Feature: Add On-Behalf-Of (OBO) Auth Flow for the Microsoft Graph Team

[joshfree]

The OAuth 2.0 On-Behalf-Of flow (OBO) serves the use case where an application invokes a service/web API, which in turn needs to call another service/web API. The idea is to propagate the delegated user identity and permissions through the request chain. For the middle-tier service to make authenticated requests to the downstream service, it needs to secure an access token from the Microsoft identity platform, on behalf of the user.

Related Links:
Prototype: jongio/azidext#41
Documenation: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow
.NET Design: https://gist.github.com/christothes/15b9903f7da0954aee166166a8fa1919
MS Graph Team's tracking issue: microsoftgraph/msgraph-sdk-java-core#132

[sadasant]

.NET’s PR: Azure/azure-sdk-for-net#22146

[sadasant]

Here’s the design proposals I’m proposing to the architects: https://gist.github.com/sadasant/ece98248cb8cd2df5edd03ab92749f35

@xirzec , @chradek , @bterlson , when you have the time, your feedback is appreciated.

cc: @schaabs

[sadasant]

After discussing the designs with @xirzec , we believe the “swapping credentials” approach to be the most promising one. I will be working on a pull request.

[sadasant]

Update:

• Today we had a meeting regarding edge cases on OBO, and there are some questions to answer, like how to approach LROs (which is simpler in JS than in other languages), and what to do with AMQP clients.
• We’ve decided to push the advanced OBO approach (with the authenticationOptions) outside of our October GA.
• I’ll be making a PR soon with the most simple OBO credential, one that just receives all of the parameters on the constructor and passes them to MSAL, without more complexity.
• In a future Milestone, I’ll come back with more information regarding the advanced OBO credential.

Based on that, I’ll move these issues to the backlog:

• [Identity] Implement the advanced approach of the OnBehalfOfCredential #17133.
• [Identity] Ensure all the LRO pollers pass OperationOptions to all of their internal requests #17044.
• [Identity] Add a sample for OBO #17043.