Automatically create and manage Dev Portal applications in Azure AD with Dynamic Client Registration

In Azure, create the main application:

1. In Azure Active Directory, click App registrations and then click New registration.

2. Enter a name for the application.

3. Ensure Single tenant only is selected for Supported account types.

4. Click Register.

5. On the application view, go to Manage > API permissions and click Add a permission.

6. Click Microsoft Graph.

7. Select the following permissions:
   • User.Read under Delegated permissions
   • Application.ReadWrite.OwnedBy under Application permissions

8. Click Add permissions.

9. Once added, click Grant admin consent. An administrator with Global Admin rights is required for this step.

10. Select Certificates & secrets and then create a client secret and save it in a secure location. You can only view the secret once.

11. In the Overview view, copy your Directory (tenant) ID and Application (client) ID, then export them:

    export TENANT_ID='YOUR-AZURE-TENANT-ID'
    export CLIENT_ID='YOUR-AZURE-CLIENT-ID'
    export CLIENT_SECRET='YOUR-AZURE-CLIENT-SECRET'
    export ISSUER_URL="https://sts.windows.net/$TENANT_ID"

    Copied!

After configuring Azure, you can integrate it with the Dev Portal for Dynamic Client Registration (DCR). This process involves two main steps: first, creating the DCR provider, and second, establishing the authentication strategy. DCR providers are designed to be reusable configurations. This means once you’ve configured the Azure DCR provider, it can be used across multiple authentication strategies without needing to be set up again.

1. Create a DCR provider using the /v2/dcr-providers endpoint:

   curl -X POST "https://us.api.konghq.com/v2/dcr-providers" \
        --no-progress-meter --fail-with-body  \
        -H "Authorization: Bearer $KONNECT_TOKEN" \
        --json '{
          "name": "Azure DCR Provider",
          "provider_type": "azureAd",
          "issuer": "'$ISSUER_URL'",
          "dcr_config": {
            "initial_client_id": "'$CLIENT_ID'",
            "initial_client_secret": "'$CLIENT_SECRET'"
          }
        }'

   Copied!

2. Export the DCR provider ID from the response:

   export DCR_PROVIDER_ID='YOUR-DCR-PROVIDER-ID'

   Copied!

3. Create an authentication strategy using the /v2/application-auth-strategies endpoint:

   curl -X POST "https://us.api.konghq.com/v2/application-auth-strategies" \
        --no-progress-meter --fail-with-body  \
        -H "Authorization: Bearer $KONNECT_TOKEN" \
        --json '{
          "name": "Azure DCR Auth Strategy",
          "display_name": "Azure DCR Auth Strategy",
          "strategy_type": "openid_connect",
          "configs": {
            "openid-connect": {
              "issuer": "'$ISSUER_URL'",
              "credential_claim": [
                "appid"
              ],
              "scopes": [
                "openid"
              ],
              "auth_methods": [
                "client_credentials",
                "bearer",
                "session"
              ]
            }
          },
          "dcr_provider_id": "'$DCR_PROVIDER_ID'"
        }'

   Copied!

4. Export the auth strategy ID from the response:

   export AUTH_STRATEGY_ID='YOUR-AUTH-STRATEGY-ID'

   Copied!

Now that the application auth strategy is configured, you can apply it to an API using the /v3/apis/{apiId}/publications/{portalId} endpoint:

curl -X PUT "https://us.api.konghq.com/v3/apis/$API_ID/publications/$PORTAL_ID" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "visibility": "public",
       "auth_strategy_ids": [
         "'$AUTH_STRATEGY_ID'"
       ]
     }'

Now that DCR is configured, you can create an application with Dynamic Client Registration by using a developer account.

1. Navigate to your Dev Portal URL and log in with your developer account.

2. Select an API and click Use this API.

3. Complete the Create New Application modal with your application name, authentication strategy, and description.

4. After the application is created, the Client ID and Client Secret will be displayed.
   Make sure to store these values, as they will only be shown once.

5. After the application is created, it will appear in your IdP. From your IdP organization, select Applications from the sidebar. You will see the application created in the Dev Portal, along with its corresponding Client ID.

For developers to authorize requests, they must attach the client ID and secret pair obtained previously in the header. They can do this by using any API client, such as Insomnia, or directly using the command line:

curl "$KONNECT_PROXY_URL/$ROUTE_PATH" \
     --no-progress-meter --fail-with-body \
     -H "Authorization: Basic $CLIENT_ID:$CLIENT_SECRET" \
     -H "Content-Type: application/json"

You can also request a bearer token from Azure using the following command, targeting the OAuth 2.0 v1 token endpoint:

curl --request GET \
  --url https://login.microsoftonline.com/TENANT_ID/oauth2/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=CLIENT_ID \
  --data 'scope=https://graph.microsoft.com/.default' \
  --data 'client_secret=CLIENT_SECRET'