Is it possible to enable Managed Identity between Azure function and Azure Web API?

Question

I am currently using Basic authentication between Azure Function and Web API .This is not secure, hence I was searching for an alternative and found the managed identity feature in Azure. However, I do not see this feature can be enabled between Web API and Azure function.

Note: We can enable between Azure Function and KeyVault but not between web API and azure function.

Looking for a solution like below

Answer 1

I have enabled Easy Auth for my app service:

You can find its client ID in advanced blade:

So we need to get an access token for this resource to call APIs, just try the code below(I assume you have enabled Managed identity for your function):

#r "Newtonsoft.Json"

using System.Net;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Primitives;
using Newtonsoft.Json;

public static async Task<IActionResult> Run(HttpRequest req, ILogger log)
{
    log.LogInformation("C# HTTP trigger function processed a request.");
    var endpoint = Environment.GetEnvironmentVariable("IDENTITY_ENDPOINT");
    var identity_header = Environment.GetEnvironmentVariable("IDENTITY_HEADER");
    //chnage your client ID value here.
    var resource = "4df52c7e-3d6f-4865-a499-cebbb2f79d26";
    var requestURL = endpoint + "?resource=" + resource + "&api-version=2019-08-01";

    HttpClient httpClient = new HttpClient();
    httpClient.DefaultRequestHeaders.Add("X-IDENTITY-HEADER", identity_header);
    HttpResponseMessage response = await httpClient.GetAsync(requestURL);
    response.EnsureSuccessStatusCode();
    string responseBody = await response.Content.ReadAsStringAsync();
    var access_token = JsonConvert.DeserializeObject<TokenResp>(responseBody).access_token;

    //After get access token for app: 4df52c7e-3d6f-4865-a499-cebbb2f79d26, call the API that protected by it
    //chnage your api url here.
    var APIURL = "https://frankapp.azurewebsites.net";
    HttpClient callAPI = new HttpClient();
    callAPI.DefaultRequestHeaders.Add("Authorization","Bearer "+ access_token);
    HttpResponseMessage APIResponse = await callAPI.GetAsync(APIURL);
    //check the response code to see if called the API successfully.
    return new OkObjectResult(APIResponse.StatusCode);
}

public class TokenResp {
 public string access_token { get; set; }
 public string expires_on { get; set; }
 public string resource { get; set; }
 public string token_type { get; set; }
 public string client_id { get; set; }

}

Result:

Answer 2

Hi i can see you asking exchange between of Azure Function and Web API , in theory, it should be your resource server(Apis) rather than managed identity. There are concept around on-behalf auth/client grant credential on top of Azure AD. You may follow this learning tutorial Build Azure functions with Microsoft Graph , and start thinking how would you want your identity flow looks like - simple way is to using on-behalf to azure functions and web api, the access token assertion are implemented in common classes for both.