Enable IWA(Intrergrated Windows Authentication) for SSO in APIM

Question

Enable IWA(Intrergrated Windows Authentication) for SSO in APIM

Dixan Thomas 105

I want to implement SSO in APIM, where i want to authenticate the user accessing the API using IWA. Is there a way to add IWA in APIM, so that the user no longer needs to go to a sign in page like every other web app authentication, rather the authentication happens using the windows credentials from the system the user is signed in or using,

Thank for your help.

Accepted answer

0 additional answers

Your answer

Answer 1

navba-MSFT 27,550 Microsoft Employee Moderator

@Dixan Thomas Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

I understand that you want to implement Single Sign-On (SSO) in Azure API Management (APIM) using Integrated Windows Authentication (IWA). You want to authenticate the user accessing the API using IWA, so that the user no longer needs to go to a sign-in page like every other web app authentication. Instead, the authentication happens using the Windows credentials from the system the user is signed in or using.

The integrated Windows Authentication is not supported by APIM. So, this is not a supported scenario. Authentication and authorization to APIs in Azure API Management is explained here.

Please note in many customer environments, OAuth 2.0 is the preferred API authorization protocol.

Though not the same ask as yours, but a similar request was raised here. On a side note, if you want to use the NTLM windows authentication for your backend API via APIM you can rely on the proxy policy User's image

Hope this answers.

**
Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Dixan Thomas 105 Reputation points

2023-09-01T14:30:04.4833333+00:00

Is there a way to know who called the API, like getting the username or email id of the person?
navba-MSFT 27,550 Reputation points Microsoft Employee Moderator

2023-09-04T04:48:12.2366667+00:00

@Dixan Thomas Thanks for getting back. APIM does monitor the published APIs but as per the ApiManagementGatewayLogs document only listed details are logged.

As per your requirement you can leverage the APIM Reports list by User API. For more details on reporting API you can refer to this document.

You can call the List by Request API and add the filter (last 4 days from today, apiID etc). The response will have the details what is the apiID, timestamp and userID which will help to find the details.

So in short, You can know the user (Caller of API) by pulling reports of that particular API management using the below rest API. You will find the options to filter the reports by User and User-Ids:

Mor Info here: https://learn.microsoft.com/en-us/rest/api/apimanagement/current-ga/reports/list-by-user

Hope this helps.

**
Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Dixan Thomas 105 Reputation points

2023-09-04T07:54:33.2066667+00:00

I'm getting /users/1 in analytics section, but i want my username to be logged in, instead.
navba-MSFT 27,550 Reputation points Microsoft Employee Moderator

2023-09-04T08:02:48.6766667+00:00

@Dixan Thomas Thanks for getting back. Please note, if you have accessed the API as as admin ( using the admin subscription keys) then it will show the user id of Admin.

You can try creating a new user for your APIM and assign it a group or you can sign-in and subscribe to a product which your API is part of using this NEW user.

Then it should show you the new user name under APIM analytics.

Also note the same details can be obtained while invoking the Report List by User REST API see below:

**
Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Enable IWA(Intrergrated Windows Authentication) for SSO in APIM

0 additional answers

Your answer