC, SAML bearer, and well-known endpoints belong to the toolbox. Secure implementations prefer modern flows, managed identity, strict token validation, and clear authorization through scopes or roles.

{
  "appRoles": [
    {
      "allowedMemberTypes": ["User"],
      "displayName": "Invoice Reader",
      "id": "22222222-2222-2222-2222-222222222222",
      "isEnabled": true,
      "value": "Invoice.Read.All"
    }
  ]
}

GET https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/.well-known/openid-configuration
GET https://login.microsoftonline.com/contoso.onmicrosoft.com/discovery/v2.0/keys

def require_role(claims, required):
    roles = claims.get('roles', [])
    if required not in roles:
        raise PermissionError('Missing role')