Azure
Azure AD authentication in Azure Functions
Ever had the need to enable Azure Active Directory authentication in Azure Functions? In a recent project, I wanted to use Azure Functions, and I wanted both system-to-system authentication, as well as user-based. As Azure Functions is a part of the app services in Azure. It shares many of the same features. Authentication is one of them.
Enable authentication
The scope for this blog post is not to show you how to build an Azure function, but to enable Azure AD authentication on it. You can add auth to your existing function or create a new one using your method of choice. For simplicity, I will show the process of using the Azure portal.
To enable authentication in Azure Function. Navigate to “Authentication/authorization”. This will open a series of blades which guides you through the process.
If you’re not familiar with Azure AD and custom application registrations, I recommend that you use the Express option. This will create the needed application in AAD for you.
Change to anonymous authentication
By default Azure Function uses something called “Function authentication” This is where all your requests have a code parameter at the end of the URL.
https://my-function-app.azurewebsites.net/api/function-name?code=xyzx-zyxx...
We want to have Azure AD perform authentication and authorization, and not the function itself.
Within the GUI, it’s just a flick of a switch. If you are developing locally, using C# you typically do this:
public static HttpResponseMessage (run
[HttpTrigger(
AuthorizationLevel.Anonymous)]
HttpRequestmessage request)
{
logic
}
Enable user assignment
After changing the authorization level and enable AAD authentication,
all users in your organization will automatically have access. If you want more granular control over who has access to your application, you should enable user assignment.
To enable user assignment. Navigate to enterprise application under AAD, and look up the app created by the wizard. The enterprise app is the service principal representing the application you created. Your Azure Function.
Under properties, find the swith for user assignment and turn it on. Navigate to your function URL and see if it works, meaning access denied.
Later add your own user and verify authentication works through Azure AD.
If you want other applications (clients) to call your function, you will have to assign them API access. The same way you give access to for example Microsoft Graph API, you will find your custom application as well.
This will not work right away – By default, there are no application roles assigned. Only delegated permissions. For client authentication to work, you will need to add custom roles to the app representing your Azure Function. It is not difficult, but I used too much time finding it out. Microsoft has it documented here
Authenticate with code
Chances are that your azure function is not a graphical website. Therefore I assume you want to authenticate using code. Either with your own user, or with a separate application/secret combination (app credentials).
The great thing about this is that it works just as any other Microsoft/Azure APIs. If you know how to get a token from Microsoft, you can use the same techniques against your function. My example below show how to retrieve a token for our azure function, and use that bearer token against the function. I use a client application in this scenario.
Summary
This feature is great. I consider my self as a modern IT operations guy. And operations role these days requires more coding and scripting. It is super easy to expose things on the internet. But remember, it might also be just as easy to secure.
I have no idea on how to implement a authentication layer. And if i can use one of the best, i’m all aboard.
22 COMMENTS
[…] to authenticate a customized API the usage of shopper credentials. In truth, I’ve written about how you can do that in the past the place we accessed a customized API constructed on Azure Purposes. Authentication-wise, I […]
[…] straightforward to authenticate a custom API using client credentials. In fact, I have written about how to do that previously where we accessed a custom API built on Azure Functions. Authentication-wise, I also wrote a post […]
[…] Azure AD authentication in Azure Functions adatum […]
[…] Azure AD authentication in Azure Functions adatum […]
[…] are a lot more to go through when talking about authentication. How to obtain Azure access tokens or how you add Azure login to your website is not covered here. However, I hope this post made the […]
… [Trackback]
[…] There you will find 16841 more Infos: adatum.no/azure/azure-ad-authentication-in-azure-functions […]
[…] https://adatum.no/azure/azure-ad-authentication-in-azure-functions […]
[…] are seeing this because your blog was recently used as part of a DDOS attack against […]
And btw any idea why my exisiting app is not listed on the drop down when I select existing app option
Hi i dont know how to get the scopes any idea?
Thanks. This post was helpful.
Followed all steps and found that applications which arent given permissions to the custom role can still call the API
Hi Ankit. You’re saying that all app registration in your directory can get an access token and access your function?
Great easy to read post – Thanks! For getting the calling user there is a ClaimsPrinciple binding available https://azure.microsoft.com/en-gb/blog/simplifying-security-for-serverless-and-web-apps-with-azure-functions-and-app-service/
Thanks Gary. I don’t think that was available when I posted this? Do you happen to know if it is available for PowerShell?
Great post, perhaps it is good to mention that “Authentication / Authorization” feature is not available for Linux Consumption Plan. I stumble upon this issue while following steps from this post.
Thank you Ankit. I did not know that! Is it a documented limitation?
Hi Martin, it’s not documented. I came across this just today when I was trying add Authentication to my Azure function on Linux Consumption plan.. Windows based Consumption plan worked perfectly..
Don’t see any way to share the screenshot else I could have share it with for reference.
Upload it somwhere and link it. I can check for my self later.
It looks like I’m not able to share the link on comment as well.. What’s the best way to share the link with you?
Sorry. I forgot this. Ping me on linked in or Twitter