如何使用应用程序服务对Azure函数应用程序进行身份验证/授权？

Question

I have an Azure app service as well as a functions app (I am currently learning Azure and if there is another way to achieve what I want I am open to suggestions). The app service contains an easy table I'd like to sync with an app (which is already working) and I'd like to implement a function with a blob storage input binding or timer trigger that fills the easy table.

Since there does not seem to be an output binding for easy tables I followed this answer and implemented the access with a MobileServiceClient .

MobileServiceClient client = new MobileServiceClient("https://my-app.azurewebsites.net");
var table = client.GetTable<MyTableClass>();
await table.InsertAsync(myObject);

This works as long as the table is publicly writeable, but of course it does not work when it is readable anonynomously, but writeable only for authenticated users. To authenticate my function I've created an Azure Active Directory and created an API key for the app within that AD, then I tried to authenticate the MobileServiceClient via

await client.LoginAsync(MobileServiceAuthenticationProvider.WindowsAzureActiveDirectory, 
                        new JObject {{"access_token", "<my API key>"}});

but this did not work out. I am always getting an error

The request could not be completed. (Unauthorized).

Obviously this does not work out (using the API key that way was really just a shot in the dark), but I am not sure how to accomplish authentication from my function app. I know that when I'm using the MobileServiceClient from within an app, I can redirect the user to login, but this (obviously) does not work with a function.

How can I authenticate my function with an existing app service in order to write to a table that is not writeable anonymously?

Answer 1

Simple access via API key is not possible with app service , but a full authentication via Active Directory is necessary to access the app service. To achieve this, the ADAL ( Active Directory Access Library ) can be used.

The AuthenticationContext

The ADAL defines AuthenticationContext class which is a helper to authenticate with an Active Directory. First create a new AuthenticationContext

var authenticationContext = new AuthenticationContext("https://login.microsoftonline.com/<Directory ID>");

You can find the Directory ID by visiting Azure Active Directory in the Azure portal and then open Properties from Azure Active Directory Menu . In the Properties menu there is a text box containing the Directory ID .

Authenticate with Azure Active Directory

You can now authenticate with

var authenticationResult = await authenticationContext.AcquireTokenAsync(
      "https://batch.core.windows.net/", 
      new ClientCredential("<app ID>", "<app secret>"));

I'm assuming that there already is an registered app. To obtain the app ID visit Azure Active Directory → App registrations → <Your app> , there you can find the Application ID (also under Properties ).

Next you'll have to create the secret key for the app. Therefor visit Azure Active Directory → App registrations → <Your app> → Keys . There you can create a key, just enter a key name and an expiry and click save. The key will be shown after saving. ( Watch out: The Key can't be restored afterwards. Save it somewhere.)

The MobileServiceClient

The last step is to create the MobileServiceClient . Since the UI login is not available we'll have to create the logged in user manually (see here ).

MobileServiceClient client = new MobileServiceClient("https://my-app.azurewebsites.net");
client.CurrentUser = new MobileServiceUser("Foo:123456789");
client.CurrentUser.MobileServiceAuthenticationToken = authenticationResult.AccessToken;

Now the MobileServiceClient is authenticated and ready to be used.

Further reading

https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service

https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-authentication-scenarios#web-application-to-web-api

https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.clients.activedirectory.authenticationcontext?view=azure-dotnet

https://docs.microsoft.com/en-us/azure/batch/batch-aad-auth

Answer 2

You an use managed service identity to authenticate your function to the app service.

Your application can communicate with other Azure services as itself using a managed Azure Active Directory identity.

You can see how to enable and work with managed identity here:

https://docs.microsoft.com/en-us/azure/app-service/app-service-managed-service-identity

Hope this helps!