[FEATURE] Mapping Azure AD groups access on Products across environment

[rohit3d2003]

Release version

V3.0

Describe the bug

We have integrated with Azure AD on Developer Portal to manage access to Products. When an Azure AD group is assigned to a Product, the assignment creates a ID against ‘name’ field while ‘description’ contains name of the Azure AD group.

While deploying this setup to a higher environment, how do we map the group based on ‘Azure AD’ group name instead of ID (Name column in Products ->access)

Expected behavior

APIOps should be able to pick the Azure AD group name if the same is available in the respective environment’s Developer Portal -> Groups section. And it should assign this group to the product for access control

Actual behavior

APIOps is looking for ID/Name of the group which is generated randomly

Reproduction Steps

1. Enable Azure Ad identity in Developer Portal
2. Add an Azure AD group under ‘Groups’ section
3. Create a new Product and grant access to the Azure AD group. It will show the Name as ID and description as ‘Group Name’
4. Run extractor tool which will pull groups.json under product
5. In another environment configure Azure Ad and add same group under ‘groups’ section.
6. Run publisher to deploy the artifacts to this environment and the deployment will fail complaining about missing Group ID

[waelkdouh]

Not sure this is a bug. I will let @guythetechie chime in.

[guythetechie]

@rohit3d2003 - You can't. ApiOps works through the REST API, and Azure AD groups are associated to products by the externalId property. I understand it's not convenient to pass an ID, but unfortunately that's how APIM works.

[rohit3d2003]

@guythetechie - The external Id is different across environments for the same AzureAD group. What’s your recommendation for mapping it in publisher configuration?

[guythetechie]

@rohit3d2003 - We currently don't support overriding Azure AD group external IDs, and we should. Adding it to our backlog.

[rohit3d2003]

For the time being, should we ignore (.gitignore) groups.json artifact created by extractor tool and just manage it manually in different environments? In our current scenario, APIM Developer Portal is only enabled in 'test' environment and we don't want to deploy Product-> Group association in higher environments

[moebius87]

It is possible to create groups via API so that they have the same name even in different environments instead of the random ID. You will have to enter external id (the AD object ID) manually and it can be different for each environment.

See: https://learn.microsoft.com/en-us/rest/api/apimanagement/group/create-or-update?view=rest-apimanagement-2022-08-01&tabs=HTTP#code-try-0

It's not convenient but it's a good workaround waiting for full support on APIOps.

[waelkdouh]

This should be addressed by v6. Please let us know if you are still facing any issues.