Secure Web Api Call (hosted in Azure APIM) from Portals/Power pages using Azure AD B2C / extend token information

(0) Share

Report

Posted on by michelcarlo

Hi all,

I've been digging what are the options and how to secure an API call from Portals/Pages to external APIs.

The Portal already uses Azure AD B2C for authentication and have some custom information in their B2C tokens, but so far I could not figure out how to use it (or if I should use B2C tokens to authenticating against external APIs).

So far I could obtain an JWT token from Portals using this approach: https://carldesouza.com/jwt-json-web-tokens-and-power-apps-portals/

However I can't find references on how to extend or add more info to this token as it seems generated automatically by Portals (and regardless of the authentication method, which makes this token being different from the B2C one, similarly to this thread: https://powerusers.microsoft.com/t5/Power-Apps-Portals/Secure-an-external-net-5-0-WebAPI-using-PowerApps-portal-token/td-p/1391818)

Does someone know how to extend this token generated by portal or how to use the B2C token instead?

Thanks

Categories:

Customize & extend

I have the same question (0)

All responses (2)

Answers (0)

Peragin 160 on at

Like (1)

Report

Hi @michelcarlo ,

You won't be able to extend the token, we tried!

For our use case where we were grabbing data for the logged in user from a 3rd party API that we had wrapped in an Azure function. Using the power pages token, we were able to extract the username (guid) from the token payload through an APIM inbound policy after validating the JWT. We were then able to pass this guid to the backend API. The Azure function got the UPN for the logged on portal user from Graph and passed this to the 3rd party API and handled the return - passing it back to APIM and the portal.
The backend API (Azure function) and APIM was secured using managed ID.
Hope this helps.

Was this reply helpful? Yes No
michelcarlo 66 on at

Like (0)

Report

@KH_2437 thanks for your response. That seems the way to go.

Was this reply helpful? Yes No