Azure API: You do not have permission to view this directory or page.

Question

Got an API with JWT hosted in Azure. I need to connect to it to get an Identity Token, (POST: /Identity/Login) from Postman but it is replying: You do not have permission to view this directory or page.

If I try it from swagger, I get a token, but Swagger is inside that api, ie in Azure. From outside Azure, I cannot connect to the API.

Can I configure the API to connect via a Client ID & Secret? This API will be used in a Mobile Application.

Thanks

JP

Answer 1

I you are using azure ad identity then you can use a clientid & secret. in your azure ad app configuration portal, add api permission and define a secret.

note: a disassemble of the mobile app will reveal the secret. A better approach is some sort of registration of the mobile app that retrieves the secret from the api website and stores encrypted. also it is a good idea that the secret expires and must be updated.