A drift-ice buoy dashboard API must call a second protected API while preserving the signed-in ranger’s identity. Which flow should the middle-tier API use?
Select an answer to reveal the explanation.
Short Explanation
The middle API still needs to act as that ranger downstream—not as a faceless daemon. That’s the on-behalf-of exchange, not client credentials.
Full Explanation
On-behalf-of (OBO) is the middle-tier flow when the drift-ice buoy dashboard API must call a second protected API as the signed-in ranger. The dashboard API receives the ranger’s access token, exchanges it at Entra for a new access token aimed at the downstream API, and calls downstream with that token. Downstream still sees the ranger’s identity and delegated permissions rather than a faceless app-only caller.
Client credentials fails the identity-preservation requirement. Client credentials mint an application-only token; the downstream API would authorize the dashboard app itself, not the ranger, which breaks auditing and per-user authorization.
Implicit flow from the browser directly against the second API fails modern guidance and the stated architecture. Implicit is legacy, and skipping the middle tier abandons the dashboard API’s server-side responsibilities. Browser-only calls also struggle with secret handling and multi-API consent patterns that middle tiers solve with OBO.
Resource Owner Password Credentials with the ranger’s password in Key Vault fails because ROPC is legacy, discouraged, incompatible with many MFA/Conditional Access scenarios, and storing user passwords—even in Key Vault—recreates a password brokering anti-pattern.
Exam caveat: OBO requires the middle API to be a confidential client, the incoming token to be for the middle API, and proper delegated scopes consented for the downstream resource. Application permissions cannot replace OBO when you must act as the user.
Operational check: capture the middle API’s inbound token, perform the OBO exchange for the downstream scope/app ID URI, and verify the downstream token’s aud and the user subject claims. Confirm downstream audit logs show the ranger, not only the dashboard app ID.