Azure API 管理：如何使用 Microsoft Identity 对后端进行身份验证？

Question

We host a .net WebAPI webapp in Azure. The webapp uses Microsoft Identity/OAuth2 for authentication. For some tests, we authorized some users for the WebAPI. This works as expected.

Now we added Azure API Management as a front proxy for our WebAPI webapp. We added all endpoints but we're unable to enable the API Management to use the backend WebAPI, because it's unauthorized by nature. And we don't know how the API Management can access it, since it has no identity as we know that we could authorize.

How does this need to be done?

Answer 1

You can achieve this be enabling Managed Identity on APIM .

Then you can use this MI in a policy to inject a JWT on backend requests.

<authentication-managed-identity resource="resource" client-id="clientid of user-assigned identity" output-token-variable-name="token-variable" ignore-error="true|false"/>  

https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies#ManagedIdentity