Protect an API by using OAuth 2.0 with Azure Active Directory and API Management
https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad
https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad
First Create a simple web API and host into Azure app service.
Go to Visual Studio -> Visual c# -> ASP.Net web application
https://webapplication1202200514100115.azurewebsites.net/api/
go to Azure and check whether Web API deployed or not.
now Web API need to deploy into API Management. to do follow below steps.
Add validate-jwt to validate client-app token. if client-app return invalid token then jwt validate and return unauthorized message.
In API Management console successfully called the Protected Web API by using OAuth 2.0 with Azure Active Directory and API Management.
Chrome Extension for CORS testing.
Successfully called the Protected Web API by using OAuth 2.0 with Azure Active Directory and API Management.
Go to App service (where Web API deployed) -> API Management -> Create new API Management if not exist else may chose existing one.
Fill required fields to create API Management instance.
after create new API Management instance need to link Web API endpoints.
go to App Service -> API Management -> select Echo API under API section then click on Link API button.
To update Web API URL into echo API,
go to API Management -> APIs -> Echo API -> Settings -> Web Service URL -> paste Web API URL
https://webapplication1202200514100115.azurewebsites.net/api/ -> click on Save button.
API Management service -> APIs -> Echo API -> Design -> Get operation -> Fronted edit ->
API Management service -> APIs -> Echo API -> Design -> Get operation -> Fronted edit -> under Get operation enter "/values" Web API's get operation endpoint.
To test click on Developer portal (legacy)
Select APIs Tab -> Get operation -> enter required fields -> click on "Send" button.
Web API endpoint return result, but there is no protection. Whoever have endpoint URL and subscription key they can call API. If any one want consume this API they have to ask subscription key and we should not give our subscription key to other. to avoid this situation whoever need our API first they need to give us there Azure App details to us then we will add as a trusted App. then they can consume our API without our subscription key.
First we need to create two Apps.
1. backend-app -> act as web API
2. client-app -> client application which is consuming protected Web API
To create and configure backend-app follow below steps.
To create and configure client-app follow below steps.
Now create OAuth 2.0 Service.
To Create and Configure OAuth 2.0 Service follow bellow steps.
<!DOCTYPE html>
<html>
<head>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script>
$(document).ready(function () {
var token = getToken();
});
function getToken() {
var settings = {
"url": "https://login.microsoftonline.com/05e85d9f-3679-4080-a879-17a8669ef4fe/oauth2/v2.0/token",
"method": "POST",
"headers": {
"Content-Type": ["application/x-www-form-urlencoded", "application/x-www-form-urlencoded"]
},
"data": {
"grant_type": "client_credentials",
"client_id": "2000da14-0dc9-4793-92c5-16184f6c397e",
"client_secret": "S~WG-20k-Bhgn1reMvtS..S6Ug0OEP80cz",
"scope": "api://2b2b2c0c-6c5e-4f0c-b669-6143e4fc5740/.default"
}
};
$.ajax(settings).done(function (response) {
callAPI(response.access_token);
});
}
function callAPI(token) {
var settings = {
"url": "https://webapplication120200514100115-apim.azure-api.net/echo/values?param1=sample",
"method": "GET",
"headers": {
"Ocp-Apim-Subscription-Key": "d09030939c7c4bc6bd319893c263f9f4",
"Authorization": "Bearer " + token
},
};
$.ajax(settings).done(function (response) {
$("#divData").text(response);
});
}
</script>
</head>
<body>
<div id="divData"></div>
</body>
</html>
Thank you for sharing such a Magnificent post here. I found this blog very useful for future references. keep sharing such informative blogs with us. How to install Android on PC
ReplyDeleteOAuth 2.0 with Azure Active Directory and API Management provides a structured way to protect an API while controlling which applications or users can access backend resources. The article begins with creating a simple web API and hosting it through Azure App Service, then moves toward configuring the API security layer. This approach is useful because authentication and authorization can be handled separately from the core API logic, allowing the backend service to remain focused on its primary functionality. RESTful API Training can help developers build a stronger understanding of REST API design, endpoints, requests, responses, and practical service integration.
DeleteA full-stack developer may also need to understand how APIs connect different parts of an application. The backend can provide business functionality through REST endpoints while frontend applications consume those endpoints to retrieve or submit information. Dot Net Full Stack Online Training offers a relevant learning path for connecting backend development, APIs, and other components involved in full-stack applications.
DeleteWhen the frontend is built with Angular and the backend uses ASP.NET Core, API communication becomes an important part of the overall application architecture. Developers can benefit from understanding how authentication, API requests, backend services, and frontend components work together rather than treating each layer independently. ASP.NET Core Angular Full Stack Online Training can support learning around this combination and provide a broader perspective on developing integrated full-stack applications.
Delete86588D158F
ReplyDeleteTakipçi Satın Al
3D Car Parking Para Kodu
Google Konum Ekleme
Stumble Guys Elmas Kodu
Viking Rise Hediye Kodu
ReplyDeleteWhen searching for reliable printing solutions, many customers look for convenient options, especially when it comes to quality transfers. If you're interested, you can easily find a service by searching for dtf transfers near me. These services provide efficient and high-quality transfers that meet your needs. Whether you're a small business owner or a hobbyist, finding local options can save you time and ensure timely results.
Thank you for sharing such a Magnificent post here. I found this blog very useful for future references. keep sharing such informative blogs with us.best air cargo services in islamabad
ReplyDeleteI sincerely enjoy using penalty shooter because it delivers realistic football gameplay with exciting penalty shootouts. Every challenge feels rewarding, while the polished visuals and smooth controls make the overall experience highly entertaining.
ReplyDeleteIt's easy to appreciate space type
ReplyDeletebecause the game perfectly combines education with entertainment. Every typing challenge rewards improvement while providing colorful graphics, smooth gameplay, and exciting space-themed adventures for every player.
My favorite thing about 1v1 lol is how every match feels exciting and competitive. The creative building mechanics, polished graphics, and responsive controls create an unforgettable online battle experience for players everywhere.
ReplyDeleteA full-stack developer may also need to understand how APIs connect different parts of an application. The backend can provide business functionality through REST endpoints while frontend applications consume those endpoints to retrieve or submit information. packers and movers in Rawalpindi
ReplyDelete