Examkin

Soru

Zorluk: OrtaDefine API Management Policies

You are developing an API gateway solution using Azure API Management (APIM). You have a backend API hosted on an Azure App Service that is secured with Microsoft Entra ID. You want to configure APIM to authenticate to the backend API using the APIM instance's system-assigned managed identity. Which of the following configurations and actions should you use to implement this authentication mechanism?

  1. Add the <authentication-managed-identity resource="https://backend-api.azurewebsites.net" /> policy to the <inbound> section of the APIM policy, and ensure the backend App Service accepts the APIM system-assigned managed identity.Cevap
  2. B
    Add the <authentication-managed-identity resource="https://backend-api.azurewebsites.net" /> policy to the <outbound> section of the APIM policy, and ensure the backend App Service accepts the APIM system-assigned managed identity.
  3. C
    Add the <authentication-managed-identity resource="https://backend-api.azurewebsites.net" client-id="00000000-0000-0000-0000-000000000000" /> policy to the <inbound> section of the APIM policy, while having only a system-assigned managed identity enabled on the APIM instance.
  4. D
    Configure a named value referencing a Key Vault secret containing the client secret, but do not grant the APIM system-assigned managed identity a Key Vault access policy with GET permission for secrets.

Cevap

Add the <authentication-managed-identity resource="https://backend-api.azurewebsites.net" /> policy to the <inbound> section of the APIM policy, and ensure the backend App Service accepts the APIM system-assigned managed identity.
To authenticate against a backend App Service using a system-assigned managed identity, the <authentication-managed-identity> policy must be placed in the <inbound> section of the API policy. By omitting the client-id attribute, APIM will automatically use the system-assigned identity to obtain a token for the specified resource. The backend App Service must also be configured to accept and authorize this identity.

Adım Adım Çözüm

1
Determine the correct policy section for setting the authentication headers.
The inbound section is selected because request authentication must happen before forwarding the request to the backend.
Outbound policies process the response after the backend call, which is too late to authenticate the request.
2
Select the correct identity configuration parameters.
The policy should use authentication-managed-identity without a client-id parameter.
Specifying client-id instructs the system to look for a user-assigned managed identity instead of the system-assigned identity.
3
Verify that backend service authorization is in place.
Ensure the system-assigned managed identity of the APIM instance is authorized in the backend App Service configuration.
Obtaining a token is only the first step; the backend must also trust and authorize that token.

Anahtar Kavram

Azure API Management policies allow dynamic request modification and authentication. The authentication-managed-identity policy can acquire an Entra ID token using either system-assigned or user-assigned managed identities. Inbound policies execute before forwarding requests, making them the correct location for authentication configuration.
Bu soruyu puanla

Konular

Define API Management Policies

Bu konudan daha fazla soru