Audience validation support for APIM

[Kirishikesan]

Problem

Description

API authentication with audience restriction in JWT (JSON Web Token) involves ensuring that the token is only accepted by the intended audience or recipients. The audience claim (aud) in a JWT specifies the intended recipients for the token. Here are the steps to handle API authentication with audience restriction using JWT.

Steps to Reproduce

Steps needed to check the validity of the fix is as follows.

1. Create an api
2. Update an api with audience.
   e.g:

{
  "id": "8a734d25-c4af-406e-acb5-b76ef1d40a9d",
  "name": "PizzaShackAPI",
  "description": "This is a simple API for Pizza Shack online pizza delivery store.",
  "context": "/pizzashack",
  "version": "1.0.0",
  "provider": "admin",
  "lifeCycleStatus": "PUBLISHED",
  .
  .
  .
  "audience": ["aud1","aud2"],
  "transport": [
    "http",
    "https"
  ],
  .
  .
  .
}

3. Deploy the api (Unless deployed the audience will not be validated)
4. Invoke the api with jwt with audience

Solution

Create audience field in api product and validate with the audience of the jwt token

Affected Component

APIM

Version

No response

Implementation

No response

Related Issues

No response

Suggested Labels

No response

[BiyonFernando]

Tested functionality of the Audience validation support as bellow.

User can turn on audience validation from Application Level Security in Runtime tab as bellow.

When access token embedded in the api request do not contain required audience value it will respond as bellow. Otherwise it will pass through.

This behaviour is tested having multiple applications subscribes to single api as well. In that case multiple audience values needed to entered.

This behaviour is tested for api products as well.