I am developing an application for my company with the following parameters & components:
- These applications shall only be available to our employees. All employees have Windows 10 laptops which have been joined to our company's Azure AD.
- We do not have an on-premise ADFS server. We are 100% cloud.
- The application will use Azure resources in it's business logic, such as Graph API.
- The application will also use other 3rd party resources, such as our company Dropbox.
- Authenticating to "the application" should also authenticate against all other 3rd party applications (like Dropbox) as seamlessly as possible.
- Today we have 10s of employees. It is highly unlikely we will have more than 50 employees in the next couple years, when this app will rev to version 2 and I will hire someone to build it.
The time has come to implement Authentication and Authorization for our application. The application should both Authenticate and Authorize against Azure AD. The ideal scenario is that a user logged in to the company laptop should be auto-magically authenticated on the application, and that users on another machine (think airport or hotel kiosk) would login using their Azure AD credentials.
My question is around which OAuth2 grant flow should be used in this scenario.
I have read a number of articles from Microsoft and OAuth, gone through a number of Udemy classes etc, and gotten conflicting advice from these sources. Some suggest that SPA's should use an implicit grant, while others say that if there is business logic on a backend server (and there is/will be) that a Client Credentials Grant should be used.
I'm a highly experienced developer, but I'm no security expert. In my perfect world I would outsource the design and implementation of the authentication piece of this app to someone who is a security expert, but budget is a major restriction here. It is simply not feasible to spend thousands of USD to have someone build this for us at this stage.
All this being said, given the design and architecture laid out above, how should authentication be implemented? Which grant flow should be used?