Authenticate service caller with its Managed Identity in another service

user_751368 0
Viewed 668

What is the state-of-the-art way to authenticate caller (an App Service/.NET Core WebAPI with its Managed Identity, not on behalf on a signed in user) in another App Service/.NET Core WebAPI (that also has its own Managed Identity)? I'd like to use Azure API Management to hide called service and as minimum keys as possible.

EDIT:

API App Service Azure Authorization/Active Directory Settings:enter image description here API App Registratoins details:

enter image description here

App registration/API App/Authentication:

  • Implicit grants - only ID tokens checked

  • Supported account types - Single tenant

enter image description here

App registration/API App/Expose an API:

enter image description here

When I try to add a client application a got this (d1d is an end of my client App Service managed id):

enter image description here

microservices azure-api-management azure-active-directory asp.net-web-api c#
1 Answers

You don't need managed identity for your API, any app registration will do. Set its application id uri and use the Azure.Identity nuget package to get a token with something like this:

var managedIdentityCredential = new ManagedIdentityCredential();
var scopes = new []{"{your api application id uri}/.default"}; // E.G: api://3a768fed-640b-420c-8b33-39c701c55199/.default
var accessToken = (await managedIdentityCredential.GetTokenAsync(new Azure.Core.TokenRequestContext(scopes))).Token;
user_55623720
Related