how to create access_token to access ARM API for a user and not the service principal

Question

I need to secure my ML endpoints in azure based on user credentials and user accesses.

Right now, we are authorising based on service principal account but now we want to test for each user.

I can see the documentation for REST API to get the access_token to make Rest API requests to ARM (azure resource manager) for a service principal account but not for any azure user.

So any pointers on whether this can be achieved or not?

so, basically what I am trying to do is this :

1. when a user tries to access the endpoint, its his credentials which needs to be validated whether he can access the API or not,
2. so what I see it that any number of users can be added to a workspace but not all user might have access to the scoring endpoint request.
3. in that case, only allowed user should be able to make the request and other users should be denied.

Answer 1

To generate access token based on user credentials, you can make use of ROPC flow.

While calling API with that token, validation will be done depending on Azure user's roles or permissions.

I tried to reproduce the same in my environment and got below results:

I created one Azure AD application and granted consent to API permissions like below:

I got the access token successfully via Postman using user credentials with parameters like below:

POST https://login.microsoftonline.com/<tenantID>/oauth2/v2.0/token

client_id:44xxxx450-xxxx-4be1-axxb-e7xxxxxxxx
grant_type:password
scope:https://management.azure.com/.default
username:[email protected]
password:xxxxxxxxx

Response:

Using the above access token, user can make Rest API requests to Azure Resource Manager successfully like below:

//To fetch list of resource groups present in the subscription
GET https://management.azure.com/subscriptions/<subscriptionID>/resourceGroups?api-version=2021-04-01

Response:

Please note that, the above user has Contributor role on the subscription that allowed user to make the request.

Now, I generated token for different Azure user via Postman in the same way as below:

POST https://login.microsoftonline.com/<tenantID>/oauth2/v2.0/token

client_id:44xxxx450-xxxx-4be1-axxb-e7xxxxxxxx
grant_type:password
scope:https://management.azure.com/.default
username:[email protected]
password:xxxxxxxxx

Response:

When the user included above token to make the same request, access is denied with 403 Forbidden error like below:

GET https://management.azure.com/subscriptions/<subscriptionID>/resourceGroups?api-version=2021-04-01

Response:

Please note that, the above user doesn't have required roles or permissions to access Azure resources that denied the request.