<p>I have deployed an application on Azure kubernetes without authentication and I have the Azure API management in front of the API.</p>
<p>How do I use the Azure API management to authenticate kubernetes APIs?</p>
<pre><code>&lt;validate-jwt header-name=&quot;Authorization&quot; failed-validation-httpcode=&quot;401&quot; failed-validation-error-message=&quot;Unauthorized. Access token is missing or invalid.&quot;&gt;
    &lt;openid-config url=&quot;https://login.microsoftonline.com/contoso.onmicrosoft.com/.well-known/openid-configuration&quot; /&gt;
    &lt;audiences&gt;
        &lt;audience&gt;25eef6e4-c905-4a07-8eb4-0d08d5df8b3f&lt;/audience&gt;
    &lt;/audiences&gt;
    &lt;required-claims&gt;
        &lt;claim name=&quot;id&quot; match=&quot;all&quot;&gt;
            &lt;value&gt;insert claim here&lt;/value&gt;
        &lt;/claim&gt;
    &lt;/required-claims&gt;
&lt;/validate-jwt&gt;
</code></pre>

<p>How are you authenticating your APIM url?</p>
<p>Here is a raw way of achieving authentication</p>
<ol>
<li>Generate a JwT from Azure AD (this could be your Web UI)</li>
<li>Enable OAuth2 for your APIM</li>
<li>While calling APIM from your UI JwT token will be passed</li>
<li>Upon receiving the token at the APIM, create an inbound policy to Validate the JwT <a href="https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies</a></li>
<li>Once the JwT is validated call the backend Kubernetes deployed endpoints.</li>
<li>You may want to restrict your ingress controller to only accept traffic from the APIM</li>
<li>Your http context will contain the user information from the JwT token at the api endpoint</li>
<li>If you want you can further use this info from #7 at your middleware time write your custom auth logic.</li>
</ol>
