​Upstream Azure AD Service Auth Policy

This policy adds a Authorization header to the upstream request that allows using Azure AD to authenticate requests to your origin server. This is a useful means of securing your origin server so that only your Zuplo gateway can make requests against it.

Using this policy allows you to delegate authentication and authorization to your gateway without writing any code on your origin service. For instructions on how to configure Azure AD authentication see Configure your App Service or Azure Functions app to use Azure AD login.

​Configuration

The configuration shows how to configure the policy in the 'policies.json' document.

{
  "name": "my-upstream-azure-ad-service-auth-inbound-policy",
  "policyType": "upstream-azure-ad-service-auth-inbound",
  "handler": {
    "export": "UpstreamAzureAdServiceAuthInboundPolicy",
    "module": "$import(@zuplo/runtime)",
    "options": {
      "activeDirectoryClientId": "20edbb34-13e9-42d0-a63c-1b6a0a20d02d",
      "activeDirectoryClientSecret": "$env(ACTIVE_DIRECTORY_CLIENT_SECRET)",
      "activeDirectoryTenantId": "b8e4141e-31f4-43e3-9a96-f97f3eba1eea",
      "expirationOffsetSeconds": 300,
      "tokenRetries": 3
    }
  }
}

​Policy Configuration

• name <string> - The name of your policy instance. This is used as a reference in your routes.
• policyType <string> - The identifier of the policy. This is used by the Zuplo UI. Value should be upstream-azure-ad-service-auth-inbound.
• handler.export <string> - The name of the exported type. Value should be UpstreamAzureAdServiceAuthInboundPolicy.
• handler.module <string> - The module containing the policy. Value should be $import(@zuplo/runtime).
• handler.options <object> - The options for this policy. See Policy Options below.

​Policy Options

The options for this policy are specified below. All properties are optional unless specifically marked as required.

• activeDirectoryTenantId (required) <string> - Azure Active Directory Tenant ID.
• activeDirectoryClientId (required) <string> - The Application (client) ID of the Azure AD App Registration.
• activeDirectoryClientSecret (required) <string> - The client secret of the Azure AD App Registration.
• tokenRetries <number> - The number of times to retry fetching the token in the event of a failure.. Defaults to 3.
• expirationOffsetSeconds <number> - The number of seconds less than the token expiration to cache the token. Defaults to 300.

​Using the Policy

Read more about how policies work