You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/spring-apps/tutorial-managed-identities-functions.md
+73-52Lines changed: 73 additions & 52 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,17 +14,17 @@ ms.date: 07/10/2020
14
14
> [!NOTE]
15
15
> Azure Spring Apps is the new name for the Azure Spring Cloud service. Although the service has a new name, you'll see the old name in some places for a while as we work to update assets such as screenshots, videos, and diagrams.
This article shows you how to create a managed identity for an Azure Spring Apps app and use it to invoke Http triggered Functions.
19
+
This article shows you how to create a managed identity for an Azure Spring Apps app and use it to invoke HTTP triggered Functions.
20
20
21
-
Both Azure Functions and App Services have built in support for Azure Active Directory (Azure AD) authentication. By leveraging this built-in authentication capability along with Managed Identities for Azure Spring Apps, we can invoke RESTful services using modern OAuth semantics. This method doesn't require storing secrets in code and provides more granular controls for controlling access to external resources.
21
+
Both Azure Functions and App Services have built in support for Azure Active Directory (Azure AD) authentication. By using this built-in authentication capability along with Managed Identities for Azure Spring Apps, we can invoke RESTful services using modern OAuth semantics. This method doesn't require storing secrets in code and provides more granular controls for controlling access to external resources.
22
22
23
23
## Prerequisites
24
24
25
25
*[Sign up for an Azure subscription](https://azure.microsoft.com/free/)
26
26
*[Install the Azure CLI version 2.45.0 or higher](/cli/azure/install-azure-cli)
27
-
*[Install Maven 3.0 or above](https://maven.apache.org/download.cgi)
27
+
*[Install Maven 3.0 or higher](https://maven.apache.org/download.cgi)
28
28
*[Install the Azure Functions Core Tools version 3.0.2009 or higher](../azure-functions/functions-run-local.md#install-the-azure-functions-core-tools)
29
29
30
30
## Create a resource group
@@ -39,43 +39,54 @@ az group create --name myResourceGroup --location eastus
39
39
40
40
To create a Function app you must first create a backing storage account, use the command [az storage account create](/cli/azure/storage/account#az-storage-account-create):
41
41
42
-
> [!Important]
42
+
> [!IMPORTANT]
43
43
> Each Function app and Storage Account must have a unique name. Replace *\<your-functionapp-name>* with the name of your Function app and *\<your-storageaccount-name>* with the name of your Storage Account in the following examples.
Once the Storage Account has been created, you can create the Function app.
53
+
After the Storage Account is created, you can create the Function app.
50
54
51
55
```azurecli
52
-
az functionapp create --name <your-functionapp-name> --resource-group myResourceGroup --consumption-plan-location eastus --os-type windows --runtime node --storage-account <your-storageaccount-name> --functions-version 3
56
+
az functionapp create \
57
+
--resource-group myResourceGroup \
58
+
--name <your-functionapp-name> \
59
+
--consumption-plan-location eastus \
60
+
--os-type windows \
61
+
--runtime node \
62
+
--storage-account <your-storageaccount-name> \
63
+
--functions-version 3
53
64
```
54
65
55
-
Make a note of the returned **hostNames**, which will be in the format *https://\<your-functionapp-name>.azurewebsites.net*. It will be used in a following step.
66
+
Make a note of the returned `hostNames` value, which is in the format *https://\<your-functionapp-name>.azurewebsites.net*. You use this value in a following step.
56
67
57
68
## Enable Azure Active Directory Authentication
58
69
59
-
Access the newly created Function app from the [Azure portal](https://portal.azure.com) and select "Authentication / Authorization" from the settings menu. Enable App Service Authentication and set the "Action to take when request is not authenticated" to "Log in with Azure Active Directory". This setting will ensure that all unauthenticated requests are denied (401 response).
70
+
Access the newly created Function app from the [Azure portal](https://portal.azure.com) and select **Authentication / Authorization** from the settings menu. Enable App Service Authentication and set the **Action to take when request is not authenticated** to **Log in with Azure Active Directory**. This setting ensures that all unauthenticated requests are denied (401 response).
60
71
61
-
72
+
:::image type="content" source="media/spring-cloud-tutorial-managed-identities-functions/function-auth-config-1.jpg" alt-text="Screenshot of the Azure portal showing Authentication / Authorization page with Azure Active Directory set as the default provider." lightbox="media/spring-cloud-tutorial-managed-identities-functions/function-auth-config-1.jpg":::
62
73
63
-
Under Authentication Providers, select Azure Active Directory to configure the application registration. Selecting Express Management Mode will automatically create an application registration in your Azure AD tenant with the correct configuration.
74
+
Under **Authentication Providers**, select **Azure Active Directory** to configure the application registration. Selecting **Express Management Mode**automatically creates an application registration in your Azure AD tenant with the correct configuration.
64
75
65
-
76
+
:::image type="content" source="media/spring-cloud-tutorial-managed-identities-functions/function-auth-config-2.jpg" alt-text="Screenshot of the Azure portal showing the Azure Active Directory provider set to Express Management Mode." lightbox="media/spring-cloud-tutorial-managed-identities-functions/function-auth-config-2.jpg":::
66
77
67
-
Once you save the settings, the function app will restart and all subsequent requests will be prompted to log in via Azure AD. You can test that unauthenticated requests are now being rejected by navigating to the function apps root URL (returned in the **hostNames** output in the step above). You should be redirected to your organizations Azure AD login screen.
78
+
After you save the settings, the function app restarts and all subsequent requests are prompted to log in via Azure AD. You can test that unauthenticated requests are now being rejected by navigating to the function apps root URL (returned in the `hostNames` output in a previous step). You should be redirected to your organizations Azure AD login screen.
68
79
69
-
## Create an Http Triggered Function
80
+
## Create an HTTP Triggered Function
70
81
71
-
In an empty local directory, create a new function app and add an Http triggered function.
82
+
In an empty local directory, create a new function app and add an HTTP triggered function.
72
83
73
84
```console
74
85
func init --worker-runtime node
75
86
func new --template HttpTrigger --name HttpTrigger
76
87
```
77
88
78
-
By default Functions use key-based authentication to secure Http endpoints. Since we'll be enabling Azure AD authentication to secure access to the Functions, we want to [set the function auth level to anonymous](../azure-functions/functions-bindings-http-webhook-trigger.md#secure-an-http-endpoint-in-production) in the *function.json* file.
89
+
By default, Functions use key-based authentication to secure HTTP endpoints. Since we're enabling Azure AD authentication to secure access to the Functions, we want to [set the function auth level to anonymous](../azure-functions/functions-bindings-http-webhook-trigger.md#secure-an-http-endpoint-in-production) in the *function.json* file.
79
90
80
91
```json
81
92
{
@@ -89,7 +100,7 @@ By default Functions use key-based authentication to secure Http endpoints. Sinc
89
100
}
90
101
```
91
102
92
-
The app can now be published to the [Function app](#create-a-function-app) instance created in the previous step.
103
+
You can now publish the app to the [Function app](#create-a-function-app) instance created in the previous step.
@@ -111,64 +122,74 @@ After installing the spring extension, create an Azure Spring Apps instance with
111
122
112
123
```azurecli
113
124
az extension add --upgrade --name spring
114
-
az spring create --name mymsispringcloud --resource-group myResourceGroup --location eastus
125
+
az spring create \
126
+
--resource-group myResourceGroup \
127
+
--name mymsispringcloud \
128
+
--location eastus
115
129
```
116
130
117
131
The following example creates an app named `msiapp` with a system-assigned managed identity, as requested by the `--assign-identity` parameter.
118
132
119
133
```azurecli
120
-
az spring app create --name "msiapp" --service "mymsispringcloud" --resource-group "myResourceGroup" --assign-endpoint true --assign-identity
134
+
az spring app create \
135
+
--resource-group "myResourceGroup" \
136
+
--service "mymsispringcloud" \
137
+
--name "msiapp" \
138
+
--assign-endpoint true \
139
+
--assign-identity
121
140
```
122
141
123
142
## Build sample Spring Boot app to invoke the Function
124
143
125
-
This sample will invoke the Http triggered function by first requesting an access token from the [MSI endpoint](../active-directory/managed-identities-azure-resources/how-to-use-vm-token.md#get-a-token-using-http) and using that token to authenticate the Function http request.
144
+
This sample invokes the HTTP triggered function by first requesting an access token from the [MSI endpoint](../active-directory/managed-identities-azure-resources/how-to-use-vm-token.md#get-a-token-using-http) and using that token to authenticate the Function http request.
0 commit comments