123. Connecting API Management to a Backend Without Secrets

https://www.betabit.nl/en/betatalks

Yvo and Christian discuss how to connect Azure API Management to an App Service using managed identities instead of static secrets. They explain how this approach enhances security and simplifies management. Yvo demonstrates the configuration of authentication and permissions to ensure tokens are used correctly. The setup was tested successfully, confirming a secure, secretless connection.

Links for more information:
https://learn.microsoft.com/en-us/ent...

Timestamps:
00:00 - Introduction Azure Managed Identities
00:31 - The traditional approach using secrets and API keys
02:18 - The improved approach using managed identities
03:30 - Configuration Pieces
05:00 - Demo API and describing authentication setup
10:40 - Demo API Management Service
12:30 - Explanation of permissions required for the service principal and use of admin consent
14:06 - Conclusion of the demo
16:19 - Using XML policies in API Management
18:02 - Conclusion and wrap-up

There is more to come!

https://www.betabit.nl/en