Secure APIs with FastAPI and the Microsoft Identity Platform Transcripts
Chapter: JSON Web Token (JWT) Authentication
Lecture: Handling authentication and authorization errors
0:00 The Oauth2 spec provides guidance on how to handle errors during authentication and authorization.
0:07 Using the error portion in the error response and here is a sample response from Azure
0:13 Active Directory. We can see the information that is sent to the authentication clients when
0:19 they attempt to log in a user or validate a token along with recommended corrective actions
0:24 Now there are a lot of errors that can be pushed out by Azure Active Directory and will go very quickly through some of them to give you an idea on
0:34 what to expect and how to fix them. For example if you receive an invalid request then that means that there was a protocol
0:41 error and the way to fix it is by fixing the submitted data and resubmitting the
0:46 authentication request or invalid grant. You need to try a new request to the authorizing
0:51 point to get a new authorization code for an unauthorized client.
0:55 This usually happens when the client application isn't registered in Azure Active directory or hasn't been added to the user's Active directory.
1:03 The application can prompt the user with instructions for installing the application and adding it to
1:08 Azure Active Directory. This is most common in multi tenant applications.
1:12 Imagine using Azure Active Directory with Adobe or Salesforce at work and using your corporate account
1:18 for single sign on. So convenient if these applications have not been registered correctly by
1:23 the Azure Active Directory admin then this is the error that you will see when you attempt to sign in invalid clients.
1:31 The client credentials are invalid to fix the application
1:34 administrator needs to update their credentials for unsupported grant type changed the grant type in the
1:40 request. This type of affairs should occur only during development and should be detected during
1:45 initial testing. Invalid request this indicates that the resource if it exists, has not been configured in the tenant.
1:53 The application can prompt the user with instructions for installing the application and adding into the
1:58 azure active directory tenant. During development this usually indicates an incorrectly setup testament or a typo
2:05 in the name of the scope being requested, interaction required retry the request with the same resource interactively so that the user can
2:12 complete any challenges required. And we saw this with the consent framework during our token
2:18 acquisition process in previous modules. Temporarily unavailable.
2:22 Retry the request in this instance the client application might explain to the user that the response is delayed because of a temporary condition.
2:30 Some of these errors will be client specific whereas others will be api
2:35 And back end specific. In the case of our Azure Active directory secured fast API A client making a request will receive a response with either 401 or
2:44 403 http status code. If an authentication or authorization error occurs. So what do these errors really mean 401 unauthorized.
2:54 Although the HTTP standard specifies it as unauthorized semantically this response means unauthenticated.
3:01 That is the client must authenticate itself to get the requested response.
3:06 It could also mean that even though a client previously authenticated the access token in the
3:10 present request has expired and therefore the client needs to re authenticate. 403 forbidden
3:15 A 403 error means that the client does not have access rights to the content. That is it is unauthorized.
3:23 So the survey is refusing to give the requested resource. Unlike 401 unauthorized, the client's identity is known to the server.
3:31 Our library will look at the scope and role claims as well as the audience claim to confirm that the authenticated client,
3:37 either a user or an application has given consent to access the target resource and that the appropriate roles are present in the token.
3:45 The nice thing for us securing our fast API with Azure Active directory is that the
3:50 Microsoft library used while this courses designed to handle the authentication and authorization flow and
3:56 generate the appropriate error message. All we have to do in our API is to
4:01 send this back to the clients so that they can take the appropriate corrective action on their end.