Is there any way to authorise requests from two separate Client credentials in a single API

Help
1

We have two applications (windows service). These applications are accessing a custom standalone web API. Our requirement is, these two applications needs to be authorized while calling the Web API methods. App1 calls API_Method1() and App2 calls API_Method2(). Auth0 client credentials flow is used for this purpose. Separate client credentials has been configured for these two applications.

Authorization flow is as below.

Client application calls Auth0 token endpoint (by providing ClientId & secret).
Client application receives token.
Client application invokes Web API method and passes token along with.
Web API validates token and executes method.

For implementing Authorization (using Microsoft.AspNetCore.Authentication.JwtBearer), we have to configure Authority and Audience. Authority is same for both. But since Audience is different for each and configuration is done on API startup, API can be configured to authorize only one of the applications.

Is there any way to authorize requests from two separate Client credentials in a single API.

3

Hey there @anju.gopinath !

Thanks for the detailed description of the issue :slight_smile:

While I’m not entirely sure why this requires 2 separate audiences (it’s the same API, right?), you may want to look into using a single logical API.

Let us know!

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.