OAuth on NASAN

OAuth 2.0 - Tutorial 3 - Expose and Access a Web API - Resource Server

Tue, 30 Sep 2025 05:10:21 +0100

Previous tutorials

In the previous tutorials:

We learned:

How to create a “server-side” Python Web App
- How to deploy this app to Azure
How to register the app with Entra ID
How to use the Authorization Code Flow to access the Microsoft Graph API.

Overview

In this tutorial:

OAuth 2.0 - Tutorial 2 - Azure Server Side Python WebApp Auth Code Flow - Entra ID

Mon, 29 Sep 2025 05:10:21 +0100

Introduction

In the previous tutorial Localhost Python WebApp Auth Code Flow with Entra ID , we demonstrated using a localhost web app as a “server-side app” (confidential client) with the Authorization Code Flow. In this tutorial, we will deploy the app to Azure, making it a true “server-side app” where users cannot access secrets.

The following steps are required to deploy the app to Azure:

Create an Azure Container Registry
Create a Dockerfile and publish the image to the registry
Create an Azure Web App using this container
Add environment variables (tenant, client ID, client secret)
Add a new redirect URI to the app registration
Update the redirect URI in the app code

Prerequisites

Microsoft Azure Tenant with active Subscription
Docker installed
Azure CLI installed
UV installed: UV Installation

Create Azure Container Registry

Create an Azure container registry where you can store your docker images:

OAuth 2.0 - Tutorial 1 - Localhost Python WebApp Auth Code Flow with Entra ID

Sun, 28 Sep 2025 05:10:21 +0100

Introduction - “Server Side App” - Auth Code Flow

This guide demonstrates how to create a “server-side” Python web application running locally (for development) that authenticates users with Microsoft Entra ID and authorizes access to the Microsoft Graph API using the Authorization Code Flow as a “confidential client” with a client secret.

Info: In the second tutorial, we will deploy this app to Azure

The client is considered confidential because the app runs solely on the server, and users do not have access to the client secret.

OAuth 2.0 - mind map

Sat, 27 Sep 2025 05:10:21 +0100

To better understand OAuth 2.0, I have created the following mind map and a series of follow-up tutorials that provide a basic overview of how OAuth works.

MindMap OAuth

OAUTH 2.0 Mind Map illustrates basic concepts

Figure 1: OAUTH 2.0 Mind Map visualizing basic concepts