A native application should *never* use a client secret. Even if it's a compiled application, it is not considered a confidential client and should never have, hold or use a secret key. The only applications that should use this are hosted
applications, where the user never has access to the code/binaries, only the interface (i.e. a web app or a web API).
You *can* get a token to a native client app when you don't have a secret key. Have you been unable to do so?
If you have multiple confidential clients (remember, hosted apps, not installed client applications) where it is logical to group them under one application, you can give them each a different secret key (and they all use the same client ID). Then, you can
revoke access to individual clients if needed.
Anyway, it sounds to me that you should do the following:
- Add a web app/web API: this is the resource that you will protect (e.g. a hosted application that does something)
- Add a native client app: this is going to represent the client application (e.g. a phone app, a desktop client app or a browser-side client app).
Once you've created the two apps in your directory, you need to add an app permission to the web API. A recent update allows you to define this in the manifest file. Download the wep API's manifest file, and edit it to add an "appPermission" entry
like this (replace the highlighted fields with your own text, and your own
generated GUID for permissionId):
"appPermissions": [ {
"claimValue": "user_impersonation",
"description": "Allow the application full access to the Test Web API service on behalf of the signed-in user",
"directAccessGrantTypes": [],
"displayName": "Have full access to the Test Web API service",
"impersonationAccessGrantTypes": [
{
"impersonated": "User",
"impersonator": "Application"
} ],
"isDisabled": false,
"origin": "Application",
"permissionId": "60e76a46-af27-4d3b-bbd2-ac74206346a5",
"resourceScopeType": "Personal",
"userConsentDescription": "Allow the application full access to the Test Web API service on your behalf",
"userConsentDisplayName": "Have full access to the Test Web API service"
} ],
- Note: 'resourceScopeType' should be "Personal" if it's something that each user should consent to, or "Global" if it's something that applies to the entire tenant, (and thus, an administrator would have to consent to).
- Note: Your web API code is where these permissions are enforced, if you have more than one. The 'scp' claim in the JWT token will have the 'claimValue' from the 'appPermission'.
Once you've uploaded the manifest file for the web API's app, when you go to the 'permissions to other applications' section of any other app, you will have an entry in the drop-down menu which refers to the "appPermission" you just added.
Now, in you native client app, you should state that the native client app (i.e. any client app identifying themselves with that client ID), should have access to your web API. So, when a user logs in, they will eventually be asked to consent to this.
