HOTSPOT You are designing a software as a service (SaaS) application that will enable Azure Active Directory (Azure AD) users to create and publish online surveys. The SaaS application will have a front-end web app and a back-end web API. The web app will rely on the web API to handle updates to customer surveys. You need to design an authorization flow for the SaaS application. The solution must meet the following requirements:
• To access the back-end web API, the web app must authenticate by using OAuth 2 bearer tokens.
• The web app must authenticate by using the identities of individual users. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Interactive Drag & Drop Matching
Drag each configuration to its target, or tap an option then tap a target slot.
Available Configurations2 remaining
a. Azure AD Azure AD is the identity provider and is responsible for generating access tokens in...
c. a web API The web API, as the resource server in the OAuth
Targets & Placement
1The access tokens will be generated by
Drop configuration here
2Authorization decisions will be performed by
Drop configuration here
Explanation
Hotspot Solution:
Recommended Community Solution:
The access tokens will be generated by: a. Azure AD Azure AD is the identity provider and is responsible for generating access tokens in an OAuth 2.0 flow. The web app will authenticate with Azure AD and receive an access token. 2. Authorization decisions will be performed by: c. a web API The web API, as the resource server in the OAuth 2.0 flow, is responsible for making authorization decisions. It validates the access token it receives from the web app and determines what resources the authenticated user can access.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
3
I believe the given answer is correct => Azure AD and A web API
2
The answer assumes the front end web app is public client like a React SPA app supported by a back-end API, then obviously the API authorizes. In a server-side confidential client web app calling downstream API scenario, the web app would authorize endpoints and use application permissions to access its API. The question doesn't specify the need for delegated API permissions
2
Yes it does. "The web app must authenticate by using the identities of individual users."
