Replies: 6 comments 9 replies
-
|
Hi @DennisRP, [See full thread here: Discussions/1720] When using DAB with Static Web Apps (Database Connections feature), DAB configuration (for Static Web Apps, this file may be named "authentication": {
"provider": "StaticWebApps"
}From Static Web Apps, you can then configure authentication providers like Azure AD. Step by step found here: https://learn.microsoft.com/azure/static-web-apps/authentication-authorization For convenience, these were the steps I had used to create my own working SWA+DAB environment. The following changes should be made in your Static Web Apps config file
"auth": {
"identityProviders": {
"azureActiveDirectory": {
"registration": {
"openIdIssuer": "https://login.microsoftonline.com/<TENANT_ID_REPLACE_THIS>/v2.0",
"clientIdSettingName": "AZURE_CLIENT_ID",
"clientSecretSettingName": "AZURE_CLIENT_SECRET"
}
}
}
}
{
"route": "/data-api/*",
"allowedRoles": ["anonymous","authenticated"]
}
{
"route": "/data-api/*",
"allowedRoles": ["anonymous","authenticated", "samplerole"]
}Example config file (For reference only): {
"routes": [
{
"route": "/authenticated/*",
"allowedRoles": [
"authenticated"
]
},
{
"route": "/data-api/*",
"allowedRoles": [
"anonymous",
"authenticated"
]
}
],
"auth": {
"identityProviders": {
"azureActiveDirectory": {
"registration": {
"openIdIssuer": "https://login.microsoftonline.com/<TENANT_ID_REPLACE_THIS>/v2.0",
"clientIdSettingName": "AZURE_CLIENT_ID",
"clientSecretSettingName": "AZURE_CLIENT_SECRET"
}
}
}
}
} |
Beta Was this translation helpful? Give feedback.
-
|
@thomasgauvin, could you please take a look at this question? |
Beta Was this translation helpful? Give feedback.
-
|
If App Roles value is "Application.Read" for Azure App Registration, please change role's value to "Application.Read" instead of "authenticated" from config json. And add X-MS-API-ROLE: Application.Read to the header when invoking. Have a try. "permissions": [ |
Beta Was this translation helpful? Give feedback.
-
|
Also, check this you. With SWA it should be as easy as using the "StaticWebApps" provider in the configuration file, and then calling Check out this video too: Authentication and row level-security with Jamstack application in 10 minutes Completely different configuration if you need to customize the AAD Authentication Process (for example you want to allow only people with a certain email domain to log in). Let me know if you need custom authentucation, I have a sample ready with that :) |
Beta Was this translation helpful? Give feedback.
-
|
So, like I saw some other guy here in another thread do, I instead deployed my DAB service as an Azure Container Instance, which straight away worked with AzureAD as authentication for my App Registrations. |
Beta Was this translation helpful? Give feedback.
-
|
I have spent two days trying to find a solution to this problem, and finally, I found this discussion. The authentication works perfectly when I run the SWA locally, but it does not work on Azure. Here are my values on staticwebapp.database.config.json file: And the permissions: I have the X-MS-API-ROLE in my api calls and have done everything as explained in this article: https://learn.microsoft.com/en-gb/azure/data-api-builder/authentication-azure-ad What am I doing wrong? |
Beta Was this translation helpful? Give feedback.









Uh oh!
There was an error while loading. Please reload this page.
-
It should be simple, but I cannot get it to work.
If DAB _entity._permission.role is "anonymous", it works. If I use "authenticated". I always get:
I am creating a Static Web App in Azure, enabling Database connection (preview), adjusting autogenerated pipeline yaml by adding "skip_app_build: true" for it to run and deploy configuration.
Creating two App Registrations; one for DAB and another for an service principal/app to test the access.
Auth provider in DAB is set to AzureAD with correct DAB client id and tenant url.
I can generate an accesstoken for the service principal, but I still get 403 when sending it to DAB. I even tried to create an app role, changed role for one of the database entities to matched, verified that it existed in the jwt accesstoken, adding X-MS-API-ROLE to the header - but still same error message.
I know I am doing something wrong, but not sure what.
Beta Was this translation helpful? Give feedback.
All reactions