一段时间以来,我一直在努力应对Azure App Service身份验证。我正在运行CI / CD管道,并希望使用ARM模板配置应用程序服务身份验证。参见此处(部分)我的模板:
{
"name": "[parameters('apiAppName')]",
"type": "Microsoft.Web/sites",
"location": "[resourceGroup().location]",
"apiVersion": "2015-08-01",
"dependsOn": [
"[resourceId('Microsoft.Web/serverfarms', parameters('apiHostingPlanName'))]"
],
"properties": {
"name": "[parameters('apiAppName')]",
"serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('apiHostingPlanName'))]",
"siteConfig": {
"siteAuthEnabled": true,
"siteAuthSettings": {
"unauthenticatedClientAction": 0,
"defaultProvider": 0,
"tokenStoreEnabled": true,
"clientAffinityEnabled": false
}
}
}
}
在部署它时,它仍将所有身份验证提供程序显示为未配置。
要配置AAD提供程序,我只想出两种解决方案:
我想知道,有什么方法可以自动获得所需的应用程序身份?可能与/结合使用托管服务标识
答案 0 :(得分:0)
可能有点晚了,但是如果您还没有找到答案的话...
资源[]
"apiVersion": "2018-02-01",
"type": "Microsoft.Web/sites",
"kind": "app",
"name": "[variables('webAppName')]",
"location": "[parameters('location')]",
"identity": {
"type": "SystemAssigned"
},
并在输出中包含servicePrincpalId,以便可以将其重新用于设置对所需资源密钥库的访问;斑点sql等
"outputs": {
"appServicePrincipalId": {
"type": "string",
"value": "[reference(concat(resourceId('Microsoft.Web/sites/', variables('webAppName')),'/providers/Microsoft.ManagedIdentity/Identities/default'), '2015-08-31-PREVIEW').principalId]"
},
答案 1 :(得分:0)
可能类似于...在现有Microsoft.Web / sites部分下添加资源数组。
{
"name": "authsettings",
"type": "config",
"apiVersion": "2015-08-01",
"dependsOn": [
"[resourceId('Microsoft.Web/sites/', variables('webAppName'))]"
],
"properties": {
"enabled": true,
"httpApiPrefixPath": null,
"unauthenticatedClientAction": "RedirectToLoginPage",
"tokenStoreEnabled": true,
"allowedExternalRedirectUrls": null,
"defaultProvider": "AzureActiveDirectory",
"clientId": "[variables('clientId')]",
"clientSecret": "[variables('clientSecret')]",
"issuer": "[concat('https://sts.windows.net/', subscription().tenantId, '/')]",
"allowedAudiences": [
"[concat('https://', variables('fqdn'), '/.auth/login/aad/callback')]"
],
"additionalLoginParams": null,
"isAadAutoProvisioned": false
}
}
答案 2 :(得分:0)
我测试了不同的选项,以使其仅使用Arm模板即可部署Webapp并直接启用身份验证,但它似乎不起作用。我采用正确的CI / CD方式的方法是通过使用Azure CLI命令添加一个额外的任务来启用身份验证并分配应用程序clientId。 我的任务:
- task: RalphJansen.Azure-AD-Application-Management.New-Azure-AD-Application.New-Azure-AD-Application@2
displayName: 'New Azure AD Application'
inputs:
azureSubscription: 'SubscriptionID'
name: '$(apiName)'
signOnUrl: 'https://$(apiName).azurewebsites.net'
- task: AzureResourceGroupDeployment@2
displayName: 'Create WebApp'
inputs:
azureSubscription: 'SubscriptionID'
resourceGroupName: '$(ResourceGroup)'
location: 'Canada East'
csmFile: '$(System.DefaultWorkingDirectory)/_build/drop/azuredeploy.json'
overrideParameters: '-apiName $(apiName) -appServicePlanName $(appServicePlanName)'
- task: AzureCLI@1
displayName: 'Update WebApp to do Oauth authentification & enable Oauth2ImplicitFlow'
inputs:
azureSubscription: 'SubscriptionID'
scriptLocation: inlineScript
inlineScript: |
call az webapp auth update --name $(apiName) --aad-client-id $(out.ApplicationId) --action LoginWithAzureActiveDirectory --enabled true --resource-group "$(ResourceGroup)" --aad-token-issuer-url "https://sts.windows.net/your AAD ID here" --token-store true
call az ad app update --id $(out.ApplicationId) --oauth2-allow-implicit-flow true