damienbod / bff-microsoftentraexternalid-aspnetcore-angular

Microsoft Entra External ID Backend for frontend security using Angular Standalone (nx) and ASP.NET Core backend

Microsoft Entra External ID BFF security architecture using ASP.NET Core and nx Angular standalone

Secure an Angular application using Microsoft Entra External ID and ASP.NET Core with BFF

Debugging

Start the Angular project from the ui folder

nx serve --ssl

Start the ASP.NET Core project from the server folder

dotnet run

Or just open Visual Studio and run the solution.

Credits and used libraries

• NetEscapades.AspNetCore.SecurityHeaders
• Yarp.ReverseProxy
• Microsoft.Identity.Web
• ASP.NET Core
• Angular
• Nx

Links

https://learn.microsoft.com/en-us/aspnet/core/introduction-to-aspnet-core

https://nx.dev/getting-started/intro

https://github.com/AzureAD/microsoft-identity-web

https://developer.microsoft.com/en-us/identity/customers

https://learn.microsoft.com/en-us/azure/active-directory/external-identities/

https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-external-id

https://www.cloudpartner.fi/?p=14685

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/microsoft-entra-external-id-public-preview-developer-centric/ba-p/3823766

https://github.com/Azure-Samples/ms-identity-ciam-dotnet-tutorial

https://github.com/damienbod/EntraExternalIdCiam

https://github.com/damienbod/bff-aspnetcore-angular

https://github.com/damienbod/bff-auth0-aspnetcore-angular

https://github.com/damienbod/bff-openiddict-aspnetcore-angular

https://github.com/damienbod/bff-azureadb2c-aspnetcore-angular

https://github.com/isolutionsag/aspnet-react-bff-proxy-example

https://github.com/damienbod/bff-aspnetcore-vuejs

bff-microsoftentraexternalid-aspnetcore-angular's Issues

BFF token with k6 authentication flow?

First of all, thanks for your work on the BFF token pattern. That's really cool and I learnt a lot from your repos.

Currently, I use this kind of pattern and the code is nearly the same as the code in this repo. Everything works very well. But now, the team need to work on k6 for load testing (API and web components). I can handle it by recording the flow for Microsoft Entra External ID, but it might be cumbersome and unstable (let's say we enable 2FA or customise authentication flow on CIAM, and the k6 script needs to be modified by adding more steps).

In the documents of k6, there are only a few options like HTTP auth, and token with OAuth 2.0.. In the past, when we did this with k6, we used OAuth 2.0 auth (authorisation code flow + pkce on SPA), and then it was quite easy to follow the guidance on the k6 document, and we could run headless mode and put it run on CI/CD.

My question is if we still use k6, then any approach based on your experience to make this kind of loading testing (or integration testing possibly)? Hope to hear your opinion.