function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Joel HowardJoel Howard 

Azure AD SSO + External API auth?

We have successfully implemented SSO with Azure AD (SAML based).

We are also building an API that will have a connection to Azure AD to authenticate requests.  The API we are building can accept OpenID or SAML based auth.

The issue we're facing is trying to figure out how to send the authorization along with the API request.

One approach I'm investigating is using a Named Credential with a custom authentication provider (Open ID provider to Azure AD).  But I'm not sure if this is necessary since we already have SSO implemented.

The Apex code would look like this with this approach:
Http http = new Http();
HttpRequest request = new HttpRequest();
request.setEndpoint('callout:MY_API_URL/');
request.setMethod('POST');
request.setHeader('Content-Type''application/json;charset=UTF-8');
request.setBody(JSON.serialize(orderPayload));
HttpResponse response = http.send(request);
return response;

If this seems like a reasonable approach, please confirm.  If there's a better way to do this, please let me know. 

It seems that since we already have SSO with Azure set up, we could leverage that without configuring anything more.  But I cannot find any documentation on how to set this up (and what I would need to do in Apex code when calling the API).
AbhishekAbhishek (Salesforce Developers) 
Joel,

What you are trying is the best approach I can see.

But the below blogs might further help you.

https://docs.microsoft.com/en-us/sharepoint/dev/spfx/web-parts/guidance/connect-to-api-secured-with-aad

https://idp.miniorange.com/login-using-azure-ad/

I hope you find the above information is helpful. If it does, please mark as Best Answer to help others too.

Thanks.
LinThawLinThaw

Hi Joel, did you find any solution? I cannot find any documentation for apex code too.

Thanks.

Joel HowardJoel Howard
We went with SAML SSO, Azure App registration (when publishing API), Auth Provider in SF (to get token for use with API), and Named Creds (to tie it all together): https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app https://help.salesforce.com/articleView?id=sso_provider_microsoft.htm&type=5
LinThawLinThaw
Thanks Joel.