[Question] How to set up AAD B2C for main API and AAD for docs?

[intility]

[Question] How to set up AAD B2C for main API and AAD for docs?

[Bulga-xD]

@leranjun Keep in mind that Swagger is just documentation of your application nothing more, Swagger is just so simple front-end application for your backend application where you can visualize your endpoints. There is no "Swagger Api". Regarding the documentation, I will try soon as possible to add one on how it works. Also, we manage to create awesome integration with the URM application(User Rights Management). Where we are getting the authentication from Azure via this project and after that, we are sending the token to the URM. In this way, we are able to check which user have permission for specific endpoints (Permissions from centralized application)

[leranjun]

Gotcha, super helpful! I think I'll need to dig a bit deeper into what I actually want to achieve. Thank you both for the comments.

[JonasKs]

I'll close this for now. Please don't hesitate re-opening or creating a new issue if you have more questions, @leranjun

[JonasKs]

Unfortunately the documentation for B2C is lacking. @kristiqntashev added tests and support - would you be up to document Azure setup too? Or you, @leranjun if you made it work?

As for APIs to be restricted, you should use roles in Azure. There's docs on how to do that here.

[leranjun]

Thanks for the reply! Is it possible for only the Swagger docs to be restricted, though? Or does it only apply to main API routes? I don't seem to see a dependency configuration for docs.

[JonasKs]

Swagger is just a client to call your APIs, there's no "swagger API" and "normal API". So if I interpret your question correctly, and you want to hide swagger docs behind authentication, then no, that's not possible (and would be security by obscurity, which is pretty useless). Your APIs should have authentication, and swagger is just a client that can call your APIs, and help you fetch a valid token.

[JonasKs]

Of course you can always host a custom swagger, or customize the one fastapi generates, but there's no security in that.

See https://fastapi.tiangolo.com/advanced/extending-openapi/.

[JonasKs]

@kristiqntashev that sounds awesome! Let me know if you need any help with docs! 😊