How can I restrict the use of operations in Azure API Management (APIM) per user or group

user_4009432 0
Viewed 841

I'll be so gratefull if you can help me with the following question: I´m resticting the access to use an API in APIM using groups, but I want to restrict even its operations for example: I have an API in APIM with the following operations:

  • OperationA
  • OperationB
  • OperationC

And the following groups of users:

  • Group1
  • Group2
  • Group3

so the idea is to give access to the groups according some business rules for instance:

  • Group1 (OperationA, OperationB)
  • Group2 (OperationA)
  • Group2 (OperationA,OperationB,OperationC).

Is there a way to implement this behavior? Thank you so much

azure-api-management azure api
2 Answers

Only possible via policy expressions. Use choose policy and check which groups current user is a member of (context.User.Groups) and if you don't see one you need - use return-response to stop request processing.

user_1815560

In the operations inbound policy you could add something like this:

<choose>
    <when condition="@(context.User.Groups.Contains(g => g.name == "Group1"))">
         <return-response>
              <set-status code="403" reason="Unauthorized" />
              <set-body>Users in group Group1 do not have access to this method. </set-body>
         </return-response>
    </when>
</choose>

These are the pieces of documentation I referenced to come up with this result:

This would make it so any user who belongs to Group1 would receive a response of "Users in group Group1 do not have access to this method." anytime they made a request to this API operation. If you add this to the inbound policy for the API the users in Group1 would be blocked from making calls to any operation in the API.

user_17275400
Related