Forum Discussion
How to setup customer to obtain AADB2C token for an API exposed through APIM
I am setting up Azure APIM instance behind a Azure Application gateway. Developer portal will be exposed so external customers will be able to subscribe to products containing the APIs and obtain the subscription key that way. There will be approvals required for subscription.
I want to setup OIDC on top of the subscription key validation. For that I believe I have to setup a Validate JWT policy on the API in APIM, using this guide below and use scopes/roles:-
https://learn.microsoft.com/en-us/azure/api-management/validate-jwt-policy
And seems like I will have to setup client credentials flow for customers to be able to obtain token from AADB2C, using the below KB:-
https://learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-custom-policy
Q1 - Firstly, is that the correct way of setting it up?
Secondly, with client credentials flow seems like customers will have to use the POST request (or PowerShell) like the one below to obtain the token:-
https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy>/oauth2/v2.0/token
But this will mean that I will have to document my B2C token endpoint in Developer portal documentation to advise customers on how to obtain token. I have 2 questions related to that:-
Q2 - Is advising/advertising B2C token endpoint good practice from security point of view?
Q3 - With client credentials flow, setting up the calling app APP Registration in B2C and providing related APP secret will become a manual process. This will remove the benefit of having Product/API subscriptions process automated through APIM and bring in the complexity of securely communicating the secret to customers. Is there a better way of doing this?
1 Reply
You need machine-to-machine tokens for external customers in addition to APIM subscription keys. Client credentials is appropriate only for confidential applications acting as themselves; it does not represent an interactive user. In the Azure AD B2C tenant, register the protected API and expose application permissions, register one confidential client per customer, grant the required permission, and have an administrator consent. The customer requests a token from the B2C policy token endpoint using client_credentials and the API’s .default scope. In APIM, keep the subscription-key check and add an inbound validate-jwt policy using the B2C OpenID configuration, expected audience, issuer, and required application claim or role. Store identifiers as named values and test invalid audience, expired token, missing role, and revoked secret. Client credentials in Azure AD B2C is documented as preview, and B2C is unavailable to new customers. For a new design, evaluate Microsoft Entra External ID before committing to B2C.
