APIM security recommendations

- API backends secured with OAuth2 and OIDC
- Authentication and authorization fully handled in backend
- Set up token validation rules in APIM, as an additional layer of protection
- Validate token
- Verify that token is issued by Azure AD
- Verify token directory = Equinor
- Set up APIM rate limiting
- Production APIs should only be accessible through APIM, to ensure all requests are covered by APIMs features for security, logging and monitoring. This can be set up using one of the following options:
- Authenticate APIM towards backend using client certificates
- Authenticate APIM towards backend using OAuth2 with either client credentials or on-behalf-of-flow (note that OBO will prevent the API from doing a second OBO-flow towards another services, as OBO cannot be nested)
- Use firewall/IP-filtering to limit access to backend, if supported by backend service