API Management is an awesome API gateway with functionality to really excell in exposing API’s to consumers. When it comes to security there are several options and today we will look in to the OAuth. In order to do this we need an IDP (Identity Provider) that we can configure a trust releationship with.
An Identity provider is a service that a user/application is signing in to (just like Azure AD) and this provider has functionality to provide needed information and grant access to requested resources that the IDP is handling. Just like the fact that you have access to a resource or resource group inside your subscription in Azure.
In API Management a trust to an IDP and creation of a validation of the JWT provided from the IDP is done easily via the restrict policy called validate-jwt
Let’s go thur how the setup looks like, we will need to set up a Trust between your API Management instance and your Auht0 instance.
I’ve created a video that will go thru all of this a link is provided bellow.
Links used in the video:
- Validate JWT Token
- Auth0 Openid Configuration url: https://YOUR_AUTH0_DOMAIN/.well-known/openid-configuration
Summary:
Adding a second security layer like this increases security and as you will see later on flexibility. It’s an awesome start in order to build a nice consumer experience for your API’s. In API Management it’s very easy to attach any IDP so you can pick and choose your favourite and the setup will be somehwat similar.
For more great content, check out the Resource Centre
My specialty has always been on integrating systems and during the past years cloud integration on the Azure platform has been the main focus.
Today you can find me in various roles, all from developing tools to improve the developer experience for developers with the Azure platform to drafting integration architecture for enterprise hybrid/cloud customers. Implementing these architectures by leading development teams and doing inspiration sessions at clients to promote new way of thinking and introduce new Azure services. My experience in the Azure platform and specificly the Integration Area and the love I have for sharing my findings and knowledge has lead med to be awarded by Microsft with a Most Valuable Professional (MVP) since 2017.
I also run the Integration User Group in Sweden (local events in Stockholm and Gothenburg) and I like talk to new people so if you have used my blog or see me at a conference or on social medias, stop me and say ‘hi’.
Reference:
Lögdberg, M. (2020). Setup Auth0 with API Management. Available at: https://mlogdberg.com/blog/2020/05/setupauth0withapim [Accessed: 16th May 2021].
