One Auth to Rule them All: Centralizing Authentication with Azure and API Gateway
summary
Company standardizes internal auth by issuing Azure AD SSO so frontends get an id token and an Azure AD access token (with app-scoped roles), then routes all calls through AWS API Gateway where a Lambda authorizer validates the access token, decodes roles and sets an x-das-groups header forwarded to backends for app-level authorization. Built solution removes per-service Graph calls and Redis cache hits but exposes limits: HTTP header size (~8KB), API Gateway 29s timeout, no streaming/gRPC.
AI-written summary · about
chapters (9)
- 0:00Centralized authentication intro
- 2:32Why centralize auth
- 7:34Auth with AWS API Gateway
- 11:31Simplifying JWT claims
- 17:54Azure AD token validation fixes
- 20:47Azure AD permission modeling
- 25:42Final architecture & token flow
- 27:29Key caveats
- 30:05Q&A on AWS Cognito
related talks
26mOne Auth Gateway to authenticate them all
58mLet's talk Auth
01h 30mUnlocking the Potential: Federated authentication from Azure to AWS
52mDemystifying Web API Security in Azure
59mAchieving Zero Trust with AWS application networking
16mAPI Security Challenges and How to Address Them
53mWeb API Security With Azure Active Directory
41mBuilding better security for your API platform using Azure API Management