The Azure SaaS Development Kit (ASDK) provides a reference architecture, deployable reference implementation and tools to help developers, startups, ISVs and Enterprises deliver their applications as a SaaS service. A platform for platform creators.
Admin API now requires a bearer token issued from azure ad b2c to communicate with it.
Because of b2c limitations, communication between the admin api and permissions api is secured via mutual tls certificate auth. The admin api will fetch the certificate from a keyvault and will use it when it issues a request to the permissions api, which will verify the thumbprint matches what it expects before returning any data.
Still To do on the admin api:
Implement data authorization based on signed in user
Figure out what scopes we want to authorize for each route
Add in options for turning back on OBO flow if user wanted to use AAD instead of b2c
Admin API now requires a bearer token issued from azure ad b2c to communicate with it.
Because of b2c limitations, communication between the admin api and permissions api is secured via mutual tls certificate auth. The admin api will fetch the certificate from a keyvault and will use it when it issues a request to the permissions api, which will verify the thumbprint matches what it expects before returning any data.
Still To do on the admin api: