How to protect API without end user to login with AD Account in Azure?

0
votes

I would like to know how (or if this is possible) to make use of Azure API Management Service with OAuth without user to be registered with Azure AD Account and consume the backend API

I followed the sample https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad and everything works fine.

This sample uses Azure Developer Console as Client App. However, if I want to use my own Client app for authentication, does it mean that my client app needs to be hosted under a server with OAuth ability?

Is that possible for my client app to use "Service Account" to login to Azure Active Directory as a user so that the client app can consume protected APIs?

1
oauth-2.0azure-active-directoryazure-api-management
What do you mean about the "service account"? – SunnySun
I mean something like what I can do in IIS, setting up an AD user account being used in the application pool so that AAD and Azure API management deal with that service account to authorize the client to consume backend api? Is that possible and if yes, is that a good approach to do this? – Benny Chan
I just edited my question title to be more specific – Benny Chan

1 Answers

1
votes

APIM itself does not care whether any given OAuth server is AAD or not. There are three things in APIM that are related to OAuth.

First is Dev portal signin. One can setup Dev portal to authenticate users via AAD, Facebook, Google e.t.c. With this setting APIM will contact required auth server to validate user identity. This is only needed if you want your users to authenticate with dev portal using some auth server.

Then there are OpenID and OAuth servers registration, and linking of them to APIs. This is purely for documentation purposes. You do this to show that your backend (not APIM) requires an Oauth token from a certain OAuth server. Dev portal in it's part will render a UI in dev console to obtain such token and call APIM proxy with it. This can be used with any OpenId/OAuth server, not necessary AAD. And you do not need to host any app, the registration is done purely to obtain client id and client secret, so that when Dev portal makes call to auth server to obtain token for user it is allowed to do so. This is only needed to render UI on dev console that will allow users to easily obtain tokens to make a call to your service. Does not affect runtime request processing in any way.

Finally there is validate-jwt policy this is the only OAuth related runtime bit in APIM. This policy can be configured to extract JWT token from a request and check it for certain claims to make a decision whether a calling party is authorized to make a call or not. This does not require any other setup to work, just placing policy in pipeline is enough. But you may want to setup auth server as well, as without it dev console will not work by default.