Search code examples
azure-web-app-service.net-6.0azure-api-managementazure-managed-identity

Authenticating webapp using Azure Managed Identity without access hosting environment

My expectation here is that this is impossible, but I figure I'd ask just to be sure.

Our setup is a bit unique. We have an Azure environment which will be hosting various resources, among which is API Management (APIM). We are looking to secure access to APIM using a Managed Identity (MI). We are also looking to connect to APIM through a .NET6 webapp.

The challenge is that this webapp will be deployed into a different environment that we have no control over, or access to.

Is there any way to use a MI in this scenario? From my understanding, the typical workflow is to use DefaultAzureCredential to access the MI (see here), however, I believe that requires MI to be configured in the same environment the webapp is deployed to. Is there a way to authenticate against the MI using a "traditional" approach of a ClientID/ClientSecret, or is that essentially the exact thing that MI is trying to prevent?

Solution

  • For a web app to use MI, we need to configure few things in Azure App Service.

    We need to set the Identity Provider in the Authentication.

    enter image description here

    enter image description here

    The above is possible only if the WebApp is deployed in the Azure App Service and the hosting environment is known.

    AFAIK, we do not have a direct way to authenticate a web app using Managed Identity without the hosting Environment.

    We can use Managed Identity when we build our application using Azure App Service, Azure Functions, Azure VM, AKS, Azure Container Instances, Azure Storage, Logic Apps.

    I believe that requires MI to be configured in the same environment the webapp is deployed to. Is there a way to authenticate against the MI using a "traditional" approach of a ClientID/ClientSecret,

    One alternative way to achieve this is by registering the App in the Azure Active Directory.

    • Navigate to the APIM instance in Azure Portal, if you don't have create a new APIM.

    • Enable Azure AD from the Portal overview as shown below.

    enter image description here

    enter image description here

    • Identities will be created with ClientID.

    enter image description here

    • New App with same name as APIM will be registered in the AAD.

    enter image description here

    • In APIM, add the new Group.I got the error as shown below.

    enter image description here

    • To add new Azure AD Group, we need to have Directory.Read.All permissions for Azure Active Directory Graph in AAD => API permissions.

    enter image description here

    • We can also manually register the App in AAD.