title: Authorize one app service from another (no user interaction) in ASP.NET Core 2.0
body: <p>I have a Web API app in Azure facing internet (PubWeb), so it's used from anywhere. And I created a Web API (again, in Azure, let's call it InWeb). And I want strong security rules:</p>
  
  <ol>
  <li>InWeb must be used only by the PubWeb. This might involve some network security - that's an easy part (in Azure).</li>
  <li>PubWeb must be authorized by Azure AD somehow in order to use InWeb services. Service Principals, certificates, etc comes to mind. But I'm not sure.</li>
  </ol>
  
  <p>So what's the best possible solution for 2?</p>
  
  <p><strong>UPDATE</strong> - here's InWeb Core 2.0 Auth setup:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddAuthentication(sharedOptions =&gt;
      {
          sharedOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
      })
      .AddAzureAdBearer(options =&gt; Configuration.Bind("AzureAd", options));
  
      services.AddMvc(options =&gt; { options.InputFormatters.Add(new TextPlainInputFormatter()); });
  }
  </code></pre>