MSAL

The Microsoft Authentication Library (MSAL) is a helper library that enables developers to acquire security tokens from the Identity platform. It can be used to provide sceure access to:

• Graph and other Microsoft APIs
• Third-party web APIs
• Your own web API

MSAL provides a consistent API with many ways to get tokens. It provides the following benefits:

• Saves you from reimplementing OAuth or using OAuth libraries
• Supports both user and app restricted flows
• Performs token management for you
• Actionable exceptions and solid logging helps with debugging

Lang/arch support

Auth flow support

Public/confidential clients

• Public
  Application runs on devices: desktops, mobile, browser. Can't be trusted because the source code is readable/disassemblable. Can't have client secrets.
• Confidential
  Application runs on services: web apps, web API apps, services/daemons. Source is not readable/disassemblable at runtime. Can hold configuration-time client secrets to prove identity.

In code

In order to get started with MSAL, you will need to have registered your app with the Microsoft Identity platform. You might then need any of the following information that can be found in the portal:

• Application ID (client ID)
• Directory ID (tenant ID)
• Authority (provider URL + sign-in audience)
• Credentials (confidential) (secret/X509Certificate2)
• Redirect URI the response route for the security token

You can instantiate a public or confidential client using the MSAL library

// public
var app = PublicClientApplicationBuilder
	.Create(clientId)
	.Build();

// confidential
var app = ConfidentialClientApplicationBuilder
	.Create(clientId)
	.WithRedirectUri(redirectUri)
	.Build();

Builders use .With modifier methods during construction.