Skip to content

Commit 454066a

Browse files
authored
Merge pull request #216514 from MicrosoftDocs/main
Publish to live, Monday 4 AM PST, 10/31
2 parents ed47576 + 82d5732 commit 454066a

File tree

61 files changed

+966
-280
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+966
-280
lines changed

articles/active-directory/develop/quickstart-register-app.md

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: active-directory
88
ms.subservice: develop
99
ms.topic: quickstart
1010
ms.workload: identity
11-
ms.date: 01/13/2022
11+
ms.date: 10/31/2022
1212
ms.author: cwerner
1313
ms.custom: aaddev, identityplatformtop40, contperf-fy21q1, contperf-fy21q2, contperf-fy21q4, mode-other
1414
#Customer intent: As developer, I want to know how to register my application with the Microsoft identity platform so that the security token service can issue ID and/or access tokens to client applications that request them.
@@ -136,6 +136,26 @@ Client secrets are considered less secure than certificate credentials. Applicat
136136

137137
For application security recommendations, see [Microsoft identity platform best practices and recommendations](identity-platform-integration-checklist.md#security).
138138

139+
140+
### Add a federated credential
141+
142+
Federated identity credentials are a type of credential that allows workloads, such as GitHub Actions, workloads running on Kubernetes, or workloads running in compute platforms outside of Azure access Azure AD protected resources without needing to manage secrets using [workload identity federation](workload-identity-federation.md).
143+
144+
To add a federated credential, follow these steps:
145+
146+
1. In the Azure portal, in **App registrations**, select your application.
147+
1. Select **Certificates & secrets** > **Federated credentials** > **Add a credential**.
148+
1. In the **Federated credential scenario** drop-down box, select one of the supported scenarios, and follow the corresponding guidance to complete the configuration.
149+
150+
- **Customer managed keys** for encrypt data in your tenant using Azure Key Vault in another tenant.
151+
- **GitHub actions deploying Azure resources** to [configure a GitHub workflow](workload-identity-federation-create-trust.md#github-actions) to get tokens for your application and deploy assets to Azure.
152+
- **Kubernetes accessing Azure resources** to configure a [Kubernetes service account](workload-identity-federation-create-trust.md#kubernetes) to get tokens for your application and access Azure resources.
153+
- **Other issuer** to configure an identity managed by an external [OpenID Connect provider](workload-identity-federation-create-trust.md#other-identity-providers) to get tokens for your application and access Azure resources.
154+
155+
156+
For more information, how to get an access token with a federated credential, check out the [Microsoft identity platform and the OAuth 2.0 client credentials flow](v2-oauth2-client-creds-grant-flow.md#third-case-access-token-request-with-a-federated-credential) article.
157+
158+
139159
## Next steps
140160

141161
Client applications typically need to access resources in a web API. You can protect your client application by using the Microsoft identity platform. You can also use the platform for authorizing scoped, permissions-based access to your web API.

articles/active-directory/develop/workload-identity-federation.md

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
99
ms.subservice: develop
1010
ms.workload: identity
1111
ms.topic: conceptual
12-
ms.date: 09/19/2022
12+
ms.date: 10/31/2022
1313
ms.author: ryanwi
1414
ms.reviewer: shkhalid, udayh, vakarand
1515
ms.custom: aaddev
@@ -23,9 +23,9 @@ You can use workload identity federation in scenarios such as GitHub Actions, wo
2323

2424
## Why use workload identity federation?
2525

26-
Typically, a software workload (such as an application, service, script, or container-based application) needs an identity in order to authenticate and access resources or communicate with other services. When these workloads run on Azure, you can use managed identities and the Azure platform manages the credentials for you. For a software workload running outside of Azure, you need to use application credentials (a secret or certificate) to access Azure AD protected resources (such as Azure, Microsoft Graph, Microsoft 365, or third-party resources). These credentials pose a security risk and have to be stored securely and rotated regularly. You also run the risk of service downtime if the credentials expire.
26+
Typically, a software workload (such as an application, service, script, or container-based application) needs an identity in order to authenticate and access resources or communicate with other services. When these workloads run on Azure, you can use [managed identities](../managed-identities-azure-resources/overview.md) and the Azure platform manages the credentials for you. For a software workload running outside of Azure, you need to use application credentials (a secret or certificate) to access Azure AD protected resources (such as Azure, Microsoft Graph, Microsoft 365, or third-party resources). These credentials pose a security risk and have to be stored securely and rotated regularly. You also run the risk of service downtime if the credentials expire.
2727

28-
You use workload identity federation to configure an Azure AD app registration or user-assigned managed identity to trust tokens from an external identity provider (IdP), such as GitHub. Once that trust relationship is created, your software workload can exchange trusted tokens from the external IdP for access tokens from Microsoft identity platform. Your software workload then uses that access token to access the Azure AD protected resources to which the workload has been granted access. This eliminates the maintenance burden of manually managing credentials and eliminates the risk of leaking secrets or having certificates expire.
28+
You use workload identity federation to configure an Azure AD app registration or [user-assigned managed identity](../managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md) to trust tokens from an external identity provider (IdP), such as GitHub. Once that trust relationship is created, your software workload can exchange trusted tokens from the external IdP for access tokens from Microsoft identity platform. Your software workload then uses that access token to access the Azure AD protected resources to which the workload has been granted access. This eliminates the maintenance burden of manually managing credentials and eliminates the risk of leaking secrets or having certificates expire.
2929

3030
## Supported scenarios
3131

@@ -41,7 +41,10 @@ The following scenarios are supported for accessing Azure AD protected resources
4141

4242
## How it works
4343

44-
Create a trust relationship between the external IdP and an app or user-assigned managed identity in Azure AD by configuring a [federated identity credential](/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-beta&preserve-view=true). The federated identity credential is used to indicate which token from the external IdP should be trusted by your application or managed identity. You configure the federated identity credential on an app registration in the Azure portal or through Microsoft Graph. A federated credential is configured on a user-assigned managed identity through the Azure portal, Azure CLI, Azure PowerShell, Azure SDK, and Azure Resource Manager (ARM) templates. The steps for configuring the trust relationship will differ, depending on the scenario and external IdP.
44+
Create a trust relationship between the external IdP and an app registration or user-assigned managed identity in Azure AD. The federated identity credential is used to indicate which token from the external IdP should be trusted by your application or managed identity. You configure a federated identity either:
45+
46+
- On an Azure AD [App registration](/azure/active-directory/develop/quickstart-register-app) in the Azure portal or through Microsoft Graph. This configuration allows you to get an access token for your application without needing to manage secrets outside Azure. For more information, learn how to [configure an app to trust an external identity provider](workload-identity-federation-create-trust.md).
47+
- On a user-assigned managed identity through the Azure portal, Azure CLI, Azure PowerShell, Azure SDK, and Azure Resource Manager (ARM) templates. The external workload uses the access token to access Azure AD protected resources without needing to manage secrets (in supported scenarios). The [steps for configuring the trust relationship](workload-identity-federation-create-trust-user-assigned-managed-identity.md) will differ, depending on the scenario and external IdP.
4548

4649
The workflow for exchanging an external token for an access token is the same, however, for all scenarios. The following diagram shows the general workflow of a workload exchanging an external token for an access token and then accessing Azure AD protected resources.
4750

@@ -62,4 +65,4 @@ Learn more about how workload identity federation works:
6265
- How to create, delete, get, or update [federated identity credentials](workload-identity-federation-create-trust.md) on an app registration.
6366
- How to create, delete, get, or update [federated identity credentials](workload-identity-federation-create-trust-user-assigned-managed-identity.md) on a user-assigned managed identity.
6467
- Read the [GitHub Actions documentation](https://docs.github.com/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure) to learn more about configuring your GitHub Actions workflow to get an access token from Microsoft identity provider and access Azure resources.
65-
- For information about the required format of JWTs created by external identity providers, read about the [assertion format](active-directory-certificate-credentials.md#assertion-format).
68+
- For information about the required format of JWTs created by external identity providers, read about the [assertion format](active-directory-certificate-credentials.md#assertion-format).

articles/azure-app-configuration/TOC.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,9 @@
2323
href: quickstart-azure-functions-csharp.md
2424
- name: Java Spring
2525
href: quickstart-java-spring-app.md
26-
- name: Python
26+
- name: Python provider
27+
href: quickstart-python-provider.md
28+
- name: Python SDK
2729
href: quickstart-python.md
2830
- name: JavaScript/Node.js
2931
href: quickstart-javascript.md
Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
---
2+
title: Quickstart for using Azure App Configuration with Python apps using the Python provider | Microsoft Docs
3+
description: In this quickstart, create a Python app with the Azure App Configuration Python provider to centralize storage and management of application settings separate from your code.
4+
services: azure-app-configuration
5+
author: maud-lv
6+
ms.service: azure-app-configuration
7+
ms.devlang: python
8+
ms.topic: quickstart
9+
ms.custom: devx-track-python, mode-other
10+
ms.date: 10/31/2022
11+
ms.author: malev
12+
#Customer intent: As a Python developer, I want to manage all my app settings in one place.
13+
---
14+
# Quickstart: Create a Python app with the Azure App Configuration Python provider
15+
16+
In this quickstart, you will use the Python provider for Azure App Configuration to centralize storage and management of application settings using the [Azure App Configuration Python provider client library](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/appconfiguration/azure-appconfiguration-provider).
17+
18+
The Python App Configuration provider is a library running on top of the Azure SDK for Python, helping Python developers easily consume the App Configuration service. It enables configuration settings to be used like a dictionary.
19+
20+
## Prerequisites
21+
22+
- Azure subscription - [create one for free](https://azure.microsoft.com/free/)
23+
- Python 3.6 or later - for information on setting up Python on Windows, see the [Python on Windows documentation](/windows/python/)
24+
25+
## Create an App Configuration store
26+
27+
[!INCLUDE [azure-app-configuration-create](../../includes/azure-app-configuration-create.md)]
28+
29+
9. Select **Configuration Explorer** > **Create** > **Key-value** to add the following key-value pairs:
30+
31+
| Key | Value | Label | Content type |
32+
|----------------|-------------------|-------------|--------------------|
33+
| *message* | *Hello* | Leave empty | Leave empty |
34+
| *test.message* | *Hello test* | Leave empty | Leave empty |
35+
| *my_json* | *{"key":"value"}* | Leave empty | *application/json* |
36+
37+
10. Select **Apply**.
38+
39+
## Set up the Python app
40+
41+
1. Create a new directory for the project named *app-configuration-quickstart*.
42+
43+
```console
44+
mkdir app-configuration-quickstart
45+
```
46+
47+
1. Switch to the newly created *app-configuration-quickstart* directory.
48+
49+
```console
50+
cd app-configuration-quickstart
51+
```
52+
53+
1. Install the Azure App Configuration provider by using the `pip install` command.
54+
55+
```console
56+
pip install azure-appconfiguration-provider
57+
```
58+
59+
1. Create a new file called *app-configuration-quickstart.py* in the *app-configuration-quickstart* directory and add the following code:
60+
61+
```python
62+
from azure.appconfiguration.provider import (
63+
AzureAppConfigurationProvider,
64+
SettingSelector
65+
)
66+
import os
67+
68+
connection_string = os.environ.get("AZURE_APPCONFIG_CONNECTION_STRING")
69+
70+
# Connect to Azure App Configuration using a connection string.
71+
config = AzureAppConfigurationProvider.load(
72+
connection_string=connection_string)
73+
74+
# Find the key "message" and print its value.
75+
print(config["message"])
76+
# Find the key "my_json" and print the value for "key" from the dictionary.
77+
print(config["my_json"]["key"])
78+
79+
# Connect to Azure App Configuration using a connection string and trimmed key prefixes.
80+
trimmed = {"test."}
81+
config = AzureAppConfigurationProvider.load(
82+
connection_string=connection_string, trimmed_key_prefixes=trimmed)
83+
# From the keys with trimmed prefixes, find a key with "message" and print its value.
84+
print(config["message"])
85+
86+
# Connect to Azure App Configuration using SettingSelector.
87+
selects = {SettingSelector("message*", "\0")}
88+
config = AzureAppConfigurationProvider.load(
89+
connection_string=connection_string, selects=selects)
90+
91+
# Print True or False to indicate if "message" is found in Azure App Configuration.
92+
print("message found: " + str("message" in config))
93+
print("test.message found: " + str("test.message" in config))
94+
```
95+
96+
## Configure your App Configuration connection string
97+
98+
1. Set an environment variable named **AZURE_APPCONFIG_CONNECTION_STRING**, and set it to the connection string of your App Configuration store. At the command line, run the following command:
99+
100+
### [Windows command prompt](#tab/windowscommandprompt)
101+
102+
To build and run the app locally using the Windows command prompt, run the following command and replace `<app-configuration-store-connection-string>` with the connection string of your app configuration store:
103+
104+
```cmd
105+
setx AZURE_APPCONFIG_CONNECTION_STRING "connection-string-of-your-app-configuration-store"
106+
```
107+
108+
### [PowerShell](#tab/powershell)
109+
110+
If you use Windows PowerShell, run the following command and replace `<app-configuration-store-connection-string>` with the connection string of your app configuration store:
111+
112+
```azurepowershell
113+
$Env:AZURE_APPCONFIG_CONNECTION_STRING = "<app-configuration-store-connection-string>"
114+
```
115+
116+
### [macOS](#tab/unix)
117+
118+
If you use macOS, run the following command and replace `<app-configuration-store-connection-string>` with the connection string of your app configuration store:
119+
120+
```console
121+
export AZURE_APPCONFIG_CONNECTION_STRING='<app-configuration-store-connection-string>'
122+
```
123+
124+
### [Linux](#tab/linux)
125+
126+
If you use Linux, run the following command and replace `<app-configuration-store-connection-string>` with the connection string of your app configuration store:
127+
128+
```console
129+
export AZURE_APPCONFIG_CONNECTION_STRING='<app-configuration-store-connection-string>'
130+
```
131+
132+
1. Restart the command prompt to allow the change to take effect. Print out the value of the environment variable to validate that it is set properly with the command below.
133+
134+
### [Windows command prompt](#tab/windowscommandprompt)
135+
136+
Using the Windows command prompt, run the following command:
137+
138+
```cmd
139+
printenv AZURE_APPCONFIG_CONNECTION_STRING
140+
```
141+
142+
### [PowerShell](#tab/powershell)
143+
144+
If you use Windows PowerShell, run the following command:
145+
146+
```azurepowershell
147+
$Env:AZURE_APPCONFIG_CONNECTION_STRING
148+
```
149+
150+
### [macOS](#tab/unix)
151+
152+
If you use macOS, run the following command:
153+
154+
```console
155+
echo "$AZURE_APPCONFIG_CONNECTION_STRING"
156+
```
157+
158+
### [Linux](#tab/linux)
159+
160+
If you use Linux, run the following command:
161+
162+
```console
163+
echo "$AZURE_APPCONFIG_CONNECTION_STRING"
164+
165+
1. After the build successfully completes, run the following command to run the app locally:
166+
167+
```python
168+
python app-configuration-quickstart.py
169+
```
170+
171+
You should see the following output:
172+
173+
```Output
174+
Hello
175+
value
176+
Hello test
177+
message found: True
178+
test.message found: False
179+
```
180+
181+
## Clean up resources
182+
183+
[!INCLUDE [azure-app-configuration-cleanup](../../includes/azure-app-configuration-cleanup.md)]
184+
185+
## Next steps
186+
187+
In this quickstart, you created a new App Configuration store and learned how to access key-values from a Python app.
188+
189+
For additional code samples, visit:
190+
191+
> [!div class="nextstepaction"]
192+
> [Azure App Configuration Python provider](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/appconfiguration/azure-appconfiguration-provider)

0 commit comments

Comments
 (0)