We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Demystifying Web API Security in Azure - Jimmy Bogard - NDC Sydney 2024
azure api security with managed identities, azure active directory, oauth 2.0, client credentials, authorization code flow, roles, permissions, and more, explained in this informative talk.
- Managed identities simplify API security by eliminating the need for client secrets and certificates.
- Azure Active Directory (AAD) provides a robust identity and access management system that integrates well with .NET.
- OAuth 2.0 is a standard authorization framework that allows for secure delegation of access to resources.
- Client credentials flow is suitable for back-end applications that don’t interact with users.
- Authorization code flow is suitable for interactive client applications.
- On-premises applications can use client credentials flow or authorization code flow with PKCE.
- Roles and permissions can be defined and assigned at the Azure resource level.
- Tokens can include claims that reflect a user’s roles and permissions.
- Azure Identity Provider can be used to manage and issue tokens.
- Authentication and authorization are separate concerns that should be treated independently.
- Token acquisition and validation are critical steps in the authentication and authorization process.
- Roles and permissions should be assigned to users and groups at the Azure resource level.
- Azure AD groups can be used to manage access to resources.
- Tokens can be used to acquire access to Azure resources and services.
- Azure Identity Provider can issue tokens for both client and server-side scenarios.