https://meetups.mulesoft.com/events/details/mulesoft-online-group-english-presents-dynamic-client-registration-dcr-using-microsoft-azure-active-directory/#/

1. All contents © MuleSoft, LLC
Krishna Misra - Solutions Engineer
Dynamic Client
Registration(DCR) using
Microsoft Azure Active Directory

2. All contents © MuleSoft, LLC
● Pre-requisites
● Problem overview
○ How to do Dynamic Client Registration with Azure AD in Anypoint Platform
● Solution Demo
○ Mule Application to invoke Azure AD GraphQL APIs for Client Registration Endpoints
○ External Identity Configuration on Anypoint Platform
○ Azure AD configuration
● Setup resources
○ Mule application source code
○ Azure GraphQL documentation
○ Postman collection
Agenda

3. All contents © MuleSoft, LLC
Pre-requisites
3
• Conceptual understanding of IDM, OAuth, JWT etc
• Understanding of Azure Active Directory
• Anypoint platform components(Exchange, API Manager, Runtime
manager etc)

4. All contents © MuleSoft, LLC
Dynamic Client Registration
• What is Dynamic Client Registration(DCR)?
• The Dynamic Client Registration(DCR) API provides operations to register and manage
client applications for use with an Identity provider’s OAuth 2.0 and OpenID Connect
endpoints. This API largely follows the contract defined in RFC7591: OAuth 2.0 Dynamic
Client Registration Protocol and OpenID Connect Dynamic Client Registration 1.0
Why do DCR?
• Allows automatic creation of client id and client secret in the identity management for the
APIs managed in MuleSoft’s API Gateway
• Makes it easier to validate Oauth Token and JWT using the OOTB policies in API Manager
• Advantages
• No need to perform manual creation of client id and client secret in IDM and then create
them in Anypoint Platform
• No manual configuration/custom development to validate Oauth Token OR JWT policy in
Anypoint Platform

5. All contents © MuleSoft, LLC
Dynamic Client Registration with Azure
• IDM Solutions and Dynamic Client Registration(DCR)
• OKTA and Open AM are known/verified/supported to have OIDC endpoints to support DCR
• Azure AD, although supports OAuth 2.0 but doesn’t have all the ends points to support
DCR(and hence the need for this work)
• Key OIDC endpoints for DCR
• /register – Allows creation of API client id and secret in IDM
• /authorize – Allows interactive login for Oauth flow to generate authorization code
• /token – Allows generation of access token
• /introspect – Allows validation of token

6. All contents © MuleSoft, LLC
Solution
6
/register
/token
/authorize
/introspect
Azure Graph
QL APIs
Azure APIs
Anypoint
Platform
Azure DCR
API

7. All contents © MuleSoft, LLC
1
API development
2 3 4
Anypoint Platform
Config
Azure AD Config Next steps
Demo

8. All contents © MuleSoft, LLC
1
API development
2 3 4
Demo

9. All contents © MuleSoft, LLC
1
API development
2 3 4
Leverage
MuleSoft Skills
Demo

10. All contents © MuleSoft, LLC
2 3 4
Demo
1
API development Anypoint Platform
Config
Leverage
MuleSoft Skills

11. All contents © MuleSoft, LLC
3 4
2
1
Demo
Anypoint Platform
Config
Leverage
MuleSoft Skills
API development
Quick & Easy

12. All contents © MuleSoft, LLC
3 4
2
Demo
1
Anypoint Platform
Config
Leverage
MuleSoft Skills
Azure AD Config
API development
Quick & Easy

13. All contents © MuleSoft, LLC
4
3
Azure AD Config
2
1
Demo
Quick & Easy
Anypoint Platform
Config
Quick & easy
API development
Leverage
MuleSoft Skills

14. All contents © MuleSoft, LLC
4
Getting started
3
Flow Designer
2
API Designer
1
Demo
API development
Quick & Easy Quick & easy
Leverage
MuleSoft Skills

15. All contents © MuleSoft, LLC
Next Steps
• Click here for download the POSTMAN collection
• Click here to view the Azure GraphQL API reference
• Click here to view the instructions for DCR on Anypoint Platform
• Click here to download the POC app source code(developed on
Anypoint Studio)
Please note that this is a custom solution and is provided as-is,
without any support or warranty.

16. All contents © MuleSoft, LLC
Thank you!