Azure APIM获取终端用户身份可行性及适用场景问询

1. Can APIM pass the end user's identity to an AD-authenticated internal backend? #

Absolutely! You can configure APIM to capture and forward the end user's identity to your backend service. Here's how it typically works:

• When the end user authenticates to APIM: If your end users authenticate via Azure AD (using OAuth2/OpenID Connect), APIM will receive a JWT token containing the user's core claims. You can use APIM policies to extract these claims and pass them to the backend via custom HTTP headers, or even forward the entire JWT token for the backend to validate directly.
• Example policy snippet:

  <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
      <openid-config url="https://login.microsoftonline.com/your-tenant-id/v2.0/.well-known/openid-configuration" />
      <required-claims>
          <claim name="aud">
              <value>your-apim-api-client-id</value>
          </claim>
      </required-claims>
  </validate-jwt>
  <!-- Forward user's Object ID to backend via a custom header -->
  <set-header name="X-End-User-OID" exists-action="override">
      <value>@{return context.Request.Headers.GetValueOrDefault("Authorization", "").Split(' ')[1].AsJwt()?.Claims.First(c => c.Type == "oid").Value;}</value>
  </set-header>
  

• Backend authentication note: If your backend uses Azure AD for its own authentication, you can have APIM authenticate to the backend using its managed identity or client credentials, while still passing the end user's identity details via headers or embedded claims. The backend can then use these details for fine-grained authorization or auditing.

2. Is this scenario within APIM's scope? #

Yes, this is a completely valid and common use case for Azure APIM. APIM is built to act as a central gateway for both end-user-initiated calls and application-to-application calls. It excels at handling authentication, authorization, traffic shaping, and observability for APIs exposed to any consumer—whether that's individual internal employees, external customers, partner applications, or internal services.

3. Does APIM favor application-to-app calls over end-user calls? #

Not at all! APIM supports both scenarios equally well, and includes features specifically tailored for end-user-driven workflows:

• Developer portals: Build a self-service portal where end users/developers can discover, subscribe to, and test your APIs.
• Per-user rate limiting: Apply usage quotas or rate limits based on individual user identities to prevent abuse and ensure fair access.
• User-specific authorization: Use policies to enforce role-based access control (RBAC) based on the end user's Azure AD roles or custom claims.
• Identity propagation: As mentioned earlier, seamlessly pass user identities from APIM to your backend services for personalized experiences or compliance tracking.

That said, APIM also shines for application-to-application scenarios—supporting client credentials flow, managed identities, and service-level rate limiting. It's a versatile gateway that adapts to whatever API consumption model you need.

内容的提问来源于stack exchange，提问作者JakeUT