0

I have created a Web API using .net core 5. I have secured the app using the Microsoft Identity platform. Clients app are able to get to the resource based on their scope/role. So I know that my api is secure.

Now, I need to add the API to Azure API Management tool. So my question is should I enable OAuth from the Azure API Management to secure my web api even though my app is already secured?. What would be the reason that I enable OAuth from API management?

Jashvita
  • 553
  • 3
  • 24

1 Answers1

1

APIM is a proxy to the backend APIs and implementing security mechanisms to give an extra layer of security to prevent unauthorized access to APIs is a recommended practice.

Configuring OAuth 2.0 Server in APIM merely enables the Developer Portal’s test console as APIM’s client to acquire a token from Azure Active Directory. In the real world, customer will have a different client app that will need to be configured in AAD to get a valid OAuth token that APIM can validate.

OAuth is an authorization framework which allows a recognized client to acquire an access token from an authorization server.

As given in this Microsoft Doc, the Microsoft Identity Platform uses the OAuth 2.0 protocol for handling authorization.

Please find below references makes you how OAuth secures the Web APIs/Services:

  • So are you saying as far as Using the OAuth in APIM vs Microsoft Identity to secure the app doesn’t enhance security. But APIM itself provides the additional layer of security. So is that okay to continue to use Microsoft Identity that was implemented outside of APIM? Also like Haider said the calls to api would go through APIM and filter rather than going directly to the API. So what would your input on my understanding? Another question, can I choose not to use to implement OAuth in APIM and leave my API as is which is already secured by using the Microsoft Identity? – Jashvita Jun 15 '22 at 09:43
  • Managed Identity feature provided by Microsoft allows your APIM APIs to securely access the other AD protected resources. So, it's better to use the Managed Identity feature provided by Microsoft. –  Jun 15 '22 at 11:04