Azure Request AD token based User/Group

Question

I have an backend application registered in my organization and we have so many clients are consuming those API's. We have also registered Client Application and given permissions to the Backend API.

My Azure APIM API Inbound Policy expecting a token and validating it before sending the requesting to the Backend Application.

As a API owner, we need to test my API's which are published in the Azure APIM. I have the following questions on this.

1)if the API owner want to test the Applications, how they will get a token?

2) Is it possible to give the permissions to the Users/AD groups to the Backend API's? if yes, how can we get the token with out the client credentials?

Please help me here to understand how we can achieve this in Azure.

Answer 1

Hi thanks for the question

for an overview of authentication/authorization in Az API Management please see here

To your specific question , if I am understanding correctly your backend is setup with oAuth and you use APIM to validate the jwt token on the way through.

The developer portal test console can be configured to allow a user to obtain a JWT token (see here)

You can do something similar if you prefer to use Postman (as an example of a popular http testing tool)

Note: If you are using the client credentials flow then you cant obtain a token without making the correct token request towards the oAuth provider with the correct data (client id, secret etc). This is explained in detail for AAD (Az Active Directory) here.