I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes cluster running on Linux OS.
We use AzureAD for getting regular users on the web app, and I know there is a device code login that could work. My problem is that the user needs to do the two factor auth manually when the token expires and I don't want this to happen during the night when everyone is sleeping and the document collection workers to stop working.
The worker machines can't be on Azure due to software and hardware that is required to run it. I was thinking to store a certificate on azure key vault and then create jwt tokens with the client and use the same certificate to verify that token. I feel there must be a best practice for this, but I don't know?
I think we could run the machines and the server inside a VPN, but I would like an extra layer of security for the API calls. If there was a way to use Windows AD for this that would be great, but I am unable to find a recommendation for this scenario.