api-management | API Management for Membrane Service Proxy | REST library

Yes - you can do this and here is a Curity resource that follows a similar process:

• Make an OAuth request to get a JWT based on an incoming credential
• Forward it to the downstream API
• Cache the result for subsequent requests with the same incoming credential

Your case is a little different but uses the same building blocks. You just need to adapt the OAuth message to use the Client Credentials flow.

I found the answer to my own Question :-) I try to comment on each line, but if you take alle the code and put it together you get a policy to handle Oauth2 in a backend api.

In the inbound section, the cache-lookup-value Assigns the value in cache to the context variable called “bearerToken”. On first entry, the cache value will be null and the variable will not be created.

• You can validate certificates presented by the connecting client and check certificate properties against desired values using policy expressions.
• For information about securing access to the back-end service of an API using client certificates, refer How to secure back-end services using client certificate authentication
• To receive and verify client certificates over HTTP/2 in the Developer, Basic, Standard, or Premium tiers you must turn on the "Negotiate client certificate" setting on the "Custom domains" blade.

• To receive and verify client certificates in the Consumption tier you must turn on the "Request client certificate" setting on the "Custom domains" blade.

• Policy to validate client certificates- Use the validate-client-certificate policy to validate one or more attributes of a client certificate.
• Certificate validation with context variables - You can also create policy expressions with the context variable to check client certificates.
• Checking the issuer and subject
• Checking the thumbprint
• Checking a thumbprint against certificates uploaded to API Management. For more detailed information please refer secure APIs using client certificate authentication in API Management

Post requests are more secure because they can carry data in an encrypted form as a message body. Whereas GET requests append the parameters in the URL, which is also visible in the browser history, SSL/TLS and HTTPS connections encrypt the GET parameters as well. If you are not using HTTPs or SSL/TSL connections, then POST requests are the preference for security. A dictionary object can be used to send the data, as a key-value pair, as a second parameter to the post method.

The HTTPS protocol is safe provided you have a valid SSL certificate on your API. If you want to be extra safe, you can implement end-to-end encryption/cryptography. Basically converting your so called plaintext, and converting it to scrambled text, called ciphertext.

In the navigation structure you can create sub-menus by selecting a parent item and then clicking "Add navigation item" to add child items (also you can use arrow keys to make an existing item a subpage or promote it to parent level). After that, the Menu widget with "Horizontal" layout will display the dropdown when clicking on them. Menus with "Vertical" layout will form a tree of navigation items.

Why you want to add the Lets Encrypt Root CA cert on your application gateway?

From my understanding the Root CA from Lets Encrypt is ISRG Root X1 and this one should be already trusted by Clients (Browsers).You only want to add the Root CA if you have self signed certificates.

Here is a workflow with storing the certs in Azure Key Vault: https://techblog.buzyka.de/2021/02/make-lets-encrypt-certificates-love.html

Another Workflow here describes adding certs with ACME challenges: https://intelequia.com/blog/post/1012/automating-azure-application-gateway-ssl-certificate-renewals-with-let-s-encrypt-and-azure-automation

If you're using OAuth and tokens to access your API you might want to have a look at the client credentials. It's a flow where the client (your app), authenticates and gets an access token, without any user interaction. In a mobile environment you will need to dynamically register each installation of your app, so that each app has its own secret. You can't use one secret and compile it into your code as anyone will be able to steal it. If DCR is too much for you, you can use some kind of proxy - have your app talk to a backend service, which in turn will talk to the OAuth server. Such a backend service can keep a secret and use it to obtain client credentials tokens.

Thank you Tom W and Amber Bhanarkar. Posting your suggestions as an answer to help other community members.

Provisioning a gateway resource in your Azure API Management instance is a prerequisite for deploying a self-hosted gateway.

Go to your API Management instance

1. In the Azure portal, search for and select API Management services.

2. On the API Management services page, select your API Management instance.

Provision a self-hosted gateway

1. Select the Gateways from under Deployment and infrastructure.
2. Click + Add.
3. Enter the Name and Region of the gateway.
4. Optionally, enter a Description of the gateway resource.
5. Optionally, select + under APIs to associate one or more APIs with this gateway resource and click Add.

Now the gateway resource has been provisioned in your API Management instance. You can proceed to deploy the gateway.

You can refer to Azure API Management and Application Gateway integration, Integrate API Management in an internal virtual network with Application Gateway and Protect APIs with Application Gateway and API Management

Azure APIM itself doesn't act as an identity provider like tyk but instead uses Azure AD (or rather any OAuth 2.0 provider).

The configuration in the docs is primarily to get the Developer Portal Console (the one used to test APIs) to work. For the actual API calls, there is no configuration required.

The validate-jwt policy is what takes care of preauthorization of requests.

Since you are looking for the client credentials flow alone, you could simply expose a portal that can create the required app registrations on your Azure AD using the Microsoft Graph API and expose the client id/secret to your users.

The current developer portal doesn't support this as of today but is something you could contribute to if you wish.