PL 400 : configure API security (Create custom connectors)

Security is always a concern in every development especially software development. The REST API is the popular choice for communication because it is lightweight, flexible and scalable, so security is an essential concern for API development, as hackers can easily compromise access control. The API works on the hypermedia transmission protocol so it is easy for hackers to steal legitimate user credentials and access business and financial data. Data breach remains a significant issue for business with loss of revenue and reputation, therefore, it is essential to protect APIs.

A connector is a proxy or a wrapper around an API.


 .

According to Microsoft, A custom connector is a wrapper around a REST API (Logic Apps also supports SOAP APIs) that allows Logic Apps, Power Automate, or Power Apps to communicate with that REST or SOAP API. Because APIs are used so much, and because they enable access to sensitive software functions and data, they are becoming a primary target for attackers. Therefore, Microsoft provides below standard authentication methods for APIs and custom connector and Azure Active directory is recommended:

  • Generic OAuth 2.0
  • OAuth 2.0 for specific services, including Azure Active Directory (Azure AD), Dropbox, GitHub, and SalesForce
  • Basic authentication
  • API Key

Generic OAuth 2.0:

OAuth 2.0 is the industry standard protocol for authorization. It is specifically for user authorization and is designed for an application that can store confidential information and maintain state. An appropriately authorized web server application can access the API when the user interacts with the application or the application is abandoned by the user.

OAuth 2.0 for specific services, including Azure Active Directory (Azure AD), Dropbox, GitHub, and SalesForce:

Many authentication providers allow a user to log in once and access services without having to re-enter authentication factors. The custom connector allows those identity providers to wire up the security process with providers such as Azure Active Director, Dropbox, GitHub and SalesForce.

Basic authentication:

Basic authentication is a simple authentication scheme built into the HTTP protocol. The client sends an HTTP request with an authorization header that consists of a base word followed by a space and a Base64-encoded string username:password.

API Key:

Some APIs use API keys for authorization. The API key is a token that the client provides when making an API call.

Comments

Post a Comment

Popular posts from this blog

Exploring the Differences: Managed vs. Unmanaged Solutions in Dynamics CRM/Dataverse

Image
In Dynamics CRM/Dataverse, solutions are central to Application Lifecycle Management (ALM) , providing a structured way to manage, package, and distribute customizations across environments. Microsoft uses solutions to transfer apps and customizations by exporting them from one Dataverse environment and importing them into another.  Each solution is authored and maintained by a publisher and includes components like Power Apps (canvas and model-driven), flows, entities, forms, connectors, web resources, and configurations—excluding business data. Solutions streamline ALM practices within Microsoft Power Platform. In Dynamics CRM/Dataverse, there are two types of solutions: Managed and Unmanaged . When planning an implementation, it’s important to understand the advantages and disadvantages of each to make an informed decision. Let’s explore both types to determine the best approach for development and deployment. In Dynamics 365 CRM, a managed solution is a fully packaged solution ...
Read more

PCF vs. Web Resources: Choosing the Right Extensibility Tool for Dataverse

Image
Extensibility refers to the ability to be extended or augmented beyond the default capabilities of the platform. This involves customization but also includes more advanced techniques, such as coding, integration with external services, and the use of custom components. In the context of Power Platform and Dynamics CRM, the term "extend behavior" refers to the ability to customize and extend the functionality of the platform to meet specific business needs. Extensibility often requires technical skills, such as coding in JavaScript, C#, or using tools like Azure Logic Apps and Power Automate for complex integrations. Customization  is a subset of extensibility. Customization involves configuring and modifying existing elements within the platform to suit specific business needs. Extensibility, on the other hand, covers a wide range of functions and techniques, including customization and more advanced development and integration tasks, to extend the capabilities of the Power ...
Read more

Effective Strategies for Debugging Plugins in Dynamics CRM

Image
In a recent interview, I was asked about debugging plugins in Dynamics CRM. The interviewer specifically wanted to know my approach to plugin debugging. In response, I mentioned using the Plugin Registration Tool profiler. However, I later realized there are multiple methods to debug plugins in Dynamics CRM/Dataverse, each essential for efficient troubleshooting. Debugging plays a crucial role in development, and having a solid understanding of various debugging approaches can help streamline issue resolution in Dynamics 365. Here, I'll explore different techniques for debugging plugin code. There are below options to use in the plugin in Dynamics CRM/Dataverse ITracingService : In Dynamics CRM plugin development, ITracingService is a service provided within the plugin's execution context that logs information for tracing and debugging. It allows developers to capture real-time. Plugin Profiler : A plugin profiler in Dynamics CRM (or Dataverse) is a debugging tool in the Plugi...
Read more