fix: ajouter le chemin de l'API MCP et mettre à jour les paramètres de déploiement

Author: Justrebl

labs/mcp-prm-oauth/mcp-prm-oauth.ipynb

@@ -82,6 +82,7 @@
     "encryption_iv = base64.b64encode(os.urandom(16)).decode('utf-8')\n",
     "encryption_key = base64.b64encode(os.urandom(16)).decode('utf-8')\n",
     "oauth_scopes = 'openid https://graph.microsoft.com/.default'\n",
+    "mcpApiPath = \"profile\"  # path to the MCP API in the APIM service\n",
     "\n",
     "utils.print_ok('Notebook initialized')\n"
    ]
@@ -147,6 +148,7 @@
     "        \"inferenceAPIType\": { \"value\": inference_api_type },\n",
     "        \"foundryProjectName\": { \"value\": foundry_project_name },\n",
     "        \"oauthScopes\": { \"value\": oauth_scopes },\n",
+    "        \"mcpApiPath\": { \"value\": mcpApiPath },\n",
     "        \"encryptionIV\": { \"value\": encryption_iv },\n",
     "        \"encryptionKey\": { \"value\": encryption_key },\n",
     "    }\n",

labs/mcp-prm-oauth/src/bicep/apim-mcp/mcp-api.bicep

@@ -78,10 +78,15 @@ resource mcpApiPathNamedValue 'Microsoft.ApiManagement/service/namedValues@2021-
 
 resource mcpBackendServerUrl 'Microsoft.ApiManagement/service/backends@2025-09-01-preview' = {
   parent: apimService
-  name: 'GraphProfileBackend'
+  name: '${webAppName}-mcp-backend'
   properties: {
     url: 'https://${containerApp.properties.configuration.ingress.fqdn}'
     protocol: 'http'
+    tls: {
+      validateCertificateChain: true
+      validateCertificateName: true
+    }
+    type: 'Single'
   }
 }
 
@@ -93,9 +98,9 @@ resource mcpApi 'Microsoft.ApiManagement/service/apis@2025-09-01-preview' = {
     displayName: '${webAppName} MCP Server'
     type: 'mcp'
     subscriptionRequired: false
-    description: 'MCP API for ${webAppName} showing authenticated user profile info'
-    path: mcpApiPath
     backendId: mcpBackendServerUrl.name
+    description: 'MCP API for ${webAppName} showing authenticated user profile info'
+    path: mcpApiPath    
     protocols: ['https']
     mcpProperties: {
       endpoints : {
@@ -104,6 +109,10 @@ resource mcpApi 'Microsoft.ApiManagement/service/apis@2025-09-01-preview' = {
         }
       }
     }
+    authenticationSettings: {
+      oAuth2AuthenticationSettings: []
+      openidAuthenticationSettings: []
+    }
     isCurrent: true
   }
 }

labs/mcp-prm-oauth/src/bicep/apim-mcp/mcp-api.policy.xml

@@ -6,6 +6,8 @@
 <policies>
     <inbound>
         <base />
+            <!-- Validate Azure AD JWT Token -->
+
             <validate-azure-ad-token tenant-id="{{McpTenantId}}" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
                 <audiences>
                     <audience>{{McpClientId}}</audience>

labs/mcp-prm-oauth/src/bicep/identity/mcp-entra-app.bicep

@@ -47,7 +47,7 @@ resource mcpEntraApp 'Microsoft.Graph/applications@v1.0' = {
     requestedAccessTokenVersion: 2
     preAuthorizedApplications: [
       {
-        appId: 'aebc6443-996d-45c2-90f0-388ff96faa56' // visual studio code well known client id for OAuth2.0 authorization code flow
+        appId: 'aebc6443-996d-45c2-90f0-388ff96faa56' // Visual studio code well known client id for OAuth2.0 authorization code flow
         delegatedPermissionIds: [
           guid(mcpAppUniqueName, 'user_impersonate')
         ]
@@ -90,9 +90,6 @@ resource mcpEntraApp 'Microsoft.Graph/applications@v1.0' = {
   }
 }
 
-// Service principal for the MCP application.
-// Referencing mcpEntraApp.appId here also forces the Graph extension to resolve the
-// read-only 'appId' property so the mcpAppId output below can be evaluated.
 resource mcpServicePrincipal 'Microsoft.Graph/servicePrincipals@v1.0' = {
   appId: mcpEntraApp.appId
 }