Can you point me to best practice documents and/or examples for what a webapi protected by OAuth Bearer Tokens should do with the Bearer Token to ensure it is valid?
I have succeeded in doing this in ASPNET with some magic OWIN middleware:
}
However my app is in Java. I have to make sure that my JSP application is doing the correct steps to validate the received token. This boils down to a Filter in the JSP app that does whatever the OWIN middleware does; I need to find out what that is! :-)
I am assuming that the WebApi (in JSP) needs to reach out to Azure AD and ask it whether the token is valid, for which I am looking at AcquireTokenByAuthorizationCode as a good candidate.
So in short; how would I write an equivalent function to UseWindowsAzureActiveDirectoryBearerAuthentication from OWIN middleware?