You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Create OAuth application access to product - Azure API Management
3
3
titleSuffix: Azure API Management
4
-
description: TBD
4
+
description: Learn how to configure OAuth 2.0 application-based access to products in Azure API Management, including prerequisites and step-by-step guidance.
API Management is introducing built-in OAuth 2.0 application-based access to products using the client credentials flow.
20
20
21
+
With this feature, an API manager configures an application in Microsoft Entra ID to represent a product, and registers a client application in Microsoft Entra ID that restricts access to the product's APIs. A developer (or client app) can then use the OAuth 2.0 client credentials flow to obtain OAuth tokens from the client application that are passed to the API Management gateway for authorization to the product's APIs.
21
22
22
-
Applications feature is now available for private preview testing.
23
+
> [!NOTE]
24
+
> This feature is in private preview. Ensure that you have received instructions to access the preview and that your subscription allows you to create an API Management instance in an Early Updates Access Program (EUAP) region. See detailed [Prerequisites](#prerequisites).
25
+
>
23
26
27
+
This article describes the following steps:
24
28
25
-
> [!NOTE]
26
-
> This feature is in private preview. Ensure that you have ...
29
+
* Enable application-based access for a product in API Management.
30
+
* Create a client application in API Management that restricts access to the product.
31
+
* Test OAuth 2.0 token-based access the product's associated API.
32
+
* View the client application in the developer portal and get secure access to the product's APIs.
27
33
34
+
<!-- Clarify personas
28
35
This feature enables:
29
36
30
37
* API Management gateway can now authorize product/API access using OAuth token **in client credentials flow**
31
38
* API managers can identify products which have OAuth authorization enabled
32
39
* API managers can create client applications and assign access to products
33
40
* Developers can view all client applications and use OAuth token to get secure access to product/API
41
+
-->
34
42
35
43
## Prerequisites
36
44
37
-
- An API Management instance deployed in one of the Azure Early Updates Access Program (EUAP) regions, such as Central US EUAP. If you haven't yet created an API Management service instance, see [Create an API Management service instance](get-started-create-service-instance). The API Management instance must be in **Premium**, **Standard**, **Basic**, or **Developer** tier.
45
+
- An API Management instance deployed in one of the Azure Early Updates Access Program (EUAP) regions, such as Central US EUAP. To create an API Management service instance, see [Create an API Management service instance](get-started-create-service-instance.md). The API Management instance must be in **Premium**, **Standard**, **Basic**, or **Developer** tier.
38
46
39
47
> [!NOTE]
40
48
> If you don't have access to an EUAP region, you can [request it](/troubleshoot/azure/general/region-access-request-process) through the Azure portal.
@@ -45,20 +53,14 @@ This feature enables:
45
53
46
54
- Permissions to assign the **Application Administrator** role, which requires at least the **Privileged Role Administrator** role in Microsoft Entra.
47
55
48
-
- Optionally, one or more [users](api-management-howto-create-or-invite-developers.md) in your API Management instance.
49
-
50
-
51
-
[Any special considerations to access the preview - regions, special URLs, etc.]
56
+
- Optionally, add one or more [users](api-management-howto-create-or-invite-developers.md) in your API Management instance.
The following are the high level configuration steps:
56
60
57
-
1. Register an application ...in Microsoft Entra ID.
61
+
<!-- Any special considerations to access the preview - regions, special URLs, etc. -->
58
62
59
-
1. The developer portal requests a token from Microsoft Entra ID using the client-app credentials.
60
63
61
-
1. After successful validation, Microsoft Entra ID issues the access/refresh token.
62
64
63
65
64
66
<!-- Clarify personas for API Management and developer portal. -->
@@ -77,71 +79,132 @@ The following are the high level configuration steps:
77
79
1. In the left menu, select **Manage** > **Roles and administrators**.
78
80
1. Select **Application administrator**.
79
81
1. In the left menu, select **Manage** > **Assignments** > **+ Add assignments**.
80
-
1. In the **Add assignments** pane, search for the API Management instance's managed identity by name or object (prinicipal) ID, select it, and then select **Add**.
82
+
1. In the **Add assignments** pane, search for the API Management instance's managed identity by name or object (principal) ID, select it, and then select **Add**.
81
83
82
84
83
85
## Enable application based access for product
84
86
85
-
Follow these steps to enable **Application based access** for a product:
87
+
Follow these steps to enable **Application based access** for a product. Enabling this setting automatically creates an application in Microsoft Entra ID to represent the selected product.
88
+
86
89
87
90
1. Sign in to the [Azure portal](https://portal.azure.com) and navigate to your API Management instance.
88
91
2. In the left menu, under **APIs**, select **Products**.
89
92
3. Choose the product you want to configure, such as the **Starter** product.
90
93
4. In the left menu, under **Product**, select **Properties**.
91
94
5. Enable the **Application based access** setting.
92
-
6. Click **Save**.
93
-
94
-
Enabling this setting automatically creates a client application in Microsoft Entra ID for the selected product.
95
+
6. Select **Save**.
95
96
96
97
:::image type="content" source="media/applications/enable-application-based-access.png" alt-text="Screenshot of enabling application based access in the portal.":::
97
98
98
99
> [!TIP]
99
100
> You can also enable the **Application based access** setting when creating a new product.
100
101
101
-
###Review application settings
102
+
## Review product application settings
102
103
103
104
After you enable application based access, an enterprise application is created.
104
105
105
106
The application is named with the following format: **APIMProductApplication<product-name>**. For example, if the product name is **Starter**, the application name is **APIMProductApplicationStarter**. The application should have an **App role** defined.
106
107
107
108
You can review application settings in **App registrations**.
108
109
109
-
1. Sign in to the Azure portal and naviage to **App registrations**.
110
+
1. Sign in to the Azure portal and navigate to **App registrations**.
110
111
1. Select **All applications** and search for the application created by API Management.
111
112
1. In the left menu, under **Manage**, select **App roles**.
112
113
1. Confirm that an application role was set by Azure API Management, as shown in the following screenshot:
113
114
114
115
:::image type="content" source="media/applications/application-roles.png" alt-text="Screenshot of app roles in the portal.":::
115
116
116
-
## Create application for multiple products
117
+
## Create client application to access product
118
+
119
+
Now create a client application that will be registered in Microsoft Entra ID and restricts to access one or more products.
117
120
118
-
You can also create an application directly in the portal that can access multiple products. Products must have **Application based access** enabled to have the application access them.
121
+
* Products must have **Application based access** enabled to be associated with a client application.
122
+
* Each client application is associated with a single user (owner) in the API Management instance.
123
+
* A product can be associated with more than one client application.
119
124
120
125
1. Sign in to the Azure portal at the following URL (`https://portal.azure.com/?showversion=true&feature.customPortal=false&Microsoft_Azure_ApiManagement=javierbo2&applicationNewRoleValueFormat=true`) and navigate to your API Management instance.
121
126
1. In the left menu, under **APIs**, select **Applications** > **+ Register application**.
122
-
1. In the **Register an application** pane,
123
-
1. Enter the following application settings:
127
+
1. In the **Register an application** pane, enter the following application settings:
124
128
***Name**: Enter a name for the application.
125
-
***Owner**: Select the owner of the application from the dropdown list. This list includes all users in the API Management instance.
126
-
***Grant access to selected products**: Select one or more products that you want the application to access. You can select one or more products in the API Management instance that have **Application based access** enabled.
129
+
***Owner**: Select the owner of the application from the dropdown list of users in the API Management instance.
130
+
***Grant access to selected products**: Select one or more products in the API Management instance that have **Application based access** enabled, such as the **Starter** product (see [Enable application based access for product](#enable-application-based-access-for-product)).
127
131
***Description**: Optionally enter a description.
128
132
129
133
:::image type="content" source="media/applications/register-application.png" alt-text="Screenshot of application settings in the portal.":::
130
134
1. Select **Register**.
131
135
136
+
The application is added to the list of applications on the Applications pane. A client secret is automatically generated for the application. The client secret is used to obtain an OAuth token from the client application in the client credentials flow.
132
137
133
-
<!--Should the application then appear in the list of applications? -->
138
+
<!--Where would client secret show? Should customer store it somewhere? -->
134
139
140
+
## Review client application settings
135
141
142
+
Review the settings for the client application in Microsoft Entra ID.
136
143
137
-
## Add/remove products in application
144
+
The application is named with the following format: **xxxxxxTBD**. For example, if the product name is **Starter**, the application name is **APIMProductApplicationStarter**. The application should have an **App role** defined.
138
145
146
+
You can review application settings in **App registrations**.
147
+
148
+
1. Sign in to the Azure portal and navigate to **App registrations**.
149
+
1. Select **All applications** and search for the application created by API Management.
150
+
1. In the left menu, under **Manage**, select **App roles**.
151
+
1. Confirm that an application role was set by Azure API Management, as shown in the following screenshot:
139
152
140
153
141
154
## Create token and use with API call
142
155
156
+
157
+
Run the following Azure PowerShell scripts to obtain a token generated for the client application and to call a product API using the token.
158
+
159
+
<!-- Warn about secure handling of token and secrets -->
160
+
161
+
### Obtain token for client application
162
+
```powershell
163
+
164
+
# Replace placeholder values with your own values.
165
+
166
+
$clientId = "aa8029d8-83a5-4713-939d-cebac1bbd672" # Client (application) ID of client application
167
+
$clientSecret = "xxxxx" # Retrieve secret of client application in developer portal
168
+
$scopeOfOtherApp = "api://03db2e9e-efe9-4f68-b74d-911966d1a684/.default" # Audience of application audience is visible under a product
169
+
$tenantId = "e74bd0b5-f803-4e01-858b-dba7e58e55cf" # Your tenant id
The token generated in the previous step is used to call a product API. The token is passed in the **Authorization** header of the request. The API Management instance validates the token and authorizes access to the API.
185
+
186
+
```powershell
187
+
188
+
# $token = "...token here..."
189
+
# Gatewate endpoint to call. Update with URI of API operation you want to call.
0 commit comments