0

Read value from header in api policy and pass it to api path param in azure policy

Hi I have a requirement where I use keycloak to authenticate my urls. Below is my policy

<policies>
    <inbound>
        <base />
        <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Authorization Failed. Check Bearer Token">
            <openid-config url="https://keycloak.digit.i/realms/{realmName}/.well-known/openid-configuration" />
        </validate-jwt>
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Now i have a requirement like I have to read a value from header and pass it to path param of the openid-config url . Below is something i want to achieve

<policies>
    <inbound>
        <base />
                <set-variable name="HostName" value="@{
            string [] HostNameHeader;
            
            context.Request.Headers.TryGetValue("Host", out HostNameHeader);    

            return HostNameHeader[0];
        }" />
        <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Authorization Failed. Check Bearer Token">
            <openid-config url="https://keycloak.digit.i/realms/{HostName}/.well-known/openid-configuration" />
        </validate-jwt>
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Kindly guide as how I can achieve it

0

1 Answer 1

0

I have reproduced the reported issue in my environment and got the below results-

Here I am using Azure AD for openid-config URL (https://login.microsoftonline.com/{aad-tenant}/.well-known/openid-configuration for v1 endpoint and https://login.microsoftonline.com/{aad-tenant}/v2.0/.well-known/openid-configuration for v2 endpoint) where aad-tenant is my Azure AD tenant-id.

I am reading tenant-id from request header and passing it to openid-config URL .

Policy-

<policies>
<inbound>
<base  />
<set-variable  name="aad-tenant"  value="@(context.Request.Headers.GetValueOrDefault("tenantId", ""))"  />
<validate-jwt  header-name="Authorization"  failed-validation-httpcode="401"  failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
<openid-config  url="@($"https://login.microsoftonline.com/{(string)context.Variables["aad-tenant"]}/.well-known/openid-configuration")"  />
</validate-jwt>
</inbound>
<backend>
<base  />
</backend>
<outbound>
<base  />
</outbound>
<on-error>
<base  />
</on-error>
</policies>

Test Result in API Management service-

enter image description here

enter image description here

enter image description here

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.