Securing Your APIs in Azure API Management with OAuth

hello and welcome to my YouTube channel in this video we are going to learn about protecting your apis in Azure API

management using oauth by end of this tutorial you will be able to secure your apis in Azure API management with oauth

so it can be accessible only by authorized users before we begin let me give you a quick

intro to Azure API management and oauth Azure API management is a fully managed service that helps you create publish

and manage apis for your applications it provides you with various tools and features to make sure your APS are

secure scalable and easy to use I have made a series of videos on Azure API management I will leave the links in

the description below you can go over there now let's talk about oauth oauth is an open standard for authorization

which allows third-party applications to access your apis securely without sharing user credentials

by using oauth you can provide granular access to your apis ensuring only authorized users and applications can

access your protector resources now let's look at the watch flow in the workflow the client never uses the

username and password to access the backend API instead he uses the access token which is obtained from the

identity provider client passes client ID and client secret to the identity provider to obtain the access token this

access token is passed to API management then the API management validates the access token against the identity

provider if the access token is valid the request is served otherwise the request is denied now let's look at this

in the demo I'm in my Azure portal I have already created couple of resources I have created Azure API Management

Service I have also created a simple API Azure function which returns a simple Json response message this will act as a

backend API for our demo which will be fronting with Azure API management and we will protect this backend API using

the oauth to begin with first what we have to do is we have to register the client applications for that go to Azure

active directory in app registration first we have to register two applications the first application which

represents Azure API management let's name it as API this application represents the actual apim results leave

everything to the default and register we have the resource application ready now go to expose API and set the

application ID URI hit save and copy the URI for the letter use and go to the app roles just let's create some app roles

in our case we are simply reading the message so it's like a reader an application and the value will be the

reader these role details will be passed to the backend API as part of your access token reader and apply okay we

have an application ready which represents the actual API now let's create another application for the

actual client just want to call it as apim iPhone user leave everything to the default and click on create we have

another application ready go to apa permissions add permission missions assign the permissions on our backend

API yes we wanted to give the reader access here for your backend API you have apim iPhone resource application

which represents actual backend API and it has certain roles now you can have a different application registered for

different consumers and you can select the permissions differently for reach consumers this permission will be passed

as part of the access token to your backend API add permissions just don't forget to Grant admin consent because we

are using Azure API management we also need to give access to Microsoft graph application permissions scroll all the

way to the down all it needs is user read and write read all right all just add permissions and Grant admin concept

here as well yeah that's all done now the next thing we need is we have to create a client cycle rate client will

use his client ID and this secret he will pass this information to the authorization provider our identity

provider to obtain the access token let's create a client secret description can be secret simply and leave

everything to the default click on ADD so we have the secret ready just make sure you copy it because once it is gone

it is gone you can't access it again now if you go to the overview you have the client ID as well just grab the client

ID we're going to pass the client ID and client Secret to obtain the access token we have the

client registered we have the backend app registered now if you go to API management apis let's add our backend

API as one of the API here we can directly pick it from the function app because it's a function app browse in

the search filter in facto select sample API select create we have the sample API added here we can simply go here and do

a quick test to see if it works yes this is working HTTP 200 okay and we got the message now to protect this API using

oauth what we can do is go to the design and in the inbound policy we can add a policy to enable the what all we have to

do is we just have to add this piece of the policy in the inbound policies this will enable the oauth authentication

what this policy will do is this policy will look for authorization position header barrier token and validate the

token against the identity provider we can also configure this in the name value collection if you want we can

simply maybe cut this and say appco and save it and go to the name value add a name value

is our scope we have added app scope as a name value and if we go to our API and Factory API sample API now we have

successfully configured oauth to protect this backend API let's test our changes let's bring up the postman so let's

obtain the token to obtain the token as we have used Azure active directory as an identity provider this is the token

in point and this is your tenant ID we have to pass the grant type as client credential because it is just to protect

the backend API and we need just access token and we pass the client ID and client and secret of the consumer then

the scope this is the apim resource scope which we have registered initially so we have to pass the scope this is the

API M scope if you hit send we should be able to retrieve the access token yes we got the access token if we use this

access token we will be able to access our Azure function if I go back to our API management and test console here

let's see what happens if we hit send directly without passing the access token now that we have configured it

with the JWT token it should validate so it should come back with 401 unauthorized because we haven't passed

any access token 2 to access the API let's pass the access token now in headers we add it as an authorization

header authorization and the value is Bearer space your actual token and hit send we are able to successfully access

the Azure function Now by passing the barrier token if you mess up the barrier token for example let's say just to

prove the point just put in something here and you just hit send and boom it will fail 401 so it will validate your

access token against the identity provider in our case Azure active directory and when the token is valid

that is when it will allow the or it will pass the request to the backend API we you can even inspect the access token

using if you go to um JWT slash Ms you can simply is inspect your access token see it has our

scope and all the information even the roles and everything the backend API the role information is passed to the

backend API the backend API can use this role information for further processing if you like the content Please Subscribe

like comment and share the video I will catch you in the next one until then this is signing off thank you