link之家

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Learn more about Collectives

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Learn more about Teams

What is the difference between securing API through oAuth2.0 and validating jwt through inbound policies?

Ask Question

I am a bit confused in understanding the relationship between oAuth2.0 and validating jwt tokens with inbound policies in azure APIM. Are they altogether different or What additional security it applies when applied together. What if I just applied inbound policies for validating JWT tokens without oAuth2.0 configuration?

I'm using the APIM's


    validate JWT token

policy with User authorization set to None (so not using oAuth2.0 ). It takes the caller's JWT token, check its validity (scope/expiration/etc) and then I extract few fields to pass them in my backend as headers. I know it doesn't reply but maybe it can help you :) – Will May 19, 2022 at 13:07 I have done the same thing and it works all fine. I wanted to understand what benefits it will provide if I added oAuth2.0 as well. – Ankush Daga May 20, 2022 at 4:30

AFAIK, the process of using OAuth 2.0 authorization for APIM to protect APIs is:

Registering the App in Azure AD and granting the users to access the API from it with a valid OAuth token.

That token is added in the Authorization header of APIM's API requests.

That token can be validated using the


    validate-jwt

policy by APIM.

This Validate JWT policy is used to pre-authorize requests in APIM.

As Will told in the comment, validate-JWT policy enforces a JSON web token's existence and validity came from either a specified query parameter or a HTTP Header.

Please refer to the article that contains practical workaround for configuring the JWT validation policy at product level, API Level and All APIs level which explains that the OAuth 2.0 implementation is required to protect the APIs more securely.

validate-jwt policy is what actually enforces the token.

Associating API with OAuth/OpenID connect server achieves presence of corresponding metadata in API when you export it and enabled authentication UI in Developer portal, so that your customers can easily test your API.

If you're relying on APIM to validate JWT both are useful. But the latter is also useful in case when it is your backend and not APIM doing the validation.

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question . Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers .