How can I manage multiple users to access to an api through apim. Taking into account that everyone got to have a client id and a secret?

Question

How can I manage multiple users to access to an api through apim. Taking into account that everyone got to have a client id and a secret?

Jhon Elmer Bustamante Botero 90

I would like to know If I had to create multiple app registration to that purpose

MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-05-02T14:40:34.9933333+00:00

Jhon Elmer Bustamante Botero Just a follow up on the answer below and see if you have any questions.

Accepted answer

0 additional answers

Your answer

MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-05-02T14:40:34.9933333+00:00

Jhon Elmer Bustamante Botero Just a follow up on the answer below and see if you have any questions.

Answer 1

MuthuKumaranMurugaachari-MSFT 22,441 Moderator

Jhon Elmer Bustamante Botero Thanks for posting your question in Microsoft Q&A. App registration is used to represent a client application and in case of multiple users, you can simply set up authentication and authorization with OAuth flows to an Identity Provider (for example, Azure AD). (No need for multiple app registration). The users need to obtain an access token from Identity Provider using OAuth flow and call APIM with the token in Authorization header. In Azure APIM, you can validate the token using validate-jwt policy.

Here are some docs that can help you with this:

I hope this helps and let me know if you have any questions.

Jhon Elmer Bustamante Botero 90 Reputation points

2023-06-01T16:13:31.5866667+00:00

Thank you for your answer. That instruction would be the same if I want to set a connection between an external server to an api hosted in my server?
MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-06-01T16:25:58.6066667+00:00

Jhon Elmer Bustamante Botero the steps described are for authenticating users in APIM. Can you elaborate on external server, on-premises API set up and the request flow? That would help in understanding the context.
Jhon Elmer Bustamante Botero 90 Reputation points

2023-06-02T14:29:24.12+00:00

The context would be something like this: A foreign organization would want to access to an api hosted in my APIM tenant. Then, to set a trusted relation and allow that a third-part get access to my resources I would have to join that foreign organization to my tenant?
MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-06-02T15:01:33.29+00:00

Jhon Elmer Bustamante Botero It depends on how Identity Provider is configured. If you are looking to use Azure as Identity provider, then you can look at the option of using AD B2C or Azure AD. Otherwise, foreign org/third party can use external identity providers to generate an access token, pass it to APIM via Authorization header and then you can validate the token in APIM using Validate JWT policy.

Let me know if you have any questions.
Jhon Elmer Bustamante Botero 90 Reputation points

2023-06-05T13:06:47.01+00:00

Appreciate your anwers. They have clarified my doubts

Share via

How can I manage multiple users to access to an api through apim. Taking into account that everyone got to have a client id and a secret?

0 additional answers

Your answer