Federated Credentials from other Identity Providers

Motivation

Federated Identity Credentials provide a way to avoid managing secrets or certificate credentials. In this case, the credential is issued by another OIDC compliant Identity Provider (IdP). The federated identity credential creates a trust relationship between an application and an external IdP.

This avoids having to manage an extra credential for Entra. You still have to manage a credential in the external IdP.

Setup

See the Entra docs for how to set this up.

Config

1. In the appsettings.json that Microsoft.Identity.Web uses, you declare a separate section in your config for the external IdP.

{
    "$schema": "https://raw.githubusercontent.com/AzureAD/microsoft-identity-web/refs/heads/master/JsonSchemas/microsoft-identity-web.json",
    "AzureAD": {
        "Instance": "https://login.microsoftonline.com/",
        "TenantId": "Entra_tenent_id",
        "ClientId": "Entra_client_id", 
        "ClientCredentials": [  
            {
                "SourceType": "CustomSignedAssertion",                
                "CustomSignedAssertionProviderName": "OidcIdpSignedAssertion",
                "TokenExchangeUrl": "api://AzureADTokenExchange", // the audience of the federated credential, for EntraID it is different on each cloud
                "CustomSignedAssertionProviderData": {
                    "ConfigurationSection": "CredentialSection" // reference to the section below
                }
            }
        ]
    },

    "CredentialSection": {
        "Instance":    "https://login.microsoftonline.us/"           // Use Instance + TenantID for EntraID and "Authority" for other Identity Providers
        "TenantId": "Entra_tenent_id"
        "ClientId": "external_idp_client_id",
        "ClientCredentials": [  // the other IdP still needs a credential
            {
                "SourceType": "StoreWithDistinguishedName",
                "CertificateStorePath": "CurrentUser/My",
                "CertificateDistinguishedName": "CN=my_cert_cn"
            }
        ]
    }
}

2. Add a reference to Microsoft.Identity.Web.OidcFIC
3. Inject the new credential

 TokenAcquirerFactoryTesting.ResetTokenAcquirerFactoryInTest();
 TokenAcquirerFactory tokenAcquirerFactory = TokenAcquirerFactory.GetDefaultInstance();
+ tokenAcquirerFactory.Services.AddOidcFic();

4. Get the authroization header or call downstream APIs as usual

Further reading

For a setup that uses Entra-to-Entra, see this integration test.

For a code-only setup, see this test.