Authentication & Authorization

The Admin API uses Microsoft Entra ID (Azure AD) for authentication via JWT bearer tokens, integrated through the Microsoft.Identity.Web library.

Authentication Flow

Configuration

Authentication is configured in Program.cs using the AzureAdAdmin configuration section:

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(azureConfig, "AzureAdAdmin", "Bearer");

The AzureAdAdmin section is loaded from Azure App Configuration and contains the tenant ID, client ID, and audience for token validation.

Role-Based Authorization

Controllers use the [Authorize] attribute with role requirements:

Role	Access Level
Admin.Global	Full administrative access — all operations
Admin.ReadWrite	Read and write access to camera configuration

Roles are assigned in Microsoft Entra ID and included as claims in the JWT token.

Managed Identity

The API uses DefaultAzureCredential for secure access to Azure services without storing credentials:

• Azure App Configuration — Connection via managed identity
• Key Vault — Secrets accessed through App Configuration key vault references
• Cosmos DB, SQL, Storage — All accessed via managed identity in deployed environments

CORS

CORS is configured to allow the React development server:

policy.WithOrigins("http://localhost:3000")
      .AllowAnyHeader()
      .AllowAnyMethod()
      .AllowCredentials();

In production, the React SPA is served as static files directly from the API, so CORS is not needed.

Authorization Endpoints

The AuthorizationController provides:

Endpoint	Method	Purpose
/authorization/login	GET	Redirects to Entra ID login, returns access token
/authorization/token	GET	Returns a token for the current session

These endpoints are primarily used by Swagger UI to authenticate interactively.