Hotspot Question You configure OAuth2 authorization in API Management as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on…

Question

Exhibits

Answer Area

• Authorization codeYes
• ImplicitNo
• Resource owner passwordNo
• Client credentialsNo
• GETYes
• POSTNo

Explanation

This hotspot question tests knowledge of OAuth2 authorization configuration in Azure API Management, specifically how OAuth2 server settings affect developer portal behavior and API call authorization requirements.

Approach. In Azure API Management, when you configure an OAuth2 authorization server and associate it with an API, the Developer Portal uses this configuration to display an 'Authorization' button allowing developers to obtain tokens interactively. The 'validate-jwt' policy must still be explicitly added to enforce token validation on incoming API calls - simply configuring OAuth2 in the APIM settings does NOT automatically enforce token validation. The OAuth2 configuration in the portal is primarily for documentation and developer experience purposes, enabling the developer console to acquire tokens, but the actual enforcement requires a policy. Therefore: (1) Developers CAN use the authorization server in the Developer Portal to obtain an access token for testing, and (2) The 'validate-jwt' inbound policy must be added separately to actually enforce token validation on API requests, meaning calls without a valid token will NOT be automatically rejected without the policy in place.

Concept tested. Azure API Management OAuth2 configuration - understanding the distinction between associating an OAuth2 server for developer portal use versus enforcing JWT validation via the validate-jwt policy. The key insight is that OAuth2 server association enables the developer console experience but does not enforce security by itself.

Reference. https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad and https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT

No community discussion yet for this question.