Azure API Management Policies

azure-api-management/oauth-client-credentials-policy.xml

@@ -0,0 +1,61 @@
+<!-- Based on https://github.com/Azure/api-management-policy-snippets/blob/master/examples/Backend%20OAuth2%20Authentication%20With%20Cache.policy.xml  -->
+<!-- The policy defined in this file provides an example of using OAuth2 for authorization between
+the gateway and a backend -->
+<!-- It shows how to obtain an access token from AAD, cache it for a configurable amount of time and
+forward it to the backend. -->
+<!-- The sample is based on the original OAuth2 example provided previously -->
+
+<!-- Send request to AAD to obtain a bearer token -->
+<!-- Parameters: authorizationServer - format https://login.windows.net/TENANT-GUID/oauth2/token -->
+<!-- Parameters: scope - a URI encoded scope value -->
+<!-- Parameters: clientId - an id obtained during app registration -->
+<!-- Parameters: clientSecret - a URL encoded secret, obtained during app registration -->
+
+
+<!-- Copy the following snippet into the inbound section. -->
+<policies>
+  <inbound>
+    <base />
+    <cache-lookup-value key="@(" bearerToken")" variable-name="bearerToken" />
+    <choose>
+      <when condition="@(!context.Variables.ContainsKey(" bearerToken"))">
+        <send-request ignore-error="true" timeout="20" response-variable-name="accessTokenResult"
+          mode="new">
+          <set-url>{{authorizationServer}}</set-url>
+          <set-method>POST</set-method>
+          <set-header name="Content-Type" exists-action="override">
+            <value>application/x-www-form-urlencoded</value>
+          </set-header>
+          <set-body>@{
+            return
+            "client_id={{clientId}}&client_secret={{clientSecret}}&grant_type=client_credentials";
+            }</set-body>
+        </send-request>
+        <set-variable name="accessToken" value="@(((IResponse)context.Variables[" accessTokenResult"]).Body.As<JObject>())" />
+        <set-variable name="bearerToken" value="@((string)((JObject)context.Variables[" accessToken"])[" access_token"])" />
+        <set-variable name="tokenDurationSeconds" value="@((int)((JObject)context.Variables[" accessToken"])[" expires_in"])" />
+        <cache-store-value key="bearerToken" value="@((string)context.Variables[" bearerToken"])"
+          duration="@((int)context.Variables[" tokenDurationSeconds"])" />
+      </when>
+    </choose>
+    <set-header name="Authorization" exists-action="override">
+      <value>@("Bearer " + (string)context.Variables["bearerToken"])</value>
+    </set-header>
+    <!--  Don't expose APIM subscription key to the backend. -->
+    <set-header name="Ocp-Apim-Subscription-Key" exists-action="delete" />
+  </inbound>
+  <backend>
+    <base />
+  </backend>
+  <outbound>
+    <choose>
+      <when condition="@(context.Response.StatusCode == 401 || context.Response.StatusCode == 403)">
+        <cache-remove-value key="bearerToken" />
+      </when>
+    </choose>
+    <base />
+  </outbound>
+  <on-error>
+    <base />
+  </on-error>
+</policies>