Azure API管理是否支持按AAD用户分配特定API/方法权限？

Absolutely! Azure API Management (APIM) has you covered with granular access control for specific Azure AD (AAD) users to individual API operations—right in line with what you’re familiar with from AWS IAM and API Gateway. Let me walk you through the main ways to set this up:

Option 1: Direct User + Method Restriction via APIM Policies #

This is the most straightforward approach when you need to lock down access to specific users for specific HTTP methods (like your GET operations):

1. Enable AAD Authentication for Your API

   • In your APIM instance, navigate to the API you want to secure. Go to Settings > Authentication and add an Azure AD identity provider. Configure your AAD tenant ID, client ID, and other required details to ensure users must authenticate with their AAD accounts to access the API.

2. Add an Inbound Policy to Enforce Access Rules

   • Head to the Design tab of your API (or directly to the specific operation you want to restrict). Add an inbound policy that first validates the user's JWT token, then checks both the request method and the user's identity:

     <inbound>
         <!-- Validate the AAD JWT token -->
         <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized: Invalid token.">
             <openid-config url="https://login.microsoftonline.com/your-tenant-id/v2.0/.well-known/openid-configuration" />
             <audiences>
                 <audience>your-apim-client-id</audience>
             </audiences>
         </validate-jwt>
     
         <!-- Restrict to specific user and GET method -->
         <choose>
             <when condition="@(context.Request.Method.Equals("GET", StringComparison.OrdinalIgnoreCase) && context.User.Identity.Name.Equals("yash@example.com", StringComparison.OrdinalIgnoreCase))">
                 <!-- Allow access to proceed -->
             </when>
             <otherwise>
                 <return-response>
                     <set-status code="403" reason="Forbidden" />
                     <set-body>{"message": "You are not authorized to access this operation."}</set-body>
                 </return-response>
             </otherwise>
         </choose>
     </inbound>
     

   • Replace your-tenant-id, your-apim-client-id, and yash@example.com with your actual values. This policy will block any non-GET requests from the specified user, and block all requests from other users for that operation.

Option 2: Role-Based Access with AAD Custom Roles #

If you need to manage access for groups of users (instead of individuals), create a custom AAD role and use APIM policies to check for that role:

1. Create a Custom AAD Role

   • In the Azure Portal, go to Azure Active Directory > Roles and administrators > New custom role. Define a role (e.g., "APIM GET Access") with no management permissions—we’ll use this role purely for API access control. Assign the relevant users to this role.

2. Check Role Claims in APIM Policy

   • Update your API's inbound policy to validate the JWT token and check if the user has the custom role claim, then restrict to GET methods:

     <inbound>
         <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized: Invalid token.">
             <openid-config url="https://login.microsoftonline.com/your-tenant-id/v2.0/.well-known/openid-configuration" />
             <audiences>
                 <audience>your-apim-client-id</audience>
             </audiences>
             <!-- Require the custom role claim -->
             <required-claims>
                 <claim name="roles" match="any">
                     <value>APIM GET Access</value>
                 </claim>
             </required-claims>
         </validate-jwt>
     
         <!-- Restrict to GET methods only -->
         <choose>
             <when condition="@(context.Request.Method.Equals("GET", StringComparison.OrdinalIgnoreCase))">
                 <!-- Allow access -->
             </when>
             <otherwise>
                 <return-response>
                     <set-status code="403" reason="Forbidden" />
                     <set-body>{"message": "Only GET operations are allowed for your role."}</set-body>
                 </return-response>
             </otherwise>
         </choose>
     </inbound>
     

   • Now any user assigned to the "APIM GET Access" role can only call GET operations on your API.

A Quick Note on Azure RBAC for APIM #

Keep in mind that Azure's built-in RBAC roles for APIM are designed for managing the APIM service itself (e.g., creating APIs, modifying policies). They don’t control end-user access to API operations directly. For that, you’ll always want to combine AAD authentication with APIM inbound policies like the examples above.

内容的提问来源于stack exchange，提问作者Yash Mochi