OAuth 2.0 authorization code flow with a React SPA, ASP.NET Core Web API, RBAC roles, and MSAL

Earlier this year the Microsoft Identity Platform team shared new guidance that recommends using the OAuth 2.0 Authorization Code flow for browser based web applications. The reason for this is that new browser security changes are going to cause problems for the commonly used implicit grant flow pattern.

Although I found plenty of great code samples and quickstart material for using the authorization code flow with graph API, it took me a while to figure out how to use it against an ASP.NET Core Web API. The goal of this post is to provide an end-to-end setup guide with source code for the protected web API resource scenario that uses RBAC roles.

Continue reading

PowerShell module starter kit – updated for 2019

A couple years ago I wrote a PowerShell module starter kit (here). The goal was to provide an example for organizing a module using best practices and provide a live repository you could clone and play around with.

I’ve taken that starter kit module and updated it for 2019. Incorporating some new best practices and new usage patterns that I find helpful. Head over to the GitHub link to check it out!
Continue reading