PUB-2269 Update OTP APIM

infrastructure/data.tf

@@ -19,18 +19,6 @@ data "azurerm_key_vault" "kv" {
 
 data "azurerm_key_vault_secret" "data_client_id" {
   count        = local.deploy_apim
-  name         = "app-pip-data-management-id"
-  key_vault_id = data.azurerm_key_vault.kv.id
-}
-
-data "azurerm_key_vault_secret" "data_client_pwd" {
-  count        = local.deploy_apim
-  name         = "app-pip-data-management-pwd"
-  key_vault_id = data.azurerm_key_vault.kv.id
-}
-
-data "azurerm_key_vault_secret" "data_client_scope" {
-  count        = local.deploy_apim
-  name         = "app-pip-${var.component}-scope"
+  name         = "app-pip-apim-admin-id"
   key_vault_id = data.azurerm_key_vault.kv.id
 }

infrastructure/resources/api-policy/api-policy.xml

@@ -29,7 +29,7 @@
             <value>application/x-www-form-urlencoded</value>
           </set-header>
           <set-body>@{
-            return "client_id=" + (string)context.Variables["clientId"] + "&scope=" + (string)context.Variables["scope"] + "/.default&client_secret=" + (string)context.Variables["clientSecret"] + "&grant_type=client_credentials";
+            return "client_id={CLIENT_ID}&scope=" + (string)context.Variables["scope"] + "/.default&client_secret=" + (string)context.Variables["clientSecret"] + "&grant_type=client_credentials";
           }</set-body>
         </send-request>
         <set-variable name="pipAuthToken" value="@("Bearer " + (String)((IResponse)context.Variables["bearerToken"]).Body.As<JObject>()["access_token"])" />

infrastructure/resources/operation-policies/sendOtpEmail.xml

@@ -1,18 +1,9 @@
 <policies>
   <inbound>
-    <send-request ignore-error="false" timeout="20" response-variable-name="pipApimClientId" mode="new">
-      <set-url>https://pip-ss-kv-{ENV}.vault.azure.net/secrets/app-pip-apim-admin-id/?api-version=7.0</set-url>
-      <set-method>GET</set-method>
-      <authentication-managed-identity resource="https://vault.azure.net" />
-    </send-request>
-    <set-variable name="clientId" value="@{
-      var secret = ((IResponse)context.Variables["pipApimClientId"]).Body.As<JObject>();
-      return secret["value"].ToString();
-    }" />
     <validate-jwt token-value="@((String)context.Request.Body.As<JObject>(preserveContent: true)["bearer"])" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
       <openid-config url="https://login.microsoftonline.com/{TENANT_ID}/v2.0/.well-known/openid-configuration" />
       <audiences>
-        <audience>@((string)context.Variables["clientId"])</audience>
+        <audience>{CLIENT_ID}</audience>
       </audiences>
       <issuers>
         <issuer>https://login.microsoftonline.com/{TENANT_ID}/v2.0</issuer>

infrastructure/resources/operation-policies/welcome.xml

@@ -1,18 +1,9 @@
 <policies>
   <inbound>
-    <send-request ignore-error="false" timeout="20" response-variable-name="pipApimClientId" mode="new">
-      <set-url>https://pip-ss-kv-{ENV}.vault.azure.net/secrets/app-pip-apim-admin-id/?api-version=7.0</set-url>
-      <set-method>GET</set-method>
-      <authentication-managed-identity resource="https://vault.azure.net" />
-    </send-request>
-    <set-variable name="clientId" value="@{
-      var secret = ((IResponse)context.Variables["pipApimClientId"]).Body.As<JObject>();
-      return secret["value"].ToString();
-    }" />
     <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Access denied due to invalid OAuth information">
       <openid-config url="https://login.microsoftonline.com/{TENANT_ID}/.well-known/openid-configuration" />
       <audiences>
-        <audience>@((string)context.Variables["clientId"])</audience>
+        <audience>{CLIENT_ID}</audience>
       </audiences>
       <issuers>
         <issuer>https://login.microsoftonline.com/{TENANT_ID}/v2.0</issuer>

infrastructure/tf-apim-api.tf

@@ -1,8 +1,10 @@
 locals {
   apim_api_name  = "${var.product}-${var.component}-api"
   api_policy_raw = file("./resources/api-policy/api-policy.xml")
-  api_policy = replace(replace(local.api_policy_raw, "{TENANT_ID}", data.azurerm_client_config.current.tenant_id)
-  , "{ENV}", local.env)
+  api_policy = replace(replace(replace(local.api_policy_raw,
+    "{TENANT_ID}", data.azurerm_client_config.current.tenant_id),
+    "{CLIENT_ID}", length(data.azurerm_key_vault_secret.data_client_id) > 0 ? data.azurerm_key_vault_secret.data_client_id[0].value : ""),
+  "{ENV}", local.env)
 }
 
 module "apim_api" {

infrastructure/tf-apim-operations.tf

@@ -4,8 +4,9 @@ locals {
     for operation_policies_file in local.operation_policies_files :
     basename(operation_policies_file) => {
       operation_id = replace(basename(operation_policies_file), ".xml", "")
-      xml_content = replace(replace(file("${path.module}/${operation_policies_file}"), "{TENANT_ID}", data.azurerm_client_config.current.tenant_id)
-      , "{ENV}", local.env)
+      xml_content = replace(replace(file("${path.module}/${operation_policies_file}"),
+        "{TENANT_ID}", data.azurerm_client_config.current.tenant_id),
+      "{CLIENT_ID}", length(data.azurerm_key_vault_secret.data_client_id) > 0 ? data.azurerm_key_vault_secret.data_client_id[0].value : "")
     }
   }
 }