How UseWindowsAzureActiveDirectoryBearerAuthentication validates the Azure Active directory Bearer token?

Question

I'm working on AzureAD authentication in web API. Every thing is working fine for me. I'm curious, how below piece of code validates the Azure Active directory Token.

app.UseWindowsAzureActiveDirectoryBearerAuthentication(
    new WindowsAzureActiveDirectoryBearerAuthenticationOptions{
        Audience = ConfigurationManager.AppSettings["ida:Audience"],
        Tenant = ConfigurationManager.AppSettings["ida:Tenant"]
    }
);

Q1) Will it call the azure active directory for webapi request?

Q2) Will it holds any keys(Private key, public key, etc)? If yes, what are the tokens? How and where?

Q3) How it decrypts the bearer token ?

Q4) Is it secure enough to depend on the chunk?

Answer 1

Q1) Will it call the azure active directory for webapi request?

Yes, it will get the public keys from https://login.microsoftonline.com/common/discovery/keys when the app starts.

Q2) Will it holds any keys(Private key, public key, etc)? If yes, what are the tokens? How and where?

See above, it stores the public keys in memory.

Q3) How it decrypts the bearer token ?

It decodes the token. The tokens are not encrypted, just base64-encoded and digitally signed. The middleware decodes the token and checks the signature is valid using the public key(s) it got earlier.

Q4) Is it secure enough to depend on the chunk?

Basically the setup you have is enough for a single-tenant API. A good idea is of course to define delegated/app permissions in your API's manifest in Azure AD so you can give apps using the API different levels of access to it.