Azure API Management with Function App

2
votes

I have a function App with API definition setup to function, and the function works when tested with API key in the API definition. I wanted to set up API management with the Azure function App, and found reference of similar setup in the link https://blogs.biztalk360.com/using-api-management-protect-azure-functions/. It mentioned the setting of "x-functions-key" header with API key in inbound processing, as a key thing, otherwise APIM will shows 401 error. I had followed the similar setup, but still the authentication with function app fails with 401 in the APIM. Any pointers, which was missed in the above link which would be helpful to troubleshoot is appreciated

1
azureazure-functionsazure-api-management
Could you share your policy document and trace you get calling this API from developer portal? – Vitaliy Kurokhtin
The policy for the API is below: <policies> <inbound> <set-backend-service id="apim-generated-policy" base-url="testfunctionapp1.azurewebsites.net" /> <base /> <set-query-parameter name="Content-Type" exists-action="override"> <value>application/json</value> </set-query-parameter> <set-query-parameter name="x-functions-key" exists-action="override"> <value>68GdGv6aHkai5gwasgvdanwXKaPGMrBHXIamDhCnlZJqDgzuvxY8g==</value> </set-query-parameter> </inbound> <outbound> <base /> </outbound> <backend> <base /> </backend> </policies> – Satheesh
Ok. The best way to test it would be to use developer portal console to make a call to this API. Along with response it will produce trace that would identify where exactly 401 is coming from. When you make a call to API do you pass API subscription key? – Vitaliy Kurokhtin
Just notices, you're saying x-functions-key is a header, but you're adding it as a query to request. – Vitaliy Kurokhtin
Thanks, You are right. It seems I was adding x-functions-key in query parameters section instead of headers in APIM inbound processing. Replacing with "code" in query param section, or adding in header section both worked fine. – Satheesh

1 Answers

2
votes

The functions key need to be passed as "code" in query parameters, or "x-functions-key" in HTTP headers. Hence in the inbound processing of API management, we if we add in query section, we need to use code, or if we use header section, we should set x-functions-key

Reference: https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook#api-key-authorization