Last-mile security with OAuth-enabled APIs


what recommended approach last-mile security (between apim proxy , back-end services) apis protected using oauth 2.0?

seems options are:

  1. on api -> security tab, configure proxy authentication "none", and use ip white-listing ensure apim proxy can communicate back-end service (which must available on public internet).  this approach requires static ip apim available in standard tier (thus more expensive while in development).
  2. on api -> security tab, configure proxy authentication "none", , use shared secret approach, involves using secret, publisher-defined key/value pair in request header coming apim (with special code on back-end verify incoming value).  the drawback approach is less-formal mechanism requires process around regularly rotating secret value.
  3. on api -> security tab, configure proxy authentication "mutual certificates", , specify client certificate in dropdown.  the drawback approach managing cert itself.

"basic authentication" can't used in scenario because of conflicting "authorization" request header (i.e., both basic authentication , oauth 2.0 make use of "authorization" request header there'd no way support both values).  in apim, on api -> security tab if specify proxy authentication = "basic authentication" when api configured use oauth 2.0 receive following error message when saving:

"disable authorization request header token sending method first"

it seems me option 3 ideal.  using mutual certificates secures communication between proxy , back-end service, , works both standard , developer tiers it's inexpensive while in development.  once in production, can combined ip white-listing if desired.

any guidance or suggestions appreciated.

thanks!

ben,

in situation, agree mutual authentication might best choice.

regards,

miao



Microsoft Azure  >  Azure API Management



Comments

Post a Comment

Popular posts from this blog

Azure DocumentDB Owner resource does not exist

having same error microsoft.azure.documents.documentclientexception: message: {"errors":["owner resource not exist"]} , scenario. when deployed webapp azure , try document docdb throws error. docdb exists in azure , contains document looking for. weird local machine(running vs) works fine. i'm using same settings in azure , local. have , idea this. thanks Microsoft Azure  >  Azure Cosmos DB
Read more

RFC_ERROR_SYSTEM_FAILURE with SAP ECC 6 Unicode

hi all, i using biztalk 2006 r2, microsoft biztalk adapter v2.0 mysap business suite sp1 & sql server 2005 database server. we have developed orchestrations communicating sap version 4.7.   currently sap has been upgraded in ecc 6(unicode) system. i have configured new send port on dev server. orchestration can communicate sap ecc 6.0 (non- unicode) system while trying connect sap ecc 6.0 (unicode) getting error. a message sent adapter "sap" on send port "ecc 6 sendport" uri "sap://as:***.**.***.***/**/***/" suspended.   error details: rfc_error_system_failure   messageid:   {b7dd677e-0ef3-480b-835a-d389f2e24179} is there can configure setting unicode ?   thanks in advance     ajay dabhade problem solved: standard table data types appear not unicode compatible in sap ecc 6.0. make rfcgetfunctiondesc raise error. solution: used other data types scratch in rfcs in sap   ajay dabhad...
Read more

C# System.Data.Common DbCommand and getting Datasets from Oracle

i found no oracle specific forum area, decided post here. getting dataset oracle c# system.data.common library's dbcommand seems tricky task. i using command object in project along dbproviderfactory , dbdataadapter because meant allow use same library multiple database providers, , don't have clutter data access layer of project separate classes accessing each individual database provider. my problem is, stored procedures fetching data oracle require refcursor object added in parameters. however, dbtype library not contain definition object. using "object"-type not work. i have read many places not have add refcursor parameter, endless failed attempts @ running command without refcursor object has brought me conclusion leaving out refcursor object not option when using system.data.common library. here coded example connectionstring purposefully left out.                 dbconnection.ope...
Read more