The development sign-in from the last lesson believes every name. For the office, the Kladde needs a real sign-in. It could store passwords itself for that. It doesn't: it leaves the sign-in to Microsoft Entra ID, the directory where most companies keep their accounts anyway, and gets the confirmation from there of who has signed in. The protocol for that is called OpenID Connect.
In this lesson you first understand the flow and read a token. Then you register the Kladde in your own Entra tenant, sign in and out again, and prove that the app's secret was never in the repository.
Why not your own passwords
An app that stores passwords takes on a lot of duties:
- It has to store passwords so that they're unreadable even after a data breach.
- It needs “forgot password,” a lockout after failed attempts and a second factor.
- When someone leaves the office, someone has to remember to lock this account too.
An identity provider like Entra ID does that in one place for all of a company's apps. The person signs in there, with a password, an authenticator app or a passkey, and the app learns only the result. If the company locks an account, the person can't get into any of these apps anymore. If they're already signed in to Entra, for Outlook say, they get into the Kladde without typing anything again. That's called single sign-on.