apimanagement-authorizations's Introduction

Azure API Management Authorizations (preview) 🚀

Introducing API Management Authorizations 🗝️ - Simple, Distributed, Secure, Managed Token Store

Overview 🎁

API Management Authorizations greatly simplifies the process of authenticating and authorizing user's across one (or) more SaaS services 👍. It reduces the development cost in ramping up, implementing and maintaining security features with service integrations 💰.

Configure OAuth, Consent, Acquire Tokens, Cache Tokens and Refresh Tokens for multiple-services without writing a single line of code. Let API Management do all the heavy lifting for you, while you focus on the application/domain logic.

To get more information, please visit the official Azure documentation here.

Scenarios 🧰

Here are some example scenarios where this feature could be used:

Easily connect to SaaS backend by attaching the stored Authorization Token and proxying requests.
Proxy requests to a Azure AppService WebApp (or) Azure Functions backend by attaching the Authorization Token that can later send requests to SaaS backend applying transformation logic.
Proxy requests to GraphQL federation backends by attaching multiple access tokens to easy perform federation.
Expose a retrieve token endpoint, acquire cached token and call the SaaS on-behalf of user from any compute, say Console App or Kubernetes Demon. Combine your fav. SaaS Sdk in a supported language.
Azure Functions unattended scenarios is a breeze while connecting to multiple SaaS.
Durable Functions gets a step closer to Logic Apps with SaaS connectivity.
Every API in API Management can act as a Logic Apps Custom Connector.

Identity providers 🛡️

Checkout the list of supported identity providers here.

Do not see your favorite identity provider? Try out the "Generic Oauth2" identity provider. With the Generic OAuth 2.0 provider, it’s possible to connect to any identity provider that supports authorization code and follows the OAuth 2.0 standard. For example, try with Pinterest and/or Eventbrite

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

apimanagement-authorizations's People

Contributors

Stargazers

Watchers

apimanagement-authorizations's Issues

when is this GAed?

Hi there, any plans to GA this product?

Policy inside aad-cc.bicep seems not correct

Thanks for this amazing project to help me understand how authentication works inside APIM!

Here is policy inside aad-cc.bicep file:

<inbound>
    <base />
     ...
    <set-variable name="uri" value="@{
      string oid = &quot;&quot;;
      string token = ((Authorization)context.Variables.GetValueOrDefault(&quot;auth-context&quot;))?.AccessToken;
      Jwt jwt;
      if (token.TryParseJwt(out jwt))
      {
          oid = jwt.Claims.GetValueOrDefault(&quot;oid&quot;, &quot;empty&quot;);
      }
      return &quot;/v1.0/users/&quot; + oid;
  }" />
  <rewrite-uri template="@((string)context.Variables[&quot;uri&quot;])" copy-unmatched-params="false" />
</inbound>

This policy is extract object id from access token, I am not sure what the oid inside access token stand for, and I got 404 error when use this policy. (tip: my tenant of the AAD is different from where APIM hosted)

I think the policy show be as below to obtain oid from query parameter objectid, if objectid is empty, it will list all the users inside the tenant:

<rewrite-uri template="@("v1.0/users/" + context.Request.Url.Query.GetValueOrDefault("objectid",""))" copy-unmatched-params="false" />

Azure B2C as Identity Provider

Hi,
I want to use Azure B2C as Identity Provider and use "Generic Oauth2 with PKCE" but when I make the call for Login I get following error message:

"OAuth2 authorization flow failed for service 'Generic Oauth 2 with PKCE'. OAuth 2 sign in failed to exchange code for access token. Client ID and secret sent in form body.. Response status code=BadRequest. Response body: {"error":"invalid_request","error_description":"AADB2C90084: Public clients should not send a client_secret when redeeming a publicly acquired grant."

I wanted to know if Azure B2C is supported and may can you provide me an example link for the setup?

For your feedback in advance many thanks.

Best regards
Ercan

Recommend Projects

azure / apimanagement-authorizations Goto Github PK

apimanagement-authorizations's Introduction

Azure API Management Authorizations (preview) 🚀

Overview 🎁

Scenarios 🧰

Identity providers 🛡️

Contributing

Trademarks

apimanagement-authorizations's People

Contributors

Stargazers

Watchers

Forkers

apimanagement-authorizations's Issues

when is this GAed?

Policy inside aad-cc.bicep seems not correct

Azure B2C as Identity Provider

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent