You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| identities | Add this element to specify one or more`identity`elements with defined claims on the client certificate. | No |
67
+
| identities | Add this element to specify up to 10`identity`subelements with defined claims on the client certificate. | No |
68
68
69
69
## identity attributes
70
70
@@ -73,7 +73,7 @@ For more information about custom CA certificates and certificate authorities, s
73
73
| thumbprint | Certificate thumbprint. | No | N/A |
74
74
| serial-number | Certificate serial number. | No | N/A |
75
75
| common-name | Certificate common name (part of Subject string). | No | N/A |
76
-
| subject | Subject string. Must follow format of Distinguished Name, which consists of comma-separated name attributes, for example, *"CN=MyName, OU=MyOrgUnit, C=US..."*.| No | N/A |
76
+
| subject | Subject string. Must follow format of Distinguished Name, which consists of comma-separated name attributes, for example, *"CN=MyName, OU=MyOrgUnit, C=US..."*.| No | N/A |
77
77
| dns-name | Value of dnsName entry inside Subject Alternative Name claim. | No | N/A |
78
78
| issuer-subject | Issuer's subject. Must follow format of Distinguished Name, which consists of comma-separated name attributes, for example, *"CN=MyName, OU=MyOrgUnit, C=US..."*. | No | N/A |
79
79
| issuer-thumbprint | Issuer thumbprint. | No | N/A |
You can secure WebSocket APIs by applying existing access control policies, like [JWT validation](validate-jwt-policy.md). You can also test WebSocket APIs using the API test consoles in both Azure portal and developer portal. Building on existing observability capabilities, API Management provides metrics and logs for monitoring and troubleshooting WebSocket APIs.
20
+
WebSocket APIs can be secured by applying API Management's [access control policies](api-management-policies.md#authentication-and-authorization) to the initial handshake operation. You can also test WebSocket APIs using the API test consoles in both Azure portal and developer portal. Building on existing observability capabilities, API Management provides metrics and logs for monitoring and troubleshooting WebSocket APIs.
21
21
22
22
In this article, you will:
23
23
> [!div class="checklist"]
@@ -39,25 +39,25 @@ API Management supports WebSocket passthrough.
39
39
40
40
:::image type="content" source="./media/websocket-api/websocket-api-passthrough.png" alt-text="Visual illustration of WebSocket passthrough flow":::
41
41
42
-
During the WebSocket passthrough the client application establishes a WebSocket connection with the API Management Gateway, which then establishes a connection with the corresponding backend services. API Management then proxies WebSocket client-server messages.
42
+
During the WebSocket passthrough, the client application establishes a WebSocket connection with the API Management gateway, which then establishes a connection with the corresponding backend services. API Management then proxies WebSocket client-server messages.
43
43
44
-
1. The client application sends a WebSocket handshake request to APIM gateway, invoking onHandshake operation.
45
-
1.APIM gateway sends WebSocket handshake request to the corresponding backend service.
44
+
1. The client application sends a WebSocket handshake request to the gateway, invoking the onHandshake operation
45
+
1.The API Management gateway applies configured policies and sends WebSocket handshake requests to the corresponding backend service.
46
46
1. The backend service upgrades a connection to WebSocket.
47
-
1.APIM gateway upgrades the corresponding connection to WebSocket.
48
-
1.Once the connection pair is established, APIM will broker messages back and forth between the client application and backend service.
49
-
1. The client application sends message to APIM gateway.
50
-
1.APIM gateway forwards the message to the backend service.
51
-
1. The backend service sends a message to APIM gateway.
52
-
1.APIM gateway forwards the message to the client application.
53
-
1. When either side disconnects, APIM terminates the corresponding connection.
47
+
1.The gateway upgrades the corresponding connection to WebSocket.
48
+
1.After the connection pair is established, API Management brokers messages back and forth between the client application and backend service.
49
+
1. The client application sends a message to the gateway.
50
+
1.The gateway forwards the message to the backend service.
51
+
1. The backend service sends a message to the gateway.
52
+
1.The gateway forwards the message to the client application.
53
+
1. When either side disconnects, API Management terminates the corresponding connection.
54
54
55
55
> [!NOTE]
56
56
> The client-side and backend-side connections consist of one-to-one mapping.
57
57
58
58
## onHandshake operation
59
59
60
-
Per the [WebSocket protocol](https://tools.ietf.org/html/rfc6455), when a client application tries to establish a WebSocket connection with a backend service, it will first send an [opening handshake request](https://tools.ietf.org/html/rfc6455#page-6). Each WebSocket API in API Management has an onHandshake operation. onHandshake is an immutable, unremovable, automatically created system operation. The onHandshake operation enables API publishers to intercept these handshake requests and apply API Management policies to them.
60
+
Per the [WebSocket protocol](https://tools.ietf.org/html/rfc6455), when a client application tries to establish a WebSocket connection with a backend service, it first sends an [opening handshake request](https://tools.ietf.org/html/rfc6455#page-6). Each WebSocket API in API Management has an onHandshake operation. onHandshake is an immutable, unremovable, automatically created system operation. The onHandshake operation enables API publishers to intercept these handshake requests and apply API Management policies to them.
@@ -72,11 +72,11 @@ Per the [WebSocket protocol](https://tools.ietf.org/html/rfc6455), when a client
72
72
73
73
| Field | Description |
74
74
|----------------|-------|
75
-
| Display name | The name by which your WebSocket API will be displayed. |
75
+
| Display name | The name by which your WebSocket API is displayed. |
76
76
| Name | Raw name of the WebSocket API. Automatically populates as you type the display name. |
77
77
| WebSocket URL | The base URL with your websocket name. For example: *ws://example.com/your-socket-name*|
78
78
| URL scheme | Accept the default |
79
-
| API URL suffix| Add a URL suffix to identify this specific API in this API Management instance. It has to be unique in this APIM instance. |
79
+
| API URL suffix| Add a URL suffix to identify this specific API in this API Management instance. It has to be unique in this API Management instance. |
80
80
| Products | Associate your WebSocket API with a product to publish it. |
81
81
| Gateways | Associate your WebSocket API with existing gateways. |
82
82
@@ -108,15 +108,15 @@ Use standard API Management and Azure Monitor features to [monitor](api-manageme
108
108
* View API metrics in Azure Monitor
109
109
* Optionally enable diagnostic settings to collect and view API Management gateway logs, which include WebSocket API operations
110
110
111
-
For example, the following screenshot shows recent WebSocket API responses with code `101` from the **ApiManagementGatewayLogs** table. These results indicate the successful switch of the requests from TCP to the WebSocket protocol.
111
+
For example, the following screenshot shows recent WebSocket API responses with code `101` from the **ApiManagementGatewayLogs** table. These results indicate the successful switch of the requests from TCP to the WebSocket protocol.
112
112
113
113
:::image type="content" source="./media/websocket-api/query-gateway-logs.png" alt-text="Query logs for WebSocket API requests":::
114
114
115
115
## Limitations
116
116
117
-
Below are the current restrictions of WebSocket support in API Management:
117
+
The following are the current restrictions of WebSocket support in API Management:
118
118
119
-
* WebSocket APIs are not supported yet in the Consumption tier.
119
+
* WebSocket APIs aren't supported yet in the Consumption tier.
120
120
* WebSocket APIs support the following valid buffer types for messages: Close, BinaryFragment, BinaryMessage, UTF8Fragment, and UTF8Message.
121
121
* Currently, the [set-header](set-header-policy.md) policy doesn't support changing certain well-known headers, including `Host` headers, in onHandshake requests.
122
122
* During the TLS handshake with a WebSocket backend, API Management validates that the server certificate is trusted and that its subject name matches the hostname. With HTTP APIs, API Management validates that the certificate is trusted but doesn’t validate that hostname and subject match.
@@ -125,7 +125,7 @@ For WebSocket connection limits, see [API Management limits](../azure-resource-m
125
125
126
126
### Unsupported policies
127
127
128
-
The following policies are not supported by and cannot be applied to the onHandshake operation:
128
+
The following policies aren't supported by and can't be applied to the onHandshake operation:
129
129
* Mock response
130
130
* Get from cache
131
131
* Store to cache
@@ -143,10 +143,10 @@ The following policies are not supported by and cannot be applied to the onHands
143
143
* Validate status code
144
144
145
145
> [!NOTE]
146
-
> If you applied the policies at higher scopes (i.e., global or product) and they were inherited by a WebSocket API through the policy, they will be skipped at runtime.
146
+
> If you applied the policies at higher scopes (for example, global or product) and they're inherited by a WebSocket API through the policy, they are skipped at runtime.
Copy file name to clipboardExpand all lines: articles/governance/policy/samples/built-in-policies.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,8 @@
1
1
---
2
2
title: List of built-in policy definitions
3
3
description: List built-in policy definitions for Azure Policy. Categories include Tags, Regulatory Compliance, Key Vault, Kubernetes, Azure Machine Configuration, and more.
0 commit comments