Skip to content

Commit 8fb8d2a

Browse files
adrianhalladrianhall
authored
Merge pull request #96 from MartinPankraz/power-query-policy-add
power query access policy added
2 parents 10404cf + e8afad5 commit 8fb8d2a

File tree

2 files changed

+63
-0
lines changed

2 files changed

+63
-0
lines changed

‎examples/Handle Power Query access request to custom API.policy.xml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
<!--
2+
This policy sample demonstrates how to respond to Power Query request to support the "Organizational Account" login flow for a downstream API.
3+
4+
References:
5+
Expected response from Power Query docuementation:
6+
https://docs.microsoft.com/power-query/connectorauthentication#supported-workflow
7+
8+
How to map jwt token from AAD obtained via Power Query for SAP OData request and SAP OAuth Server
9+
https://github.com/Azure/api-management-policy-snippets/blob/master/examples/Request%20OAuth2%20access%20token%20from%20SAP%20using%20AAD%20JWT%20token.xml
10+
11+
IMPORTANT:
12+
- Power Query requires a verifiable resource for the login process. Hence a custom domain for APIM needs to be configured.
13+
- {{AADTenantID}} needs to be maintained via an APIM Named Value configuration.
14+
- a672d62c-fc7b-4e81-a576-e60dc46e951d is the default client id for Power Query. It should be verified from the documentation: https://docs.microsoft.com/power-query/connectorauthentication#supported-workflow
15+
-->
16+
<policies>
17+
<inbound>
18+
<base />
19+
<choose>
20+
<!-- if empty Bearer assume Power Query signin request as described here: https://docs.microsoft.com/power-query/connectorauthentication#supported-workflow -->
21+
<when condition="@(context.Request.Headers.GetValueOrDefault("Authorization","").Trim().Equals("Bearer"))">
22+
<return-response>
23+
<set-status code="401" reason="Unauthorized" />
24+
<set-header name="WWW-Authenticate" exists-action="override">
25+
<value>Bearer authorization_uri=https://login.microsoftonline.com/{{AADTenantId}}/oauth2/authorize?response_type=code%26client_id=a672d62c-fc7b-4e81-a576-e60dc46e951d</value>
26+
</set-header>
27+
</return-response>
28+
</when>
29+
<otherwise>
30+
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" require-scheme="Bearer">
31+
<openid-config url="https://login.microsoftonline.com/{{AADTenantId}}/.well-known/openid-configuration" />
32+
<audiences>
33+
<audience>https://your-custom-apim-domain</audience>
34+
</audiences>
35+
<issuers>
36+
<issuer>https://sts.windows.net/{{AADTenantId}}/</issuer>
37+
</issuers>
38+
<required-claims>
39+
<claim name="scp" match="all" separator=" ">
40+
<value>user_impersonation</value>
41+
</claim>
42+
</required-claims>
43+
</validate-jwt>
44+
</otherwise>
45+
</choose>
46+
</inbound>
47+
<backend>
48+
<base />
49+
</backend>
50+
<outbound>
51+
<base />
52+
<choose>
53+
<!-- URL rewrite in body only required for GET -->
54+
<when condition="@(context.Request.Method == "GET")">
55+
<!-- ensure downstream api metadata matches apim caller domain in Power Query -->
56+
<find-and-replace from="@(context.Api.ServiceUrl.Host +":"+ context.Api.ServiceUrl.Port + context.Api.ServiceUrl.Path)" to="@(context.Request.OriginalUrl.Host + ":" + context.Request.OriginalUrl.Port + context.Api.Path)" />
57+
</when>
58+
</choose>
59+
</outbound>
60+
<on-error>
61+
</on-error>
62+
</policies>

‎examples/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ Overview
2424
| <a href="Get OAuth2 access token from AAD and forward it to the backend.policy.xml">Get OAuth2 access token from AAD and forward it to the backend</a> | OAuth2 for authorization between the gateway and a backend |
2525
| <a href="Get OAuth2 access token from AAD using client id and certificate using key vault manage identity.xml">Get OAuth2 token using Certificate</a> | Get Certificat from KeyVault using managed identity to generate OAuth 2 token using certificate |
2626
| <a href="Get X-CSRF token from SAP gateway using send request.policy.xml">Get X-CSRF token from SAP gateway using send request</a> | X-CSRF token handling impemented in [SAP Principal Propagation policy](Request%20OAuth2%20access%20token%20from%20SAP%20using%20AAD%20JWT%20token.xml). |
27+
| <a href="Handle Power Query access request to custom API.policy.xml">Handle Power Query access request to custom API.policy</a> | Enable [Organizational Account login flow for Power Query](https://docs.microsoft.com/power-query/connectorauthentication#supported-workflow) for downstream APIs like SAP OData. |
2728
| <a href="List all inbound headers.policy.xml">List all inbound headers</a> | Lists all inbound headers and their values. |
2829
| <a href="Log errors to Stackify.policy.xml">Log errors to Stackify</a> | Error logging policy to send errors to Stackify |
2930
| <a href="Look up Key Vault certificate using Managed Service Identity and call backend.policy.xml">Look up Key Vault certificate using Managed Service Identity</a> | Look up and use a Key Vault certificate using Managed Service Identity and call the backend using it as a client certificate |

0 commit comments

Comments
 (0)