Can we use OAuth 2.0 in Azure Api management without using AAD ? We have created our Authentication server for OAuth 2.0 implementation.
2 Answers
If you build your client applications to talk directly to your OAuth2 server to obtain the JWT token, the API Management can validate that JWT Token before allowing access to your API. You can do this using the Validate-Jwt policy that looks like this if your OAuth server supports OpenId configuration:
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid."> <openid-config url="https://{Your OAuth Server}/.well-known/openid-configuration" /> <required-claims> <claim name="id" match="all"> <value>insert claim here</value> </claim> </required-claims> </validate-jwt> More examples of how to use this policy can be found here
1 Comment
dev.e.loper
Could you take a look at a related issue stackoverflow.com/q/63291339/37759
Yes, there is no requirement to use AAD, any OAuth 2.0 server should work.
