apim-policy-utils/policies/getOauth2.xml

An XML file scripts maniputaling and debugging tool targeting to help working with Azure APIM Policy files in xml format.

<!-- The policy defined in this file provides an example of using OAuth2 for authorization between the gateway and a backend. -->
<!-- It shows how to obtain an access token from Azure AD and forward it to the backend. -->

<!-- Send request to Azure AD to obtain a bearer token -->
<!-- Parameters: authorizationServer - format https://login.windows.net/TENANT-GUID/oauth2/token -->
<!-- Parameters: scope - a URI encoded scope value -->
<!-- Parameters: clientId - an id obtained during app registration -->
<!-- Parameters: clientSecret - a URL encoded secret, obtained during app registration -->

<!-- Copy the following snippet into the inbound section. -->

<policies>
    <inbound>
      <base />
        <send-request ignore-error="true" timeout="20" response-variable-name="bearerToken" mode="new">
          <set-url>{{authorizationServer}}</set-url>
          <set-method>POST</set-method>
          <set-header name="Content-Type" exists-action="override">
            <value>application/x-www-form-urlencoded</value>
          </set-header>
          <set-body>
            @{

    

    
                return $"client_id={{clientId}}&scope={{scope}}&client_secret={{clientSecret}}&grant_type=client_credentials";
  
                // For Azure AD v1, try return statement below
                // return $"client_id={{clientId}}&resource={{scope}}&client_secret={{clientSecret}}&grant_type=client_credentials";
            

}
          </set-body>
        </send-request>
  
        <set-header name="Authorization" exists-action="override">
          <value>
            @("Bearer " + (String)((IResponse)context.Variables["bearerToken"]).Body.As<JObject>()["access_token"];;)
        </value>
        </set-header>
  
        <!--  Don't expose APIM subscription key to the backend. -->
        <set-header exists-action="delete" name="Ocp-Apim-Subscription-Key"/>
    </inbound>
    <backend>
      <base />
    </backend>
    <outbound>
      <base />
    </outbound>
    <on-error>
      <base />
    </on-error>
  </policies>