The OBO flow

The OBO flow (which is not part of standard OAuth 2.0 (IETF) but is specific to Microsoft Azure Active Directory implementation) is used to allow a resource server to call another resource server in the background without any user interaction. This is useful when there are two resource servers, usually managed by different parties, that trust the same authorization server and contribute to the logic of a single application, and need to be used in the background seamlessly. To allow a resource server to use the OBO flow, the authorization server must be properly configured.

Figure 4.7 – OBO flow

The diagram is explained in detail as follows:

1. The client application requests an access token to the authorization server using the authorization code grant flow or another authentication flow, as described in the previous paragraphs.
2. The authorization server validates the request and issues an access token to the client application.
...