How to Integrate Apigee with Azure Active Directory

Question

How Clients will obtain an Azure AD access token and send it to Apigee.

How Apigee will validate the token by communicating with Azure AD.

How This will ensure secure authentication and authorization for all API requests.

Answer 1

Hello Ibrahim Siddiqui (LCL-C),

Please check this GitHub blog for implementation : https://github.com/rcbj/apigee-jwt-aad-timeapi-proxy

In Microsoft Entra ID register two apps, one your clients use to get tokens and one that represents your API. Your client posts posts to

https://login.microsoftonline.com/{TENANT_ID}/oauth2/token

with client ID, secret, user credentials and the API’s URI to receive a JWT.

In Apigee import the proxy from the repo, create an environment cache named signer-cert, update the ServiceCallout policy’s federation metadata URL to point at your tenant, and set claim_iss and claim_aud in the Java Callout policy to your own values.

Once live, Apigee will fetch Azure’s signing keys, verify each token’s signature, issuer, audience and expiry, and only forward valid requests to your backend.

Hope this helps!

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.