Skip to content

Commit 67303ea

Browse files
author
Fabrice Michellonet
committed
update readme
1 parent e45d31f commit 67303ea

1 file changed

Lines changed: 18 additions & 102 deletions

File tree

‎README.md‎

Lines changed: 18 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
# AzureFunctions.Extensions.OpenIDConnect
22
[![Build status](https://github.com/fmichellonet/AzureFunctions.Extensions.OpenIDConnect/workflows/Continuous%20Integration/badge.svg)](https://github.com/fmichellonet/AzureFunctions.Extensions.OpenIDConnect/actions?query=workflow%3A%22Continuous+Integration%22) [![NuGet Badge](https://buildstats.info/nuget/AzureFunctions.Extensions.OpenIDConnect)](https://www.nuget.org/packages/AzureFunctions.Extensions.OpenIDConnect/)
33

4-
> This project is originally forked from https://github.com/bryanknox/AzureFunctionsOpenIDConnectAuthSample. Thank you to Bryan for the helpful sample.
4+
> This project is originally forked from https://github.com/AspNetMonsters/AzureFunctions.OidcAuthentication. Thanks goes to [David Paquette](https://github.com/dpaquette) the helpful intial codebase.
5+
56

67
## Why?
78
As of writing this, securing Azure Functions using Bearer token is clumsy. For some auth providers, you can enable App Service Authentication in the Azure Portal but that only works for the deployed version of your app which makes testing locally difficult and clumsy.
@@ -10,23 +11,15 @@ This library makes it easy to authenticate a user by validating a bearer token.
1011

1112
## Requirements
1213

13-
Azure Functions v3
14-
Dependency Injection using Azure Functions Extensions
15-
An identity provider (e.g. Auth0, Azure AD, Okta)
14+
Azure Functions using v3 runtime and of course an identity provider (e.g. Google, Azure AD, etc..)
1615

1716
## How to use it
1817

19-
First, configure dependency injection for your Azure Functions project. Start by adding the Microsoft.Azure.Functions.Exentions NuGet package.
20-
21-
> dotnet add package Microsoft.Azure.Functions.Extensions
22-
23-
Add the OidcAuthentication NuGet package to your Azure Functions project.
18+
Add AzureFunctions.Extensions.OpenIDConnect NuGet package to your Azure Functions project.
2419

25-
> dotnet package install AzureFunctions.OidcAuthentication
20+
> dotnet package install AzureFunctions.Extensions.OpenIDConnect
2621
27-
Now add a `FunctionStartup` class to configure services that will be used in your Azure Functions app. In the `Configure` method, add a call to `builder.Services.AddOidcApiAuthorization();` This will configure the `IApiAuthentication` service that you will use to authenticate users.
28-
29-
[assembly: FunctionsStartup(typeof(Curbsy.API.Startup.DependencyInjection))]
22+
Now head over the Configure method of the Startup class, add configure OpenID-Connect the way you like it.
3023

3124
```
3225
namespace MySecuredApp
@@ -35,114 +28,37 @@ namespace MySecuredApp
3528
{
3629
public override void Configure(IFunctionsHostBuilder builder)
3730
{
38-
builder.Services.AddOidcApiAuthorization();
31+
var audience = Environment.GetEnvironmentVariable("OpenIdConnect_Audience");
32+
var issuer = Environment.GetEnvironmentVariable("OpenIdConnect_Issuer");
33+
var issuerUrl = Environment.GetEnvironmentVariable("OpenIdConnect_IssuerUrl");
34+
builder.Services.AddOpenIDConnect(config =>
35+
{
36+
config.SetTokenValidation(TokenValidationParametersHelpers.Default(audience, issuer));
37+
config.SetIssuerBaseUrlConfiguration(issuerUrl);
38+
});
3939
}
4040
}
4141
}
4242
```
4343

44-
Configuration is loaded from a environment variables which can be set in `local.settings.json` for local development or in the Azure portal for your deployed app. Settings are prefixed with `OidcApiAuthSettings:`.
45-
46-
Here is an example `local.settings.json` file for Azure AD B2C:
47-
48-
```
49-
{
50-
"IsEncrypted": false,
51-
"Values": {
52-
"AzureWebJobsStorage": "UseDevelopmentStorage=true",
53-
"FUNCTIONS_WORKER_RUNTIME": "dotnet",
54-
"OidcApiAuthSettings:Audience": "Your API Application's Client ID",
55-
"OidcApiAuthSettings:MetadataAddress": "https://yourb2cdomain.b2clogin.com/yourb2cdomain.onmicrosoft.com/yoursigninuserflowname/v2.0/.well-known/openid-configuration/",
56-
"OidcApiAuthSettings:IssuerUrl": "https://yourb2cdomain.b2clogin.com/Your Directory (tenant) ID/v2.0/"
57-
}
58-
}
59-
```
60-
61-
### Settings
62-
63-
**OidcApiAuthSettings:Audience** - Required
64-
65-
Identifies the API to be authorized by the Open ID Connect provider (issuer).
66-
67-
The "Audience" is the identifer used by the authorization provider to identify the API (HTTP triggered Azure Function) being protected. This is often a URL but it is not used as a URL is is simply used as an identifier.
68-
69-
For Auth0 use the API's Identifier in the Auth0 Dashboard.
70-
71-
For Azure AD B2C, use your API Application's (client) ID. This is a GUID.
72-
73-
**OidcApiAuthSettings:IssuerUrl** - Required
74-
75-
The URL of the Open ID Connect provider (issuer) that will perform API authorization.
76-
77-
The "Issuer" is the URL for the authorization provider's end-point. This URL will be used as part of the OpenID Connect protocol to obtain the the signing keys that will be used to validate the JWT Bearer tokens in incoming HTTP request headers.
78-
79-
For Auth0 the URL format is: `https://{Auth0-tenant-domain}.auth0.com`
80-
For Auzre AD B2C, the format is: `https://yourb2cdomain.b2clogin.com/Your Directory (tenant) ID/v2.0/`
81-
82-
**OidcApiAuthSettings:MetadataAddress** - Optional (depending on identity provider)
83-
84-
The URL for the identity provider's well-known openid-configuration url.
85-
86-
Default Vaule: `$"{IssuerUrl}.well-known/openid-configuration"`
87-
88-
For Auth0, leave this blank.
89-
For Azure AD B2C, use `https://yourb2cdomain.b2clogin.com/yourb2cdomain.onmicrosoft.com/yoursigninuserflowname/v2.0/.well-known/openid-configuration/`
90-
91-
**OidcApiAuthSettings:NameClaimType** - Optional
92-
93-
A string defining the name of the claim that will identify the user's name
94-
95-
Default value: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier`
96-
97-
**OidcApiAuthSettings:RoleClaimType** - Optional
98-
99-
A string defining the name of the claim that will identify the user's role membership
100-
101-
Default value: "http://schemas.microsoft.com/ws/2008/06/identity/claims/roleidentifier"
102-
103-
10444
### Securing an Azure Function
105-
Not that everything is configured, you can inject the `IApiAuthentication` service into your Azure Function and authenticate users as follows:
45+
Not that everything is configured, you can decorate your http-triggered functions with the well known [Authorize](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authorization.authorizeattribute?view=aspnetcore-3.1) attribute as follows:
10646

10747
```
10848
namespace MySecuredApp
10949
{
11050
public class MyFunction
11151
{
112-
private readonly IApiAuthentication apiAuthentication;
113-
114-
public MyFunction(IApiAuthentication apiAuthentication)
115-
{
116-
this.apiAuthentication = apiAuthentication;
117-
}
118-
52+
[Authorize]
11953
[FunctionName("MyFunction")]
12054
public async Task<IActionResult> Run(
121-
[HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)] HttpRequest req,
55+
[HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = null)] HttpRequest req,
12256
ILogger log)
12357
{
124-
// Authenticate the user
125-
var authResult = await this.apiAuthentication.AuthenticateAsync(req.Headers);
126-
127-
// Check the authentication result
128-
if (authResult.Failed)
129-
{
130-
return new ForbidResult(authenticationScheme: "Bearer");
131-
}
132-
133-
// User is authenticated. Proceed with function logic
134-
string name = authResult.User.Identity.Name; // This gives us the unique user name
135-
136-
string responseMessage = $"Hello, {name}. This HTTP triggered function executed successfully.";
58+
string responseMessage = $"Hello, {name}. This HTTP triggered function is protected.";
13759
13860
return new OkObjectResult(responseMessage);
13961
}
14062
}
14163
}
14264
```
143-
144-
`AuthResult.User` is a [ClaimsPrincipal](https://docs.microsoft.com/dotnet/api/system.security.claims.claimsprincipal) that is created using the claims that were included in the JWT token that was validated by the `IApiAuthentication` service. You can use `authResult.User` to inspect the user's claims and add your own authorization rules inside your Function.
145-
146-
## End-to-end Sample
147-
- **Functions App:** https://github.com/AspNetMonsters/functions-azure-b2c-sample
148-
- **Vue front-end:** https://github.com/AspNetMonsters/vue-azure-b2c-sample

0 commit comments

Comments
 (0)