Connect An Azure AD-Secured API Using Application ID

This blog describes the steps to connect an Azure AD-secured API with a client ID. These steps will be helpful to call the secured API with the application access.

Introduction

 

This blog describes the steps to connect an Azure AD-secured API with a client ID. These steps will be helpful to call the secured API with the application access. 

 

Prerequisites

To follow the steps in this article you should have:

• An Azure AD tenant.
• An API hosting azure service.
• Access to register the app in Azure AD.

Overview

1. Create a serverless API and authenticate it using Azure AD.
2. Register an application in Azure AD to represent the API and create the secret key to access the API.
3. If required, provide permission to the Azure app, to access specific scope.
4. Create a bearer token using App ID and access the resource.

Register an application in Azure AD to represent the API:

• Go to the Azure portal. Create the APP from New registration under Active Directory. For more details, please visit here.
• Create the secret key to access the API.

Create a Secured API

Create a sample API and host the same into the Azure function. Authenticate the same using the Azure active directory. Now, the API is secured and only the users who have been part of AD can access the API.

 

To secure the API, Go to the Azure function, select the Authentication and Authorization under the security section.

 

Select the Azure Active directory, and select the app that we created above. For more details, please visit here.

 

Sample API

 

https://blogs.azurewebsites.net. This API is AD protected, hence it cannot be accessed without proper authentication.

 

Create a Bearer Token and Access the Resource

To create the access token, use the below details:

URL: https://login.microsoftonline.com/{{Tenant}}/oauth2/token
Method: POST
Headers: Content-Type: application/x-www-form-urlencoded
Body:
{
   grant_type:client_credentials
   client_id: {{App ID}}
   client_secret:{{secret key}}
   resource:{{App ID}}
}

Response

 

The following is an example of the response:

HTTP/1.1 200 OK
{
   "token_type": "Bearer",
   "expires_in": "3599",
   "ext_expires_in": "3599",
   "expires_on": "",
   "not_before": "",
   "resource": "",
   "access_token": ""
}

The access token in the response will be used to access the resource.

API Url: https://blogs.azurewebsites.net
Headers: Authorization: Bearer {{access_token}}

Bingo! Now you can access the API.

 

Cheers! Happy Coding!