secure APIs using client certificate authentication for specific API

Almaany, Omar 1 Reputation point
2022-07-13T03:22:46.92+00:00

Hi, I'm trying to secure APIs using client certificate authentication in API Management. but I don't want to apply the authentication on all API’s in the APIM I want to apply the authentication on a Specific API but I'm unable to do that because if i set Request client certificate =yes then i will enable the validation on all API’s and if I set it to no then context.Request.Certificate.Thumbprint will be null in the policy?

Azure API Management
Azure API Management
An Azure service that provides a hybrid, multi-cloud management platform for APIs.
1,769 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. MayankBargali-MSFT 68,656 Reputation points
    2022-07-13T05:41:27.36+00:00

    @Almaany, Omar Assuming you have API-1 and API-2. You can enable the negotiate client certificate and simply let your client ignore the certificate request and as long as API-1 does not have a logic to validate the certificate, the call will not fail and will be handled as usual. If you have custom client code or tool to make requests, it will work fine without specifying any certificate for API-2 but if the request is coming from the client browser, then the browser may ask for any certificate depending on the browser. For the second API-2 you don't have to write the policy to validate the certificate but browser will still ask for any certificate to be passed. You need to write the validation policy for certificate in the API level.

    The alternative would be setting up multiple custom domains for the gateway endpoint and set the negotiate client certificate on one domain and ignore it for the other, with that you can call API-1 from domain-1 and API-2 from domain-2, but keep in mind that both Apis will continue to be callable using any of the custom domains, so this is inefficient and pricey solution.