API in APIM?

Question

When I host an api in apim, the authentication y authorization is lying in apim. Should I set authentication and authorization again on api backend?

Answer 1

@Anonymous Thanks for reaching out.

When you host an API in Azure API Management (APIM), the authentication and authorization can be handled by APIM itself. APIM provides a number of authentication and authorization policies that you can use to secure your API, such as OAuth2, JWT, and Basic Authentication.

If you have already configured authentication and authorization policies in APIM, you do not need to configure them again on the API backend. APIM will handle the authentication and authorization for incoming requests and forward the requests to the API backend with the appropriate credentials. Make sure that your backend is only accessible using APIM.

However, if you have additional security requirements that are not supported by APIM, you may need to configure additional authentication and authorization policies on the API backend. For example, if you need to use client certificates to authenticate requests, you may need to configure the API backend to accept and validate client certificates.

In general, it is recommended to handle authentication and authorization at the edge of your system, such as in APIM, rather than in the API backend. This allows you to centralize the security policies and provides a consistent security model for all APIs hosted in APIM.

Feel free to get back to me if you have any queries or concerns.

Please "Accept Answer" if the answer is helpful so that it can help others in the community.