Does not use the ClientSecret value

[AjmalVh]

I can see, this sample does not uses the ClientSecret from AzureAdOptions. Few other samples, for example this one, uses ClientSecert. What is the difference here?

[jmprieur]

@AjmalVh : this sample is a Web App which lets the user sign-in, but does not call any Web API.
The dotnet-webapp-webapi-openidconnect-aspnetcore sample is a Web App which let's the user sign-in and then calls a Web API in the name of the user, using ADAL.NET's on behalf of flow.
When Web Apps or Web APIs call another Web API, as they are confidential clients applications, they need to provide an application secret which was previously share with Azure AD.

[AjmalVh]

Crystal clear 👍 Thanks @jmprieur