Multi-login REST API question

[ThePridestalker]

Hello again, I'm working on a REST API that works with DynamicsWebApi, but before we put it online, I have to make sure that people from outer the Azure Active Directory can't do requests. Is there a way that I can do dynamic logins without the other apps that make requests through my api having to send me their username and password at every request?

//acquireToken function
//call a necessary function in adal-node object to get a token

//these username and password are dynamic
    adalContext.acquireTokenWithUsernamePassword(resource, username, password, clientId, adalCallback); 
}
~~~~~~~~~~~~~~~~~~~~~~

//create DynamicsWebApi object
var dynamicsWebApi = new DynamicsWebApi({
    webApiUrl: 'https://myorg.api.crm.dynamics.com/api/data/v9.1/',
    onTokenRefresh: acquireToken
});

Could you give me a better approach? Maybe there is a correct way to do this that I'm missing

[AleksandrRogov]

@ThePridestalker I do not understand your question completely, but it feels like you will need to research it more somewhere else, I am not going to teach you how to make authentication for your application.

[ThePridestalker]

Mmm, the normal way of authenticating is sending the Oauth token in the request, but in this case I'm asking how can I pass the token into the dynamicsWebApi instanciation instead of running the acquireToken function again.

[AleksandrRogov]

@ThePridestalker you can pass any token you want, you can even cache it and use the same token over and over again until it expires, technique is always the same. You have full control over what token you send to DynamicsWebApi. Basically, DynamicsWebApi only requests the token from you by calling "onTokenRefresh" callback, you can return anything you want in that function.

[ThePridestalker]

In the end I found this https://www.npmjs.com/package/passport-azure-ad , which valitdates the token against Azure. That was mainly my problem, since I didn't know how to verify the token, and this also helped me:

DynamicsWebApi only requests the token from you by calling "onTokenRefresh" callback, you can return anything you want in that function.

I have no more doubts so I close the issue.