APIM between internal services and a service broker

Hi Fred A,

The bellow recomendation may vary accord your environment: Internal Services to APIM:

• Your internal services will make requests to the APIM gateway.
• Configure authentication policies in APIM to ensure that only authorized requests are allowed. You can use OAuth, API keys, or other authentication mechanisms.
• Set up client authentication for your internal services. For example, issue API keys or tokens to each internal service.

APIM to Service Broker:

• APIM acts as an intermediary between your internal services and the service broker.
• Define an outbound policy in APIM to authenticate with the service broker. This could involve using client certificates, API keys, or other methods.
• Ensure that the service broker endpoint is secured and accessible only from APIM.

Flow:

• When an internal service wants to communicate with the external API:
• The internal service sends its request to the APIM gateway.
• APIM validates the request using the configured authentication policies.
• If authorized, APIM forwards the request to the service broker.
• The service broker processes the request and communicates with the external API.
• The response flows back through APIM to the internal service.

Suggestions:

• OAuth 2.0: Consider using OAuth 2.0 for secure authentication. APIM can act as an OAuth provider, issuing tokens to internal services.
• API Keys: Generate unique API keys for each internal service. Validate these keys in APIM before forwarding requests.
• Certificates: Use client certificates for mutual authentication between APIM and the service broker.
• Rate Limiting and Quotas: Implement rate limiting and quotas in APIM to prevent abuse.
• Logging and Monitoring: Set up logging and monitoring to track requests, errors, and performance.

References:

• https://video2.skills-academy.com/en-us/azure/api-management/authentication-authorization-overview

If the information helped address your question, please Accept the answer. Luis