Service to service auth via Azure Active Directory with ASP.Net Core

Sample configuration for ASP.Net Core 1.1 to use Azure AD for Service to Service Authentication.  Update your Startup.cs to have the following

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication();
    ...
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    app.UseJwtBearerAuthentication(new JwtBearerOptions
    {
        Authority = "https://login.microsoftonline.com/{AAD Tenant Name or ID}",
        Audience = "{Application ID URL}"
    });
    ...
}

Microsoft.AspNetCore.Authentication.JwtBearer defaults to using OpenID Connect discovery document to validate the bearer token.

The Authority is the prefix for the the discovery document.  The middleware will append ".well-known/openid-configuration/" to whatever you pass in to the Authority.  If your IDP has a diffrent endpoint for the discovery document, you can specify the MetadataAddress option, that address will be used without appending anything to it.  For Azure AD, the discovery documents are located at https://login.microsoftonline.com/{AAD Tenant Name or ID}/.well-known/openid-configuration/, if your unsure that your AAD Tenant Name is, the Tenant Id (or Directory ID as it's called in the new Azure Portal) works as well.

The Audience is our Application ID URI, this is the same as the resource in the token request.

There is also a sample project on Github at https://github.com/aspnet/Security/tree/release/samples/JwtBearerSample

This changed in ASP.Net Core 2

See https://github.com/aspnet/Security/issues/1310 for updates.  The new way is:

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(options =>
        {
            options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        })

        .AddJwtBearer(options =>
        {
            options.Authority = "https://login.microsoftonline.com/{AAD Tenant Name or ID}";
            options.Audience = "{Application ID URL}";
        });
    }

    public void Configure(IApplicationBuilder app)
    {
        app.UseAuthentication();

        // ...
    }
}