@azure/functions-authentication-events 1.0.0-alpha.20250106.1 → 1.0.0-alpha.20250110.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +113 -117
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -4,42 +4,42 @@ Authentication Event Trigger for Azure Functions handles all the backend process
|
|
|
4
4
|
|
|
5
5
|
This project framework provides the following features:
|
|
6
6
|
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
7
|
+
- Token validation for securing the API call
|
|
8
|
+
- Object model, typing, and IDE intellisense
|
|
9
|
+
- Inbound and outbound validation of the API request and response schemas
|
|
10
|
+
- Versioning
|
|
11
|
+
- No need for boilerplate code.
|
|
12
12
|
|
|
13
13
|
## Getting started
|
|
14
14
|
|
|
15
15
|
### Install the npm package
|
|
16
16
|
|
|
17
17
|
```console
|
|
18
|
-
npm install @azure/functions-authentication-events
|
|
18
|
+
npm install @azure/functions-authentication-events
|
|
19
19
|
```
|
|
20
20
|
|
|
21
21
|
### Prerequisites
|
|
22
22
|
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
23
|
+
- [Azure function tools](https://github.com/Azure/azure-functions-core-tools)
|
|
24
|
+
- [Azure Function Core Tools](https://github.com/Azure/azure-functions-core-tools#installing)
|
|
25
|
+
- If using Visual Studio Code the following extensions:
|
|
26
|
+
- [ms-azuretools.vscode-azurefunctions](https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azurefunctions)
|
|
27
|
+
- [ms-dotnettools.csharp](https://marketplace.visualstudio.com/items?itemName=ms-dotnettools.csharp)
|
|
28
28
|
|
|
29
29
|
### Authenticate the Client
|
|
30
30
|
|
|
31
|
-
When Azure AD authentication events service calls your custom extension, it will send an `Authorization` header with a `Bearer {token}`. This token will represent a [service to service authentication](https://review.
|
|
31
|
+
When Azure AD authentication events service calls your custom extension, it will send an `Authorization` header with a `Bearer {token}`. This token will represent a [service to service authentication](https://review.learn.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow) in which:
|
|
32
32
|
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
33
|
+
- The '**resource**', also known as the **audience**, is the application that you register to represent your API. This is represented by the `aud` claim in the token.
|
|
34
|
+
- The '**client**' is a Microsoft application that represents the Azure AD authentication events service. It has an `appId` value of `99045fe1-7639-4a75-9d4a-577b6ca3810f`. This is represented by:
|
|
35
|
+
- The `azp` claim in the token if your application `accessTokenAcceptedVersion` property is set to `2`.
|
|
36
|
+
- The `appid` claim in the token if your resource application's `accessTokenAcceptedVersion` property is set to `1` or `null`.
|
|
37
37
|
|
|
38
|
-
There are three approaches to dealing with the token. You can customize the behavior using [application settings](https://
|
|
38
|
+
There are three approaches to dealing with the token. You can customize the behavior using [application settings](https://learn.microsoft.com/azure/azure-functions/functions-how-to-use-azure-function-app-settings?tabs=portal#settings) as shown below or via the [local.settings.json](https://learn.microsoft.com/azure/azure-functions/functions-develop-local#local-settings-file) file in local environments.
|
|
39
39
|
|
|
40
40
|
#### Validate tokens using Azure Functions Azure AD authentication integration
|
|
41
41
|
|
|
42
|
-
When running your function in production, it is **highly recommended** to use the [Azure Functions Azure AD authentication integration](https://
|
|
42
|
+
When running your function in production, it is **highly recommended** to use the [Azure Functions Azure AD authentication integration](https://learn.microsoft.com/azure/app-service/configure-authentication-provider-aad#-option-2-use-an-existing-registration-created-separately) for validating incoming tokens.
|
|
43
43
|
|
|
44
44
|
1. Go to the "Authentication" tab in your Function App
|
|
45
45
|
2. Click on "Add identity provider"
|
|
@@ -47,29 +47,27 @@ When running your function in production, it is **highly recommended** to use th
|
|
|
47
47
|
4. Select "Provide the details of an existing app registration"
|
|
48
48
|
5. Enter the `Application ID` of the app that represents your API in Azure AD
|
|
49
49
|
|
|
50
|
-
The issuer and allowed audience depends on the [`accessTokenAcceptedVersion`](https://review.
|
|
50
|
+
The issuer and allowed audience depends on the [`accessTokenAcceptedVersion`](https://review.learn.microsoft.com/azure/active-directory/develop/access-tokens) property of your application (can be found in the "Manifest" of the application).
|
|
51
51
|
|
|
52
|
-
If the `accessTokenAcceptedVersion` property is set to `2`:
|
|
53
|
-
6. Set the `Issuer URL to "https://login.microsoftonline.com/{tenantId}/v2.0"
|
|
52
|
+
If the `accessTokenAcceptedVersion` property is set to `2`: 6. Set the `Issuer URL to "https://login.microsoftonline.com/{tenantId}/v2.0"
|
|
54
53
|
7. Set an 'Allowed Audience' to the Application ID (`appId`)
|
|
55
54
|
|
|
56
|
-
If the `accessTokenAcceptedVersion` property is set to `1` or `null`:
|
|
57
|
-
|
|
58
|
-
7. Set an 'Allowed Audience' to the Application ID URI (also known as`identifierUri`). It should be in the format of`api://{azureFunctionAppName}.azurewebsites.net/{resourceApiAppId}` or `api://{FunctionAppFullyQualifiedDomainName}/{resourceApiAppId}` if using a [custom domain name](https://docs.microsoft.com/azure/dns/dns-custom-domain#:~:text=Azure%20Function%20App%201%20Navigate%20to%20Function%20App,Custom%20domain%20text%20field%20and%20select%20Validate.%20).
|
|
55
|
+
If the `accessTokenAcceptedVersion` property is set to `1` or `null`: 6. Set the `Issuer URL to "https://sts.windows.net/{tenantId}/"
|
|
56
|
+
7. Set an 'Allowed Audience' to the Application ID URI (also known as`identifierUri`). It should be in the format of`api://{azureFunctionAppName}.azurewebsites.net/{resourceApiAppId}`or`api://{FunctionAppFullyQualifiedDomainName}/{resourceApiAppId}` if using a [custom domain name](https://learn.microsoft.com/azure/dns/dns-custom-domain#:~:text=Azure%20Function%20App%201%20Navigate%20to%20Function%20App,Custom%20domain%20text%20field%20and%20select%20Validate.%20).
|
|
59
57
|
|
|
60
58
|
By default, the Authentication event trigger will validate that Azure Function authentication integration is configured and it will check that the **client** in the token is set to `99045fe1-7639-4a75-9d4a-577b6ca3810f` (via the `azp` or `appid` claims in the token).
|
|
61
59
|
|
|
62
60
|
If you want to test your API against some other client that is not Azure AD authentication events service, like using Postman, you can configure an _optional_ application setting:
|
|
63
61
|
|
|
64
|
-
|
|
62
|
+
- **AuthenticationEvents\_\_CustomCallerAppId** - the guid of your desired client. If not provided, `99045fe1-7639-4a75-9d4a-577b6ca3810f` is assumed.
|
|
65
63
|
|
|
66
64
|
#### Have the trigger validate the token
|
|
67
65
|
|
|
68
66
|
In local environments or environments that aren't hosted in the Azure Function service, the trigger can do the token validation. Set the following application settings:
|
|
69
67
|
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
68
|
+
- **AuthenticationEvents\_\_TenantId** - your tenant ID
|
|
69
|
+
- **AuthenticationEvents\_\_AudienceAppId** - the same value as "Allowed audience" in option 1.
|
|
70
|
+
- **AuthenticationEvents\_\_CustomCallerAppId** (_optional_) - the guid of your desired client. If not provided, `99045fe1-7639-4a75-9d4a-577b6ca3810f` is assumed.
|
|
73
71
|
|
|
74
72
|
An example `local.settings.json` file:
|
|
75
73
|
|
|
@@ -90,20 +88,20 @@ An example `local.settings.json` file:
|
|
|
90
88
|
|
|
91
89
|
If you would like to _not_ authenticate the token while in local development, set the following application setting:
|
|
92
90
|
|
|
93
|
-
|
|
91
|
+
- **AuthenticationEvents\_\_BypassTokenValidation** - value of `true` will make the trigger not check for a validation of the token.
|
|
94
92
|
|
|
95
93
|
### Quickstart
|
|
96
94
|
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
95
|
+
- Visual Studio Code
|
|
96
|
+
- Start Visual Studio Code
|
|
97
|
+
- Run the terminal command `func init . --worker-runtime node` via the command palette
|
|
98
|
+
- Run the terminal command `func new` via the command palette
|
|
99
|
+
- Follow the project creation prompts
|
|
100
|
+
- Run the terminal command `npm install @azure/functions-authentication-events` via the command palette
|
|
101
|
+
- Run the terminal command `npm install` via the command palette
|
|
102
|
+
- Run the terminal command `npm run-script build` via the command palette
|
|
103
|
+
- For development purpose turn of token validation for testing:
|
|
104
|
+
- Add the **AuthenticationEvents\_\_BypassTokenValidation** application key to the "Values" section in the local.settings.json file and set it's value to **true**. If you do not have a local.settings.json file in your local environment, create one in the root of your Function App.
|
|
107
105
|
|
|
108
106
|
```json
|
|
109
107
|
{
|
|
@@ -116,7 +114,7 @@ If you would like to _not_ authenticate the token while in local development, se
|
|
|
116
114
|
}
|
|
117
115
|
```
|
|
118
116
|
|
|
119
|
-
|
|
117
|
+
- Once the project is loaded, you can run the sample code and you should see the Azure functions developer's application load your end point.
|
|
120
118
|
|
|
121
119
|
## Key concepts
|
|
122
120
|
|
|
@@ -124,100 +122,97 @@ Key concepts of the Azure .NET SDK can be found [here](https://azure.github.io/a
|
|
|
124
122
|
|
|
125
123
|
## Documentation
|
|
126
124
|
|
|
127
|
-
|
|
125
|
+
- One the function has been published, there's some good reading about logging and metrics that can be found [here](https://learn.microsoft.com/azure/azure-functions/functions-monitor-log-analytics?tabs=csharp)
|
|
128
126
|
|
|
129
|
-
|
|
130
|
-
|
|
127
|
+
- For API Documentation, please see the (Link TBD)
|
|
128
|
+
- Once this moves to preview, we except no breaking changes and would be as simple as removing the the nuget source that points to the private preview.
|
|
131
129
|
|
|
132
130
|
## Examples
|
|
133
131
|
|
|
134
132
|
To Test Token Augmentation, please do the following.
|
|
135
133
|
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
134
|
+
- Open the project that was created in the prior step. (QuickStart)
|
|
135
|
+
- Run the Application. `func host start`
|
|
136
|
+
- Once the Azure functions developer's application has started, copy the listening url that is displayed with the application starts up.
|
|
137
|
+
- Note: All Authentication functions are listed, in the case we have one function listener registered called "**OnTokenIssuanceStart**"
|
|
138
|
+
- Your function endpoint will then be a combination of the listening url and function, for example: "http://localhost:7071/runtime/webhooks/AuthenticationEvents?code=(YOUR_CODE)&function=OnTokenIssuanceStart"
|
|
139
|
+
- Post the following payload using something like Postman or Fiddler.
|
|
140
|
+
- Steps for using Postman can be found (Link TBD)
|
|
143
141
|
|
|
144
142
|
```json
|
|
145
143
|
{
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
}
|
|
144
|
+
"type": "microsoft.graph.authenticationEvent.tokenIssuanceStart",
|
|
145
|
+
"source": "/tenants/00000001-0000-0ff1-ce00-000000000000/applications/ef9e995c-efdb-4e76-97a9-8cdfc6e06afc",
|
|
146
|
+
"data": {
|
|
147
|
+
"@odata.type": "microsoft.graph.onTokenIssuanceStartCalloutData",
|
|
148
|
+
"tenantId": "00000001-0000-0ff1-ce00-000000000000",
|
|
149
|
+
"authenticationEventListenerId": "f2390d57-9664-4dde-b625-f0115925e1e2",
|
|
150
|
+
"customAuthenticationExtensionId": "9cc1c1ed-5f04-4fdf-85c0-94a7c6ea819c",
|
|
151
|
+
"authenticationContext": {
|
|
152
|
+
"correlationId": "f4bd1870-b774-4fa5-ba78-e08ac6be14c0",
|
|
153
|
+
"client": {
|
|
154
|
+
"ip": "127.0.0.1",
|
|
155
|
+
"locale": "en-us",
|
|
156
|
+
"market": "en-us"
|
|
157
|
+
},
|
|
158
|
+
"protocol": "OAUTH2.0",
|
|
159
|
+
"clientServicePrincipal": {
|
|
160
|
+
"id": "eedfddb9-304e-4d62-aa83-24700a0bcf0e",
|
|
161
|
+
"appId": "ef9e995c-efdb-4e76-97a9-8cdfc6e06afc",
|
|
162
|
+
"appDisplayName": "",
|
|
163
|
+
"displayName": "Test application"
|
|
164
|
+
},
|
|
165
|
+
"resourceServicePrincipal": {
|
|
166
|
+
"id": "eedfddb9-304e-4d62-aa83-24700a0bcf0e",
|
|
167
|
+
"appId": "ef9e995c-efdb-4e76-97a9-8cdfc6e06afc",
|
|
168
|
+
"appDisplayName": "",
|
|
169
|
+
"displayName": "Test application"
|
|
170
|
+
},
|
|
171
|
+
"user": {
|
|
172
|
+
"companyName": "Evo Sts Test",
|
|
173
|
+
"country": "",
|
|
174
|
+
"id": "69d24544-c420-4721-a4bf-106f2378d9f6",
|
|
175
|
+
"mail": "testadmin@evostsoneboxtest.com",
|
|
176
|
+
"onPremisesSamAccountName": "testadmin",
|
|
177
|
+
"onPremisesSecurityIdentifier": "testadmin",
|
|
178
|
+
"preferredDataLocation": "",
|
|
179
|
+
"userPrincipalName": "testadmin@evostsoneboxtest.com"
|
|
180
|
+
}
|
|
184
181
|
}
|
|
182
|
+
}
|
|
185
183
|
}
|
|
186
184
|
```
|
|
187
185
|
|
|
188
|
-
|
|
186
|
+
- You should see this response:
|
|
189
187
|
|
|
190
188
|
```json
|
|
191
189
|
{
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
"Editor"
|
|
205
|
-
]
|
|
206
|
-
}
|
|
207
|
-
]
|
|
208
|
-
}
|
|
190
|
+
"data": {
|
|
191
|
+
"@odata.type": "microsoft.graph.onTokenIssuanceStartResponseData",
|
|
192
|
+
"actions": [
|
|
193
|
+
{
|
|
194
|
+
"@odata.type": "ProvideClaimsForToken",
|
|
195
|
+
"claims": [
|
|
196
|
+
{
|
|
197
|
+
"DateOfBirth": "01/01/2000"
|
|
198
|
+
},
|
|
199
|
+
{
|
|
200
|
+
"CustomRoles": ["Writer", "Editor"]
|
|
201
|
+
}
|
|
209
202
|
]
|
|
210
|
-
|
|
203
|
+
}
|
|
204
|
+
]
|
|
205
|
+
}
|
|
211
206
|
}
|
|
212
207
|
```
|
|
213
208
|
|
|
214
209
|
## Troubleshooting
|
|
215
210
|
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
211
|
+
- Visual Studio Code
|
|
212
|
+
- If running in Visual Studio Code, you get an error along the lines of the local Azure Storage Emulator is unavailable, you can start the emulator manually.! (Note: Azure Storage emulator is now deprecated and the suggested replacement is [Azurite](https://learn.microsoft.com/azure/storage/common/storage-use-azurite?tabs=visual-studio))
|
|
213
|
+
- If using Visual Studio Code on Mac please use [Azurite](https://learn.microsoft.com/azure/storage/common/storage-use-azurite?tabs=visual-studio)
|
|
214
|
+
- If you see the following error on Windows (it's a bug) when trying to run the created projected.
|
|
215
|
+
- This can be resolved by executing this command in powershell `Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine` more info on this can be found [here](https://github.com/Azure/azure-functions-core-tools/issues/1821) and [here](https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7)
|
|
221
216
|
|
|
222
217
|
## Next steps
|
|
223
218
|
|
|
@@ -225,11 +220,11 @@ For more information on Azure SDK, please refer to [this website](https://azure.
|
|
|
225
220
|
|
|
226
221
|
## Publish
|
|
227
222
|
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
|
|
223
|
+
- Follow the instruction here to create and publish your Azure Application. <https://learn.microsoft.com/azure/azure-functions/functions-develop-vs?tabs=in-process#publish-to-azure>
|
|
224
|
+
- To determine your published posting endpoint, combine the azure function endpoint you created, route to the listener and listener code, the listen code can be found by navigating to your azure function application, selecting "App Keys" and copying the value of AuthenticationEvents_extension.
|
|
225
|
+
- For example: "https://azureautheventstriggerdemo.azurewebsites.net/runtime/webhooks/AuthenticationEvents?code=(AuthenticationEvents_extension_key)&function=OnTokenIssuanceStart"
|
|
226
|
+
- Make sure your production environment has the correct application settings for token authentication.
|
|
227
|
+
- Once again you can test the published function by posting the above payload to the new endpoint.
|
|
233
228
|
|
|
234
229
|
## Contributing
|
|
235
230
|
|
|
@@ -252,6 +247,7 @@ more information see the [Code of Conduct FAQ][coc_faq] or contact
|
|
|
252
247
|
<opencode@microsoft.com> with any additional questions or comments.
|
|
253
248
|
|
|
254
249
|
<!-- LINKS -->
|
|
250
|
+
|
|
255
251
|
[cg]: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/resourcemanager/Azure.ResourceManager/docs/CONTRIBUTING.md
|
|
256
252
|
[coc]: https://opensource.microsoft.com/codeofconduct/
|
|
257
253
|
[coc_faq]: https://opensource.microsoft.com/codeofconduct/faq/
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@azure/functions-authentication-events",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
3
|
+
"version": "1.0.0-alpha.20250110.1",
|
|
4
4
|
"description": "Typescript Trigger SDK for Azure AD Authentication event custom extensions. Lets you focus on your business logic.",
|
|
5
5
|
"sdk-type": "client",
|
|
6
6
|
"main": "./dist/commonjs/index.js",
|
|
@@ -79,9 +79,9 @@
|
|
|
79
79
|
"disableDocsMs": true,
|
|
80
80
|
"productName": "Azure Template",
|
|
81
81
|
"productSlugs": [],
|
|
82
|
-
"apiRefLink": "https://
|
|
82
|
+
"apiRefLink": "https://learn.microsoft.com/javascript/api/",
|
|
83
83
|
"requiredResources": {
|
|
84
|
-
"Azure App Configuration": "https://
|
|
84
|
+
"Azure App Configuration": "https://learn.microsoft.com/azure/azure-app-configuration/"
|
|
85
85
|
}
|
|
86
86
|
},
|
|
87
87
|
"type": "module",
|