ApiConnections in local development scenarios with vscode

[rayburks]

Hi,

i use Standard Logic Apps to implement a cloud native lowcode solution and have a relative simple question, but don't found a real good explanation in microsoft docs:

How could i create(transform) the managed Api Connection which use an app service(WebApp with a swagger api) in azure to use this for local development in vscode.
For instance, if i start the (standard) function app locally in vscode, then i got the following error:

Workflow '<my-workflow>' validation and creation failed. Error: 'The API connection reference name 'my-connector' has invalid authentication type 'ManagedServiceIdentity'. Only 'Raw' or 'ActiveDirectoryOAuth' authentication type is allowed in local developer environment.'

My connections.json in azure looks like:

"managedApiConnections": {

....
  "my-connector": {
        "api": {
            "id": "/subscriptions/<subscriptionid>/resourceGroups/<resourcegroup>/providers/Microsoft.Web/customApis/my-connector-in-azure"
        },
        "authentication": {
            "type": "ManagedServiceIdentity"
        },
        "connection": {
            "id": "/subscriptions/<subscriptionid>/resourceGroups/<resourcegroup>/providers/Microsoft.Web/connections/my-connection"
        },
        "connectionRuntimeUrl": "<my-connection-runtime-url>"
      }
.....
}

I found in the documentation it is possible to use the authentication type "Raw", but it fails because i couldn't found the right settings for local development.

"authentication": {
            "type": "Raw" // instead of ManagedServiceIdentity
}
...

In addition, i couldn't found a reference for the connections.json file in MS documentation.

And my Custom Api in azure use a apikey for authentication, which is defined in the ApiConnection in azure. How could this ApiConnection transfrom to use it for local development?

Any help is appreciated. Thx in advance.
Regards Ray

[mark-abrams]

Hi @rayburks, in a local development environment you can set the authentication.type to Raw or ActiveDirectoryOAuth, depending on how you want developers to connect to the API connection's token store in Azure.

The managed connection configuration that is committed into your Git repo should use Raw or ActiveDirectoryOAuth. Don't commit to the repo any connection configuration using ManagedServiceIdentity because this is only used in Azure environments, it is not used when developing locally. When you edit a workflow locally and create a new managed API connection, the workflow designer will automatically create the required configuration for you in your environment, including the connector configuration in connections.json and local.settings.json, using the Raw authentication type.

Information about how to use ActiveDirectoryOAuth instead of Raw is described here and this is the approach that I prefer because it avoids having a raw token that expires after 7 days which can get annoying for developers. It requires an App Registration to be created in Azure AD (or rather Entra ID) and you then assign an access policy for the related Service Principal to the API connector.

Before you deploy a Logic App to an Azure environment you need to change the authentication.type to ManagedServiceIdentity so that the Logic App connects to the token store using its own managed identity. This is described in the Microsoft documentation. It is also described in the Integration Services blog.

There are different ways that you can do this. I prefer automating it as part of a DevOps build pipeline so that (i) developers don't have to worry about it and (ii) the build output that is generated by the build pipeline is configured ready for a deployment pipeline that deploys the workflows (and related configuration) to the Logic App resource in Azure. You can write a simply PowerShell script that manipulates the connections.json file and updates the authentication object in the JSON for each managed connection, and then call this script from the build pipeline.

I use something like this:

param(
    [Parameter(Mandatory=$True)]
    [string]
    $logicAppFolderPath
)

$ErrorActionPreference = 'Stop'

# Get the connections file
$connectionsFilePath = [IO.Path]::Combine($logicAppFolderPath, 'connections.json')
Write-Host "Updating connections file: $connectionsFilePath"
$json = Get-Content -Path $connectionsFilePath | ConvertFrom-Json

If ([bool]($json.PSobject.Properties.name -match "managedApiConnections") -eq $false)
{
    return
}

# For each Managed API connection
$json.managedApiConnections.PsObject.Properties.Value | ForEach-Object {
    
    # Replace with Managed Service Identity authentication
    If ([bool]($_.authentication.PSObject.Properties.name -match "type") -eq $true) {
        $_.authentication.type = "ManagedServiceIdentity"
    }
    
    # Remove any unnecessary properties relating to 'raw' authentication
    If ([bool]($_.authentication.PSObject.Properties.name -match "audience") -eq $true) {
        $_.authentication.PSObject.Properties.Remove('audience')
    }
    If ([bool]($_.authentication.PSObject.Properties.name -match "credentialType") -eq $true) {
        $_.authentication.PSObject.Properties.Remove('credentialType')
    }
    If ([bool]($_.authentication.PSObject.Properties.name -match "clientId") -eq $true) {
        $_.authentication.PSObject.Properties.Remove('clientId')
    }
    If ([bool]($_.authentication.PSObject.Properties.name -match "tenant") -eq $true) {
        $_.authentication.PSObject.Properties.Remove('tenant')
    }
    If ([bool]($_.authentication.PSObject.Properties.name -match "secret") -eq $true) {
        $_.authentication.PSObject.Properties.Remove('secret')
    }
    If ([bool]($_.authentication.PSObject.Properties.name -match "scheme") -eq $true) {
        $_.authentication.PSObject.Properties.Remove('scheme')
    }
    If ([bool]($_.authentication.PSObject.Properties.name -match "parameter") -eq $true) {
        $_.authentication.PSObject.Properties.Remove('parameter')
    }
}

# Write the updated content
Remove-Item -Path $connectionsFilePath -Force -Recurse
$json | ConvertTo-Json -Depth 20 | Out-File ( New-Item -Path $connectionsFilePath -Force )

Mike Stephenson has also created a good video about Managed API connectors and the associated DevOps processes, check it out here. He takes a similar appraoch and uses a similar PowerShell file.

[mark-abrams]

@rayburks , please remember to close this discussion as resolved if you are happy with my response.

[rayburks]

Hi Mark, thx for the infos.

Have still one question.
Ok i changed the managed Api connections in the local environment to auttype: "Raw".
Now if i start the Designer, i got a error message:
Unable to initialize operation details for swagger based operation - .
Error details - The access token is from the wrong issuer '
https://sts.windows.net/'wrong tenant'/'

I have access to many tenants and subscriptions in azure.
I got also this error, after running the following command:
az accountz set -s 'the right subscription'

Do i have to configure this locally in vscode for the logic app?

Besides of that the discussion could be closed.
Regards Ray