Architecture for Secure User Access with Azure B2C and Azure API Management

Question

Architecture for Secure User Access with Azure B2C and Azure API Management

hampton123 1,175

I'm planning to create an API Management instance where users can securely access my APIs through B2C, with access restricted to those who sign in using pre-made accounts. To achieve this, I'd like to understand the recommended architectural approach and best practices for integrating Azure B2C with Azure API Management (to be specific, I'm using an Azure Function that uses Node JS inside of Azure APIM). What considerations should I keep in mind when designing this system to be extremely secure? Any insights into the architecture, potential configurations, and key components involved would be highly valuable. Thank you in advance for your help and please let me know if anything needs any clarification!

Thomas Meads 1,586 Reputation points

2023-09-06T17:06:19.8433333+00:00

When you say extremely secure is there a standard you are trying to meet?
hampton123 1,175 Reputation points

2023-09-06T17:11:54.82+00:00

I just want it to be inaccessible to anyone outside of the system, sorry if my wording was a bit too much! I don't want outside access into the system but I do want to make it as secure as I can without being too costly whether that be through APIM's built-in systems or Managed Identities or Identity Providers.
JananiRamesh-MSFT 29,261 Reputation points

2023-09-18T05:53:43.3366667+00:00

Hi Hunter B Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.

Accepted answer

0 additional answers

Your answer

Thomas Meads 1,586 Reputation points

2023-09-06T17:06:19.8433333+00:00

When you say extremely secure is there a standard you are trying to meet?
hampton123 1,175 Reputation points

2023-09-06T17:11:54.82+00:00

I just want it to be inaccessible to anyone outside of the system, sorry if my wording was a bit too much! I don't want outside access into the system but I do want to make it as secure as I can without being too costly whether that be through APIM's built-in systems or Managed Identities or Identity Providers.
JananiRamesh-MSFT 29,261 Reputation points

2023-09-18T05:53:43.3366667+00:00

Hi Hunter B Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.

Answer 1

Thomas Meads 1,586

Hi (sorry for waiting this long to reply!),

Looking over the components here are a few recommendations though this list is not exhaustive.

Use OAuth for all calls to APIM this would mean setting up an App Registration that can be used via B2C policies
Enforce HTTPS and TLS 1.3
Enforce HTTPS on the Azure Function
Turn FTP on the Azure function or use SFTP
Put the APIM instance and Azure Function in a vNet if using a tier that supports it
If not IP restrict the Azure function to the VIP of the APIM instance

This is making the assumption that it is B2C calling the APIM instance and not users in that B2C instance. If it is users then also include.

APIS should be accessed via OAuth or another secure standard (stay away from API keys)
Apply rate limiting (use products if needed)
Put the APIM instance behind Azure Front Door (then enable HSTS, Azure firewall, Rate limiting at this level etc)
If put behind Azure front door a VNet is needed to force calls through the Front Door instance or a Private Endpoint (I think these are supported)

Hope this is what you were looking for. If you want me to expand on more points here let me know.

hampton123 1,175 Reputation points

2023-09-13T20:52:15.9366667+00:00

Hi Thomas Meads, I appreciate your response! I also appreciate you commenting on my other posts lately.

So I've been working on the API more and I've actually already decided a little bit on the architecture. This is the tutorial I decided to go with for the API, simply because I've had some past experience with it. The tutorial includes some of the bullets you've included so I think it will be secure (minus using Azure Front Door and a VNet). Do you think the tutorial is fine? I don't know if you remember my previous posts but I also want to manage what APIs each individual B2C user will have access to, and if this is possible with APIM's other tiers then I'll continue using this tutorial for my API.
Thomas Meads 1,586 Reputation points

2023-09-14T08:01:44.9433333+00:00

Heya,

This tutorial looks good though I would suggest looking at static web apps as it will be cheaper to run and includes many SPA specific features. Front Door / Azure WAF is a consideration you need to make based on the ingress type and use.

I have spun up an APIM instance to test the B2C authentication on the developer portal. Once I have completed some testing I will get back to you on the other ticket.

Have a great day.
hampton123 1,175 Reputation points

2023-09-14T18:58:03.81+00:00

Thank you Thomas Meads for all of your help, you've assisted me greatly throughout the past few posts. I'll look at static web apps for SPA specific features and I look forward to your response on the other thread :)

Share via

Architecture for Secure User Access with Azure B2C and Azure API Management

0 additional answers

Your answer