Restrict API Clients to Azure B2C only

Question

I have 2 APIs, in Azure AppService.
One of them is behind Azure APIM

Those API offer a helper services used by Azure AD B2C custom policies.

Currently the APIs are protected by a subscription key only.

I need to ensure that specific operations of those the APIs can be consumed only by B2C and not by whoever has the subscription key.

Can this be achieved via servie tags or so?

Note: at the time the B2C needs to consume the APIs, the user is not yet authenticated I can´t use JWT tokens for validation.

Help is really aprreciated.
Many thanks,
JD

Answer 1

@juni dev To restrict access to your APIs to only Azure AD B2C clients, you can use Azure AD B2C as the authentication mechanism for your APIs. You can configure your APIs to accept only requests that include a valid Azure AD B2C-issued access token.

Here are the high-level steps to achieve this:

1. Register your APIs in Azure AD B2C as applications.
2. Configure your APIs to accept only requests that include a valid Azure AD B2C-issued access token.
3. Configure your Azure AD B2C custom policies to obtain an access token for your APIs.

You mentioned that at the time the B2C needs to consume the APIs, the user is not yet authenticated. In this case, you can use the client credentials flow to obtain an access token for your APIs.

Here is an example of how to use the client credentials flow to obtain an access token for your APIs:

1. Register your APIs in Azure AD B2C as applications.
2. In the Azure portal, go to your Azure AD B2C tenant and select "App registrations".
3. Select "New registration" and register your APIs as applications.
4. In the API Management portal, go to your API and select "Settings".
5. Under "Security", select "OAuth 2.0".
6. Select "Add" and configure your APIs to accept only requests that include a valid Azure AD B2C-issued access token.
7. In your Azure AD B2C custom policies, use the client credentials flow to obtain an access token for your APIs.To restrict access to your APIs to only Azure AD B2C clients, you can use Azure AD B2C as the authentication mechanism for your APIs. You can configure your APIs to accept only requests that include a valid Azure AD B2C-issued access token. Here are the high-level steps to achieve this:
   1. Register your APIs in Azure AD B2C as applications.
      1. Configure your APIs to accept only requests that include a valid Azure AD B2C-issued access token.
         1. Configure your Azure AD B2C custom policies to obtain an access token for your APIs.
   You mentioned that at the time the B2C needs to consume the APIs, the user is not yet authenticated. In this case, you can use the client credentials flow to obtain an access token for your APIs. Here is an example of how to use the client credentials flow to obtain an access token for your APIs:
   1. Register your APIs in Azure AD B2C as applications.
   2. In the Azure portal, go to your Azure AD B2C tenant and select "App registrations".
   3. Select "New registration" and register your APIs as applications.
   4. In the API Management portal, go to your API and select "Settings".
   5. Under "Security", select "OAuth 2.0".
   6. Select "Add" and configure your APIs to accept only requests that include a valid Azure AD B2C-issued access token.
   7. In your Azure AD B2C custom policies, use the client credentials flow to obtain an access token for your APIs.