Authenticating API Requests in an Azure Logic App

Development, Security

One way to help understand how Active Directory, App Registrations, managed identities and Key Vaults work in Microsoft Azure is to look at a typical Logic App that authenticates itself with an API that provides data only to services registered with the organisation’s Active Directory.

The basic sequence for the authentication part of the Logic App here is this:

    1. Get a password from an Azure Key Vault.
    1. Get an OAuth token for the Logic App from Active Directory.
    1. Extract a value from the OAuth token and use it as the Authorizaion header value for HTTP requests to the API.

Note: For some reason, Microsoft had renamed Active Directory ‘Entra ID’, but I’ll still refer to it as Active Directory to avoid confusion.

Get Secret

The purpose of this step is to read a password that’s stored in an Azure Key Vault. Obviously our Logic App or its Resource Groups needs a ‘System-assigned managed identity’ to access this.

Use this configuration when creating a new connection:

  • Default Azure AD authentication for OAuth, because access to the Key Vault is managed by Azure AD.
  • TenantID of the organisation’s Active Directory instance.
  • Name of the Key Vault. There might be more than one in the Resource Group.

In order to access the Key Vault, the Logic App must be added to its Access policies.

Get Token

This step is an HTTP request to Azure AD to get a OAuth token, but we use the POST method. I believe the Logic App’s Resource Group will need an App Registration (essentially an Active Directory account) in order to do this.

The Logic App will make an HTTP request to the Active Directory, with the instance’s Tenant ID included in the URI:

https://login.microsoftonline.com/@{parameters('TenantId')}/oauth2/v2.0/token

The request payload will be something like:

grant_type=client_credentials&scope=api://@{parameters(MyApplicationScope')}/.default

For this, I’ve used basic username and password authentication.

AuthKey Variable

This stage is merely to extract a value from the token response and declare it as a variable for the Logic App. This value is to be used in the Authorization header field of subsequent HTTP requests to the external API.

The variable name is set as ‘AuthKey’, and the value is the following expression:

concat('Bearer ',body('Get_Token')?['access_token'])

Using the AuthKey Variable

This goes into the Authorization HTTP header of the REST request. The JSON for this step will look something like:

"inputs": {
      "method": "GET",
            "uri": "@{parameters('API-URL')}/products",
        "headers": { "Authorization": "@variables('AuthKey')" }
      }