An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
Expiring AzureAD Client secret with implicit and hybrid flow
Our AzureAD Client secret is going to expire soon and we already created a new client secret but have not deleted the expiring one yet. It is used to authenticate our .Net core Web application.
We store Clientid, TenantId, domain etc. in appsettings.json and authenticate it using OpenIdConnectDefaults.AuthenticationScheme with Microsoft Identity platform (i.e. using .AddMicrosoftIdentityWebApp AzureAD configuration binding). We currently do not hardcode or specify the ClientSecret in our application or using any keyvault storage.
This is the screenshot of our Azure AD authentication set up which uses ID tokens (Implicit and hybrid flows option). It also does not allow public client flow.
If we delete the expiring secret now or let it expire next week, Do we need to make any change in the application or ID tokens (implicit and hybrid flow) option even require a client secret? Kindly appreciate your response.
Azure Application Gateway
Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Developer technologies | ASP.NET Core | Other
A set of technologies in .NET for building web applications and web services. Miscellaneous topics that do not fit into specific categories.
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
1 deleted comment
Comments have been turned off. Learn more