【Azire APIM】在凭据管理器中配置通用凭据提供程序 |

语言 Chinese, Simplified

SEO Title

先决条件

要在API管理中配置任何受支持的提供程序，请首先在标识提供程序中配置一个OAuth 2.0应用程序，该应用程序将用于授权API访问。有关配置详细信息，请参阅提供商的开发人员文档。

如果要创建使用授权码授权类型的凭据提供程序，请在应用程序中配置重定向URL（有时称为授权回调URL或类似名称）。对于该值，请输入https://authorization-manager.consent.azure-apim.net/redirect/apim/<您的电…;。
根据您的场景，配置应用程序设置，如作用域（API权限）。
最低限度，检索将在API管理中配置的以下应用程序凭据：应用程序的客户端ID和客户端机密。
根据提供者和您的场景，您可能需要检索其他设置，如授权端点URL或范围。

API凭据管理器支持Microsoft Entra身份提供程序，这是Microsoft Azure中提供身份管理和访问控制功能的身份服务。它允许用户使用行业标准协议安全登录。

笔记

目前，Microsoft Entra凭据提供程序仅支持Azure AD v1.0终结点。

Property	Description	Required	Default
Provider name	Name of credential provider resource in API Management	Yes	N/A
Identity provider	Select Azure Active Directory v1	Yes	N/A
Grant type	The OAuth 2.0 authorization grant type to use Depending on your scenario, select either Authorization code or Client credentials.	Yes	Authorization code
Authorization URL	`https://graph.microsoft.com`	Yes	N/A
Client ID	The application (client) ID used to identify the Microsoft Entra app	Yes	N/A
Client secret	The client secret used for the Microsoft Entra app	Yes	N/A
Login URL	The Microsoft Entra login URL	No	`https://login.windows.net`
Resource URL	The URL of the resource that requires authorization Example: `https://graph.microsoft.com`	Yes	N/A
Tenant ID	The tenant ID of your Microsoft Entra app	No	common
Scopes	One or more API permissions for your Microsoft Entra app, separated by the " " character Example: `ChannelMessage.Read.All User.Read`	No	API permissions set in Microsoft Entra app

您可以使用两个通用提供程序来配置连接：

通用提供者允许您根据特定需求使用自己的OAuth 2.0身份提供者。

笔记

如果您的身份提供程序支持，我们建议将通用OAuth 2.0与PKCE提供程序一起使用，以提高安全性。了解更多信息

支持的授权类型：授权码、客户端凭据【authorization code, client credentials】

Property	Description	Required	Default
Provider name	Name of credential provider resource in API Management	Yes	N/A
Identity provider	Select Generic Oauth 2 or Generic Oauth 2 with PKCE.	Yes	N/A
Grant type	The OAuth 2.0 authorization grant type to use Depending on your scenario and your identity provider, select either Authorization code or Client credentials.	Yes	Authorization code
Authorization URL	The authorization endpoint URL	No	UNUSED
Client ID	The ID used to identify an app to the identity provider's authorization server	Yes	N/A
Client secret	The secret used by the app to authenticate with the identity provider's authorization server	Yes	N/A
Refresh URL	The URL that your app makes a request to in order to exchange a refresh token for a renewed access token	No	UNUSED
Token URL	The URL on the identity provider's authorization server that is used to programmatically request tokens	Yes	N/A
Scopes	One or more specific actions the app is allowed to do or information that it can request on a user's behalf from an API, separated by the " " character Example: `user web api openid`	No	N/A