Search code examples
oauth-2.0azure-active-directorypostmanazure-api-management

Which Client ID & Secret for Azure API Management Authorization Code Flow?

Background

I have an instance of Azure API Managment that is configured to use Azure AD as the OAuth 2.0 identity provider. In Azure AD, there are two App Registrations:

  • (A) Azure APIM App Registration
  • (B) Customer Application App Registration
    • Registered as Authorized client application of (A)
    • Customer application will authenticate against Azure AD before passing bearer token to Azure APIM.

In Postman, authenticating with Azure AD using Client Credentials grant type works fine using the Customer Application (B) client ID & secret to authenticate and call APIM endpoints. This simulates the customer's service authenticating with Azure AD.

Question

Which client ID and client Secret should the customer's developers use in Postman if they want to test APIM using Authorization Code as the Grant Type?

Should they use the APIM client ID and client secret (A), the customer application's client ID & client secret (B), or something else?

enter image description here

Solution

  • You can provide the developers with a separate client secret that is only meant for testing purposes, while the actual client application continues to use its own client secret for production usage. But make sure to maintain strict control over the client secrets and ensure that they are only shared with authorized parties and kept securely.

    You can use customer application's client ID & client secret (B) to test APIM using Authorization Code as the Grant Type in Postman.

    I tried to reproduce the same in my environment and got below results:

    I created two app registrations i.e, APIM App and ClientApp in my Azure AD tenant.

    Now, I exposed an API with scope access_as_user and added ClientApp as Authorized client application in APIM App like below:

    enter image description here

    You can find above scope in ClientApp's API permissions like this:

    enter image description here

    Now add those permissions in your application by following below steps:

    enter image description here

    Make sure to grant admin consent to added permissions like this:

    enter image description here

    Before generating access token via Postman, I added below environment variables:

    clientAppId: <appID of ClientApp>
clientAppSecret: <secret from ClientApp>
authUrl: https://login.microsoftonline.com/<tenantID>/oauth2/v2.0/authorize
authTokenUrl: https://login.microsoftonline.com/<tenantID>/oauth2/v2.0/token

    enter image description here

    To generate access token using Authorization Code as the Grant Type, I filled required fields like this:

    enter image description here

    When you select Get New Access Token button, it will ask you to sign in like below:

    enter image description here

    After successful authentication, I got access token like below:

    enter image description here

    To confirm that, you can decode the access token by pasting it in jwt.ms and check below claims:

    enter image description here