Azure Application to authenticate users - azure

Question

I’m trying to create an .NET console application to authenticate users for an Azure function app. I want to authenticate users using their AD credentials and then create a token based on that. I believe I need to enable “Public client flows” in order to achieve this. I’m pretty new to this, but after many failed attempts I managed to get it working after setting the Application ID URI and the scope in the “Expose an API” section. I believe the manifest refers to this property as “identifierUris”. An according to some findings both public access and identifierUris cannot be used at the same time.
Is there an alternative way to achieve this? Any explanations or reasonings as to why this is not ideal would be appreciated as well.
This is the code we're using to retrieve the token and use it:
var publicClient = PublicClientApplicationBuilder
.Create(clientId)
.WithAuthority(authorityUri)
.WithRedirectUri(redirectUri)
.Build();
var accessTokenRequest = publicClient.AcquireTokenInteractive(scopes);
var accessToken = await accessTokenRequest.ExecuteAsync();
restRequest.AddHeader("authorization", "Bearer " + token);
This is the Pulumi code creating the Azure AD Application, where functionApp is the Pulumi.Azure.AppService.FunctionApp that we are trying to authorize against:
var azureApp = new AzureAD.Application(name, new AzureAD.ApplicationArgs
{
DisplayName = name,
AvailableToOtherTenants = false,
Homepage = "https://VisualStudio/SPN",
Oauth2AllowImplicitFlow = true,
ReplyUrls = { "http://localhost" },
IdentifierUris =
{
functionApp.DefaultHostname.Apply(dnsName => "https://" + dnsName)
},
PublicClient = true
}, new CustomResourceOptions {DependsOn = functionApp});
When PublicClient is set to false, this deploys fine. When it is set to true, the the underlying API call returns a 400 error with this text:
Property identifierUris is invalid
So we set PublicClient to false and then manually update it to true in the portal, which works fine:
What are we missing?

Answer 1

You don't need to set PublicClient to true because it applies to ROPC flow, Device Code Flow or Windows Integrated Auth flow as your screenshot shows.
But according to your code, I think you are not using any the three auth flows.
You should create a new app registration which represents the API/server side (your Azure function app) and do "Expose an API".
Add the scope/permission (exposed by the API/server side) in your app registration which represents the client side (.NET console application).
To use PublicClientApplicationBuilder, you just need to modify "allowPublicClient": true in the manifest file of the app registration of the client side. Don't add any IdentifierUris or set the Application ID URI and the scope in the "Expose an API" section because this should be done in the app registration which represents the API/server side.