Add active directory policy

code/api.tf

@@ -405,7 +405,10 @@ module "apim_backoffice_api" {
 
   content_value = file("./backoffice_api/swagger.json")
 
-  xml_content = file("./backoffice_api/policy.xml")
+  xml_content = templatefile("./backoffice_api/policy.xml.tpl", {
+    openid_config_url = var.adb2c_openid_config_url
+    audience          = var.adb2c_audience
+  })
 }
 
 module "apim_spid_login_api" {

code/backoffice_api/policy.xml.tpl

@@ -0,0 +1,17 @@
+<policies>
+  <inbound>
+    <base />
+    <validate-jwt header-name="Authorization" failed-validation-httpcode="401" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true" >
+      <openid-config url="${openid_config_url}" />
+      <audiences>
+        <audience>${audience}</audience>
+      </audiences>
+    </validate-jwt>
+    <set-header name="X-CGN-USER-ROLE" exists-action="override">
+      <value>ROLE_ADMIN</value>
+    </set-header>
+  </inbound>
+  <outbound>
+    <base />
+  </outbound>
+</policies>

code/variables.tf

@@ -316,3 +316,14 @@ variable "enable_ade_aa_mock" {
   type = bool
   default = false
 }
+
+## AD B2C
+variable "adb2c_openid_config_url" {
+  type        = string
+  description = "Azure AD B2C OpenID Connect metadata document"
+}
+
+variable "adb2c_audience" {
+  type        = string
+  description = "recipients that the JWT is intended for"
+}

vars/dev.tf

@@ -238,3 +238,19 @@ resource "tfe_variable" "dev_enable_ade_aa_mock" {
 }
 
 
+
+resource "tfe_variable" "dev_adb2c_openid_config_url" {
+  key          = "adb2c_openid_config_url"
+  value        = "https://testcgnportalbitrock.b2clogin.com/testcgnportalbitrock.onmicrosoft.com/B2C_1_LOGIN/v2.0/.well-known/openid-configuration"
+  category     = "terraform"
+  sensitive    = true
+  workspace_id = data.tfe_workspace.dev.id
+}
+
+resource "tfe_variable" "dev_adb2c_audience" {
+  key          = "adb2c_audience"
+  value        = "5f75f12e-b5a0-4656-b0ff-334bb9d4222f"
+  category     = "terraform"
+  sensitive    = true
+  workspace_id = data.tfe_workspace.dev.id
+}

vars/uat.tf

@@ -239,3 +239,19 @@ resource "tfe_variable" "uat_enable_ade_aa_mock" {
   category     = "terraform"
   workspace_id = data.tfe_workspace.uat.id
 }
+
+resource "tfe_variable" "uat_adb2c_openid_config_url" {
+  key          = "adb2c_openid_config_url"
+  value        = "https://cgnonboardingportaluat.b2clogin.com/cgnonboardingportaluat.onmicrosoft.com/B2C_1_login/v2.0/.well-known/openid-configuration"
+  category     = "terraform"
+  sensitive    = true
+  workspace_id = data.tfe_workspace.uat.id
+}
+
+resource "tfe_variable" "uat_adb2c_audience" {
+  key          = "adb2c_audience"
+  value        = "2416d411-9cbb-4d4c-a902-2570f031b9f0"
+  category     = "terraform"
+  sensitive    = true
+  workspace_id = data.tfe_workspace.uat.id
+}