Why the azure APIM does not have inbuilt OAuth server ..?

Achanta Prasad 0

Why azure API management is not having in built oauth server and need relay on other external Idp..?Why the product subscription using subscription keys and they cleary states it is not an strong auntentication framework Authentication and Authorization Overview because we can track the efficiently if using OAuth alone.

1 answer

Shireesha Eeraboina (Quadrant Resource LLC) 570 Reputation points Microsoft Vendor

2024-11-27T08:34:50.33+00:00

Hi @Achanta Prasad ,

Welcome to the Microsoft Q&A Platform! Thank you for your question.

Azure API Management does not have an inbuilt OAuth server because its main focus is on API management, not identity management. OAuth is a complex protocol that requires handling authentication, consent, and token management. Instead, Azure API Management integrates with external Identity Providers (IdPs) like Azure Active Directory (Azure AD), which specialize in secure authentication and user management. This approach provides flexibility by allowing integration with various authentication mechanisms and enables stronger user authentication and fine-grained authorization. I hope this explanation is helpful. Let me know if you have any further questions.

Feel free to reach out if you need more assistance. I would be happy to help.

Thank you.
Please sign in to rate this answer.
Shireesha Eeraboina (Quadrant Resource LLC) 570 Reputation points Microsoft Vendor

2024-11-28T12:09:49.91+00:00

Hi @Achanta Prasad ,

Following up to see if you have chance to check my previous response and help us with requested information to check and assist you further on this.

Thankyou.

Shireesha Eeraboina (Quadrant Resource LLC) 570 Reputation points Microsoft Vendor

2024-11-29T10:51:24.45+00:00

Hi @Achanta Prasad ,

I wanted to follow up and see if you’ve had an opportunity to review my previous message and share the requested details. Having this information will help us assist you more efficiently.

Thankyou.

Achanta Prasad 0 Reputation points

2024-12-03T00:30:41.91+00:00

Thank you for your explanation. In Azure API Management (APIM), the subscription key provides authorization across different scopes, allowing us to track users and monitor usage with built-in mechanisms for usage tracking and access control.

Can we achieve a deeper integration with Azure AD to map Azure APIM users with client IDs?

When using OAuth 2.0 with Azure Entra ID, we don't get the same level of functionality as we do with subscriptions in APIM. This seems to be a drawback compared to other contenders like Apigee, Kong, and IBM API Connect.

Shireesha Eeraboina (Quadrant Resource LLC) 570 Reputation points Microsoft Vendor

2024-12-03T11:38:27.35+00:00

Hi @Achanta Prasad ,

To secure your API, the most effective method is to implement OAuth 2.0 and OpenID Connect for authentication and authorization. This approach allows you to leverage external Identity Providers (IdPs) like Azure Active Directory (Azure AD) for secure user authentication.

For detailed instructions on configuring OAuth 2.0, please refer to the following document Protect API in API Management using OAuth 2.0 and Microsoft Entra ID - Azure API Management | Microsoft Learn

If you wish to configure OAuth 2.0 authorization with Microsoft Entra ID, please consult this document for a comprehensive understanding OAuth 2.0 authorization with Microsoft Entra ID - Microsoft Entra | Microsoft Learn

I hope this helps! Let me know if you have any further questions. I hope this response helps address your query and resolve the issue.

Thank you!

Shireesha Eeraboina (Quadrant Resource LLC) 570 Reputation points Microsoft Vendor

2024-12-04T16:16:04.9+00:00

Hi @Achanta Prasad ,

I’m following up to see if you’ve been able to review my earlier response and send the requested information. Having the full details will allow us to help you resolve the issue more quickly.

Thankyou.

Achanta Prasad 0 Reputation points

2024-12-11T01:45:19.6433333+00:00

Thanks for the details , If I use external Identity Providers (IdPs) like Azure Active Directory (Azure AD) for secure user authentication alone then I am not achieve the feature like below in our APIM as we able to get using subscription keys and for the below features we need to use both subscriptionkey and clientID of the apps registration.We have question from partners that why they need to use both of the both authentication , can we use either of two subscription key or client id and secret ..?

Shireesha Eeraboina (Quadrant Resource LLC) 570 Reputation points Microsoft Vendor

2024-12-12T07:43:08.9966667+00:00

Hi @Achanta Prasad ,

When it comes to securing your API, you have two main options: subscription keys or client ID and client secret (OAuth). The choice between them depends on your specific security needs and use case.

Subscription keys are typically used to control API traffic and enforce quotas, while Azure AD provides a more authentication and authorization system that's based on user roles, permissions, and identity.

The best approach is to use both subscription keys and Azure AD if you need the features they offer, such as tracking usage, authenticating apps and users, and fine-graining access controls. However, if you have a simple API with minimal security requirements, using just subscription keys might be sufficient.

I hope this helps.

Thank you!

Shireesha Eeraboina (Quadrant Resource LLC) 570 Reputation points Microsoft Vendor

2024-12-16T02:25:18.6433333+00:00

Hi @Achanta Prasad ,

I’m following up to see if you’ve been able to review my earlier response and send the requested information. Having the full details will allow us to help you resolve the issue more quickly.

Thankyou.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Why the azure APIM does not have inbuilt OAuth server ..?

1 answer

Your answer