Demystifying Web API Security in Azure

on YouTube ↗52m

" summary

Shows a concrete migration path: a .NET 8 API deployed to Azure, provisioned with Pulumi, using Microsoft.Identity.Web for token validation and Azure AD application roles to enforce action-level permissions. External on‑prem clients use client credentials (client id + secret), Azure-hosted services use managed identity to avoid secrets. On‑behalf-of flows prove infeasible for mixed on‑prem systems, so a roles+client‑credentials model is implemented and tested end‑to‑end and works for the demo.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to API security
2. 2:28Microservices architecture challenges
3. 5:59Zero trust security model
4. 10:32Authentication for internal services
5. 16:11Authorization for healthcare data
6. 22:14Demo setup and Azure AD config
7. 36:26Role-based authorization in practice
8. 40:43External client authentication
9. 47:27Managed identities in Azure
10. 51:25Key takeaways and Q&A

" related talks

• 01h 02mDemystifying Web API Security in AzureJimmy Bogard · NDC Sydney 2024
• 01h 05mBuilding Secure Microservices in AzureJimmy Bogard · NDC London 2023
• 53mWeb API Security With Azure Active DirectoryRainer Stropek, Simon Opelt · Global Azure Austria 2021
• 01h 03mBuilding Secure Microservices in AzureJimmy Bogard · NDC Oslo 2022
• 50mSecuring .NET Apps and Microservices in AzureVictoria Almazova · .NET fwdays'20 online conference
• 55mReal World Guide to Web API authentication on AzureHeather Downing · NDC Copenhagen 2019
• 41mReal World Guide to Web API authentication on AzureHeather Downing · NDC London 2020
• 58mLet's talk AuthJordan Knight · NDC Sydney 2016