-
Notifications
You must be signed in to change notification settings - Fork 469
Description
Currently the pattern most customers follow when enabling Easy Auth on their Function App is to mark their http functions with auth level Anonymous, since upstream Easy Auth is ensuring that no unauthenticated calls are allowed, so additional key auth requirements are unnecessary.
We should consider making changes that would allow such customers to specify an auth level User (see existing AuthorizationLevel.User). We'd do the work in the auth pipeline to identify when the request has an authenticated Easy Auth identity, and add the User auth level claim, similar to how we do for the Admin claim here. Then, then our downstream authorization pipeline would just work.
The benefit is that function metadata correctly reflects the actual authentication requirements.