An organization is deploying an API to Azure API Management (APIM). The security requirements specify that all client applications must authenticate using mutual TLS (client certificates) at the APIM gateway. You need to configure APIM to receive and validate the client certificates. Which two actions should you perform?
- Enable the Negotiate client certificate setting in the gateway domain configuration of the API Management instance.Answer
- Add an inbound policy that validates the client certificate properties using the context.Request.Certificate variable.Answer
- CAdd an outbound policy that validates the client certificate properties using the context.Request.Certificate variable.
- DConfigure a user-assigned managed identity to authenticate the incoming client requests at the gateway.
Answer
To implement client certificate authentication, you must enable the Negotiate client certificate setting in the gateway domain configuration and add an inbound policy that validates the certificate using the context.Request.Certificate variable.
To successfully authenticate incoming clients using mutual TLS, the API Management gateway must negotiate the client certificate. This is configured at the gateway domain settings. Then, to inspect and enforce authorization rules, an inbound policy must be added to validate the certificate's thumbprint or other properties using the request context.
Step-by-Step Solution
Key Concept
Client certificate authentication at the API Management gateway requires both enabling TLS client certificate negotiation at the domain configuration level and validating the certificate properties within an inbound policy.