You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| 1.4.12 | v1.1.1 | v1.26, v1.27, v1.28, v1.29, v1.30 | Updated to Gateway API version 1.1.1, Regex match support for path and header match in HTTP and GRPC routes, [Wildcard hostname fix](https://github.com/Azure/AKS/issues/4713), Misc. bug fixes and improvements |
| 1.4.12 | v1.1.1 | v1.26, v1.27, v1.28, v1.29, v1.30 | Updated to Gateway API version 1.1.1, Regex match support for path and header match in HTTP and GRPC routes, [Wildcard hostname fix](https://github.com/Azure/AKS/issues/4713), Misc. bug fixes and improvements |
35
35
| 1.3.7| v1.1 | v1.26, v1.27, v1.28, v1.29, v1.30 | Minor fixes and improvements |
36
36
| 1.2.3| v1.1 | v1.26, v1.27, v1.28, v1.29, v1.30 | Gateway API v1.1, gRPC support, frontend mutual authentication, readiness probe fixes, custom health probe port and TLS mode |
37
37
| 1.0.2| v1 | v1.26, v1.27, v1.28, v1.29 | ECDSA + RSA certificate support for both Ingress and Gateway API, Ingress fixes, Server-sent events support |
Copy file name to clipboardExpand all lines: articles/application-gateway/for-containers/quickstart-deploy-application-gateway-for-containers-alb-controller.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -146,7 +146,7 @@ You need to complete the following tasks before deploying Application Gateway fo
146
146
az aks get-credentials --resource-group $RESOURCE_GROUP --name $AKS_NAME
In this example, the ALB controller version is **1.4.12**.
31
+
In this example, the ALB controller version is **1.4.14**.
32
32
33
33
The ALB Controller version can be upgraded by running the `helm upgrade alb-controller` command. For more information, see [Install the ALB Controller](quickstart-deploy-application-gateway-for-containers-alb-controller.md#install-the-alb-controller).
The following steps describe how to assign a **SignalR App Server** role to a service principal or a managed identity for an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml).
13
+
14
+
> [!NOTE]
15
+
> A role can be assigned to any scope, including management group, subscription, resource group, or single resource. To learn more about scope, see [Understand scope for Azure RBAC](../../role-based-access-control/scope-overview.md).
16
+
17
+
1. In the [Azure portal](https://portal.azure.com/), go to your Azure SignalR Service resource.
18
+
19
+
1. Select **Access control (IAM)** in the sidebar.
20
+
21
+
1. Select **Add** > **Add role assignment**.
22
+
23
+
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment.":::
24
+
25
+
1. On the **Role** tab, select **SignalR App Server** or other SignalR built-in roles depends on your scenario.
|[SignalR App Server](../../role-based-access-control/built-in-roles.md#signalr-app-server)| Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
30
+
|[SignalR Service Owner](../../role-based-access-control/built-in-roles.md#signalr-service-owner)| Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
31
+
|[SignalR REST API Owner](../../role-based-access-control/built-in-roles.md#signalr-rest-api-owner)| Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
32
+
|[SignalR REST API Reader](../../role-based-access-control/built-in-roles.md#signalr-rest-api-reader)| Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs. |
33
+
34
+
1. Select Next.
35
+
36
+
37
+
1. For Microsoft Entra application.
38
+
39
+
40
+
1. In the `Assign access` to row, select **User, group, or service principal**.
41
+
1. In the `Members` row, click `select members`, then choose the identity in the pop-up window.
42
+
43
+
1. For managed identity for Azure resources.
44
+
45
+
1. In the `Assign access` to row, select **Managed identity**.
46
+
1. In the `Members` row, click `select members`, then choose the application in the pop-up window.
47
+
48
+
1. Select Next.
49
+
50
+
51
+
1. Review your assignment, then click **Review + assign** to confirm the role assignment.
52
+
53
+
> [!IMPORTANT]
54
+
> Newly added role assignments might take up to 30 minutes to propagate.
55
+
56
+
To learn more about how to assign and manage Azure roles, see these articles:
57
+
58
+
-[Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml)
59
+
-[Assign Azure roles using the REST API](../../role-based-access-control/role-assignments-rest.md)
60
+
-[Assign Azure roles using Azure PowerShell](../../role-based-access-control/role-assignments-powershell.md)
61
+
-[Assign Azure roles using the Azure CLI](../../role-based-access-control/role-assignments-cli.md)
62
+
-[Assign Azure roles using Azure Resource Manager templates](../../role-based-access-control/role-assignments-template.md)
Copy file name to clipboardExpand all lines: articles/azure-signalr/signalr-concept-authorize-azure-active-directory.md
+22-8Lines changed: 22 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,7 +33,7 @@ When a security principal tries to access an Azure SignalR Service resource, the
33
33
34
34
When you use an access key, the key is shared between your app server (or function app) and the Azure SignalR Service resource. Azure SignalR Service authenticates the client connection request by using the shared key.
35
35
36
-
When you use Microsoft Entra ID, there is no shared key. Instead, Azure SignalR Service uses a *temporary access key* for signing tokens used in client connections. The workflow contains four steps:
36
+
When you use Microsoft Entra ID, there's no shared key. Instead, Azure SignalR Service uses a *temporary access key* for signing tokens used in client connections. The workflow contains four steps:
37
37
38
38
1. The security principal requires an OAuth 2.0 token from Microsoft Entra ID to authenticate itself.
39
39
2. The security principal calls the SignalR authentication API to get a temporary access key.
@@ -44,13 +44,27 @@ The temporary access key expires in 90 minutes. We recommend that you get a new
44
44
45
45
The workflow is built in the [Azure SignalR Service SDK for app servers](https://github.com/Azure/azure-signalr).
46
46
47
+
### Cross tenant access when using Microsoft Entra ID
48
+
49
+
In some cases, your server and your Azure SignalR resource may not be in the same tenant due to security concerns.
50
+
51
+
A [multitenant applications](/entra/identity-platform/single-and-multi-tenant-apps#best-practices-for-multitenant-apps) could help you in this scenario.
52
+
53
+
If you've already registered a single-tenant app, see [convert your single-tenant app to multitenant](/entra/identity-platform/howto-convert-app-to-be-multi-tenant).
54
+
55
+
Once you have registered the multitenant application in your `tenantA`, you should provision it as an enterprise application in your `tenantB`.
56
+
57
+
[Create an enterprise application from a multitenant application in Microsoft Entra ID](/entra/identity/enterprise-apps/create-service-principal-cross-tenant?pivots=msgraph-powershell)
58
+
59
+
The application registered in your `tenantA` and the enterprise application provisioned in your `tenantB` share the same Application (client) ID.
60
+
47
61
## Assign Azure roles for access rights
48
62
49
63
Microsoft Entra ID authorizes access rights to secured resources through [Azure RBAC](../role-based-access-control/overview.md). Azure SignalR Service defines a set of Azure built-in roles that encompass common sets of permissions for accessing Azure SignalR Service resources. You can also define custom roles for access to Azure SignalR Service resources.
50
64
51
65
### Resource scope
52
66
53
-
You might have to determine the scope of access that the security principal should have before you assign any Azure RBAC role to a security principal. We recommend that you grant only the narrowest possible scope. Azure RBAC roles defined at a broader scope are inherited by the resources beneath them.
67
+
Before assigning Azure RBAC roles to a security principal, it’s essential to define the appropriate scope of access they should have. We advise granting the most limited scope necessary to minimize unnecessary permissions. Keep in mind that Azure RBAC roles assigned at a higher or broader scope are automatically inherited by the resources nested within that scope.
54
68
55
69
You can scope access to Azure SignalR Service resources at the following levels, beginning with the narrowest scope.
56
70
@@ -65,16 +79,16 @@ You can scope access to Azure SignalR Service resources at the following levels,
|[SignalR App Server](../role-based-access-control/built-in-roles.md#signalr-app-server)| Access to the WebSocket connection creation API and authentication APIs. | Most commonly used for an app server. |
69
-
|[SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner)| Full access to all data-plane APIs, including REST APIs, the WebSocket connection creation API, and authentication APIs. |Use for *serverless mode* for authorization with Microsoft Entra ID, because it requires both REST API permissions and authentication API permissions. |
70
-
|[SignalR REST API Owner](../role-based-access-control/built-in-roles.md#signalr-rest-api-owner)| Full access to data-plane REST APIs. |Often used to write a tool that manages connections and groups, but does *not* make connections or call authentication APIs. |
71
-
|[SignalR REST API Reader](../role-based-access-control/built-in-roles.md#signalr-rest-api-reader)| Read-only access to data-plane REST APIs. |Commonly used to write a monitoring tool that calls *only* Azure SignalR Service data-plane read-only REST APIs.|
82
+
|[SignalR App Server](../role-based-access-control/built-in-roles.md#signalr-app-server)| Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
83
+
|[SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner)| Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. |For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
84
+
|[SignalR REST API Owner](../role-based-access-control/built-in-roles.md#signalr-rest-api-owner)| Full access to data-plane REST APIs. |For using [Azure SignalR Management SDK](./signalr-howto-use-management-sdk.md) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
85
+
| [SignalR REST API Reader](../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs.
72
86
73
87
## Next steps
74
88
75
-
- To learn how to create an Azure application and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra applications](signalr-howto-authorize-application.md).
89
+
- To learn how to create an Azure application and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra applications](./signalr-howto-authorize-application.md).
76
90
77
-
- To learn how to configure a managed identity and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra managed identities](signalr-howto-authorize-managed-identity.md).
91
+
- To learn how to configure a managed identity and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra managed identities](./signalr-howto-authorize-managed-identity.md).
78
92
79
93
- To learn more about roles and role assignments, see [What is Azure role-based access control (Azure RBAC)?](../role-based-access-control/overview.md).
0 commit comments