en un clic
msal-obo-flow
// On-Behalf-Of (OBO) Flow for web APIs to call downstream APIs while preserving user identity in MSAL.NET
// On-Behalf-Of (OBO) Flow for web APIs to call downstream APIs while preserving user identity in MSAL.NET
| name | msal-obo-flow |
| description | On-Behalf-Of (OBO) Flow for web APIs to call downstream APIs while preserving user identity in MSAL.NET |
| tags | ["msal","obo","on-behalf-of","token-exchange","confidential-client","multi-tier","downstream-api","user-assertion"] |
OBO (On-Behalf-Of) Flow enables a web API to act on behalf of an authenticated user to access downstream APIs. The web API receives a user token, validates it, and exchanges it for a token to call another API while maintaining the user's identity and context.
⚠️ Always pass an access token, NOT an ID token to AcquireTokenOnBehalfOf()
ID tokens are for authentication; access tokens are for authorization and API access.
Agent can show code for each credential type:
Reference appropriate credential setup:
// In web API controller receiving user token
[HttpGet("api/data")]
public async Task<IActionResult> GetData()
{
// Extract access token from Authorization header
var authHeader = Request.Headers["Authorization"].ToString();
var userToken = authHeader.Replace("Bearer ", "");
// See: with-certificate.cs for credential setup
var app = ConfidentialClientApplicationBuilder
.Create(clientId)
.WithCertificate(cert)
.WithAuthority($"https://login.microsoftonline.com/{tenantId}/v2.0")
.Build();
// Create UserAssertion with access token (not ID token)
var userAssertion = new UserAssertion(userToken, "urn:ietf:params:oauth:grant-type:jwt-bearer");
var result = await app.AcquireTokenOnBehalfOf(
new[] { "scope-uri" },
userAssertion)
.ExecuteAsync();
// Use result.AccessToken to call downstream API
return Ok(result.AccessToken);
}
Refer to Troubleshooting Guide
Common OBO errors:
MsalUiRequiredException: MFA or conditional access required—requires client re-authenticationtid claim from user token for guest user scenarios—use tenant-specific authority, not /commonAcquireTokenOnBehalfOf() with user's token + client credentialsChoose OBO if:
Avoid if:
Authorization Code Flow for web applications using MSAL.NET confidential client to sign in users and access APIs on their behalf
Client Credentials Flow for service-to-service (daemon) authentication in MSAL.NET without user involvement