You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/howto-custom-domain.md
+42-41Lines changed: 42 additions & 41 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,80 +24,81 @@ In addition to the default domain that the Azure Web PubSub service provides, yo
24
24
25
25
Before you can add a custom domain, add a matching custom certificate. A custom certificate is a resource of your instance of Web PubSub. It references a certificate in your key vault. For security and compliance, Web PubSub doesn't permanently store your certificate. Instead, it fetches the certificate from your key vault and keeps it in memory.
26
26
27
-
### Step 1: Grant your Web PubSub resource access to Key Vault
27
+
### Step 1: Grant your Web PubSub resource access to the key vault
28
28
29
29
Azure Web PubSub Service uses Managed Identity to access your Key Vault. In order to authorize, it needs to be granted permissions.
30
30
31
31
1. In the Azure portal, go to your Azure Web PubSub resource.
32
32
1. On the left pane, select **Identity**.
33
33
34
-
1. Select the type of identity you want to use: **System assigned** or **User assigned**. To use a user-assigned identity, first you create one.
34
+
1. Select the type of identity to use: **System assigned** or **User assigned**. To use a user-assigned identity, first you create one.
35
35
36
36
To use a system-assigned identity:
37
37
38
38
1. Select **On**.
39
39
1. Select **Yes** to confirm.
40
40
1. Select **Save**.
41
41
42
-
:::image type="content" alt-text="Screenshot of enabling system assigned managed identity." source="media\howto-custom-domain\portal-identity.png" :::
42
+
:::image type="content" alt-text="Screenshot of enabling a system-assigned managed identity." source="media\howto-custom-domain\portal-identity.png" :::
43
43
44
44
To use a user-assigned identity:
45
45
46
46
1. Select **Add user assigned managed identity**.
47
47
1. Select an existing identity.
48
48
1. Select **Add**.
49
49
50
-
:::image type="content" alt-text="Screenshot of enabling user assigned managed identity." source="media\howto-custom-domain\portal-user-assigned-identity.png" :::
50
+
:::image type="content" alt-text="Screenshot of enabling a user-assigned managed identity." source="media\howto-custom-domain\portal-user-assigned-identity.png" :::
51
51
52
52
1. Select **Save**.
53
53
54
54
Depending on how you configure your Azure Key Vault permissions model, you might need to grant permissions at different locations in the Azure portal.
If you're using Key Vault built-in access policy as Key Vault permission model:
58
+
If you use a key vault built-in access policy as a key vault permissions model:
59
59
60
-
:::image type="content" alt-text="Screenshot of built-in access policy selected as Key Vault permission model." source="media\howto-custom-domain\portal-key-vault-perm-model-access-policy.png" :::
60
+
:::image type="content" alt-text="Screenshot of a built-in access policy selected as the key vault permissions model." source="media\howto-custom-domain\portal-key-vault-perm-model-access-policy.png" :::
61
61
62
62
1. Go to your Key Vault resource.
63
-
1.In the menu pane, select **Access configuration**.
63
+
1.On the left menu, select **Access configuration**.
64
64
1. Select **Vault access policy**.
65
65
1. Select **Go to access policies**.
66
66
1. Select **Create**.
67
-
1. Select **Secret Get** permission.
68
-
1. Select **Certificate Get** permission.
67
+
1. On the **Create an access policy** pane, select the **Permissions** tab.
68
+
1. For **Secret permissions**, select **Get**.
69
+
1. For **Certificate permissions**, select **Get**.
69
70
1. Select **Next**.
70
71
71
-
:::image type="content" alt-text="Screenshot of permissions selection in Key Vault." source="media\howto-custom-domain\portal-key-vault-permissions.png" :::
72
+
:::image type="content" alt-text="Screenshot of permissions selection in a key vault." source="media\howto-custom-domain\portal-key-vault-permissions.png" :::
72
73
73
-
1. Search for the Azure Web PubSub resource name.
74
+
1. Search for the Web PubSub resource name.
74
75
1. Select **Next**.
75
76
76
-
:::image type="content" alt-text="Screenshot of principal selection in Key Vault." source="media\howto-custom-domain\portal-key-vault-principal.png" :::
77
+
:::image type="content" alt-text="Screenshot of principal selection in a key vault." source="media\howto-custom-domain\portal-key-vault-principal.png" :::
77
78
78
-
1. Select **Next**on the **Application** tab.
79
+
1. Select the **Application**tab, and then select **Next**.
If you're using Azure role-based access control as Key Vault permission model:
84
85
85
-
:::image type="content" alt-text="Screenshot of Azure RBAC selected as Key Vault permission model." source="media\howto-custom-domain\portal-key-vault-perm-model-rbac.png" :::
86
+
:::image type="content" alt-text="Screenshot of Azure RBAC selected as the key vault permission model." source="media\howto-custom-domain\portal-key-vault-perm-model-rbac.png" :::
86
87
87
88
1. Go to your Key Vault resource.
88
-
1. On the left menu, select **Go to access control (IAM)**.
89
+
1. On the left menu, select **Access control (IAM)**.
89
90
1. Select **Add** > **Add role assignment**.
90
91
91
-
:::image type="content" alt-text="Screenshot of Key Vault IAM." source="media\howto-custom-domain\portal-key-vault-iam.png" :::
92
+
:::image type="content" alt-text="Screenshot of the key vault Access control pane." source="media\howto-custom-domain\portal-key-vault-iam.png" :::
1.Select the **Role** tab, and then select **Key Vault Secrets User**. Select **Next**.
94
95
95
-
:::image type="content" alt-text="Screenshot of role tab when adding role assignment to Key Vault." source="media\howto-custom-domain\portal-key-vault-role.png" :::
96
+
:::image type="content" alt-text="Screenshot of the Role tab when adding a role assignment to a key vault." source="media\howto-custom-domain\portal-key-vault-role.png" :::
96
97
97
-
1.Under the **Members** tab, select **Managed identity**.
98
-
1. Search for and **Select**the Azure Web PubSub Service resource name or the user assigned identity name.
98
+
1.Select the **Members** tab, and then select **Managed identity**.
99
+
1. Search for and then select the Web PubSub resource name or the name of the user-assigned identity.
99
100
100
-
:::image type="content" alt-text="Screenshot of members tab when adding role assignment to Key Vault." source="media\howto-custom-domain\portal-key-vault-members.png" :::
101
+
:::image type="content" alt-text="Screenshot of the Members tab when adding a role assignment to a key vault." source="media\howto-custom-domain\portal-key-vault-members.png" :::
101
102
102
103
1. Select **Next**.
103
104
1. Select **Review + assign**.
@@ -106,51 +107,51 @@ If you're using Azure role-based access control as Key Vault permission model:
106
107
107
108
### Step 2: Create a custom certificate
108
109
109
-
1. In the Azure portal, go to your Azure Web PubSub Service resource.
110
-
1.In the menu pane, select **Custom domain**.
111
-
1.In the **Custom certificate**section, select **Add**.
110
+
1. In the Azure portal, go to your Web PubSub resource.
111
+
1.On the left menu, select **Custom domain**.
112
+
1.On the **Custom certificate**pane, select **Add**.
112
113
113
114
:::image type="content" alt-text="Screenshot of custom certificate management." source="media\howto-custom-domain\portal-custom-certificate-management.png" :::
114
115
115
-
1.Fill in a name for the custom certificate.
116
-
1. Select **Select from your Key Vault** to choose a Key Vault certificate. After selection the following **Key Vault Base URI**, the**Key Vault Secret Name**will be automatically filled in. Alternatively you can also fill in these fields manually.
117
-
1.Optionally, you can specify a **Key Vault Secret Version** if you want to pin the certificate to a specific version.
116
+
1.Enter a name for the custom certificate.
117
+
1. Select **Select from your Key Vault** to choose a key vault certificate. After you select a key vault, values for **Key Vault Base URI** and**Key Vault Secret Name**are automatically added. You also have to option to edit these fields manually.
118
+
1.(Optional) To pin the certificate to a specific version, enter a value for **Key Vault Secret Version**.
118
119
1. Select **Add**.
119
120
120
121
:::image type="content" alt-text="Screenshot of adding a custom certificate." source="media\howto-custom-domain\portal-custom-certificate-add.png" :::
121
122
122
-
Azure Web PubSub Service fetches the certificate and validates its contents. When it succeeds, the certificate's **Provisioning State** is **Succeeded**.
123
+
Web PubSub fetches the certificate and validates its contents. When certificate validation succeeds, **Provisioning State** for the certificate is **Succeeded**.
123
124
124
-
:::image type="content" alt-text="Screenshot of an added custom certificate." source="media\howto-custom-domain\portal-custom-certificate-added.png" :::
125
+
:::image type="content" alt-text="Screenshot of an added custom certificate." source="media\howto-custom-domain\portal-custom-certificate-added.png" :::
125
126
126
127
## Create a custom domain CNAME
127
128
128
-
To validate the ownership of your custom domain, you need to create a CNAME record for the custom domain and point it to the default domain of Azure Web PubSub Service.
129
+
To validate the ownership of your custom domain, you need to create a CNAME record for the custom domain and point it to the default domain of your Web PubSub resource.
129
130
130
-
For example, if your default domain is `contoso.webpubsub.azure.com`, and your custom domain is `contoso.example.com`, you need to create a CNAME record on `example.com` like:
131
+
For example, if your default domain is `contoso.webpubsub.azure.com` and your custom domain is `contoso.example.com`, create a CNAME record on `example.com` like in this example:
131
132
132
133
```plaintext
133
134
contoso.example.com. 0 IN CNAME contoso.webpubsub.azure.com.
134
135
```
135
136
136
-
If you're using Azure DNS Zone, see [manage DNS records](../dns/dns-operations-recordsets-portal.md) to learn how to add a CNAME record.
137
+
If you're using Azure DNS Zone, see [Manage DNS records](../dns/dns-operations-recordsets-portal.md) to learn how to add a CNAME record.
137
138
138
-
:::image type="content" alt-text="Screenshot of adding a CNAME record in Azure DNS Zone." source="media\howto-custom-domain\portal-dns-cname.png" :::
139
+
:::image type="content" alt-text="Screenshot of adding a CNAME record in Azure DNS Zone." source="media\howto-custom-domain\portal-dns-cname.png" :::
139
140
140
-
If you're using other DNS providers, follow provider's guide to create a CNAME record.
141
+
If you use other DNS providers, use the provider's documentation to create a CNAME record.
141
142
142
143
## Add a custom domain
143
144
144
-
A custom domain is another sub resource of your Azure Web PubSub Service. It contains all configurations for a custom domain.
145
+
A custom domain is another sub resource of your Web PubSub instance. It contains all configurations that are required for a custom domain.
145
146
146
-
1. In the Azure portal, go to your Azure Web PubSub Service resource.
147
-
1.In the menu pane, select **Custom domain**.
148
-
1.Under **Custom domain**, select **Add**.
147
+
1. In the Azure portal, go to your Web PubSub resource.
148
+
1.On the left menu, select **Custom domain**.
149
+
1.On the **Custom domain** pane, select **Add**.
149
150
150
151
:::image type="content" alt-text="Screenshot of custom domain management." source="media\howto-custom-domain\portal-custom-domain-management.png" :::
151
152
152
-
1. Enter a name for the custom domain. It's the sub resource name.
153
-
1. Enter the domain name. It's the full domain name of your custom domain, for example, `contoso.com`.
153
+
1. Enter a name for the custom domain. Use the sub resource name.
154
+
1. Enter the domain name. Use the full domain name of your custom domain, for example, `contoso.com`.
154
155
1. Select a custom certificate that applies to this custom domain.
155
156
1. Select **Add**.
156
157
@@ -160,7 +161,7 @@ A custom domain is another sub resource of your Azure Web PubSub Service. It con
160
161
161
162
You can now access your Web PubSub endpoint by using the custom domain.
162
163
163
-
To verify the domain, you can access the health API. Here's an example that uses cURL:
164
+
To verify the domain, you can access the health API. The following examples use cURL.
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/howto-disable-local-auth.md
+20-22Lines changed: 20 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Disable local (access key) authentication with Azure Web PubSub Service
3
-
description: This article provides information about how to disable access key authentication and use only Microsoft Entra authorization with Azure Web PubSub Service.
2
+
title: Disable local (access key) authentication with Azure Web PubSub
3
+
description: Learn how to disable access key authentication and use only Microsoft Entra authorization with Azure Web PubSub.
# Disable local (access key) authentication with Azure Web PubSub Service
13
+
# Disable local (access key) authentication with Azure Web PubSub
14
14
15
-
There are two ways to authenticate to Azure Web PubSub Service resources: Microsoft Entra ID and Access Key. Microsoft Entra ID provides superior security and ease of use over access key. With Microsoft Entra ID, there’s no need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Azure Web PubSub Service resources when possible.
15
+
Azure Web PubSub resources can authenticate requests in two ways: via a Microsoft Entra ID or via an access key. Microsoft Entra ID provides superior security and ease of use over an access key. If you use Microsoft Entra ID, you don't need to store the tokens in your code and risk potential security vulnerabilities. We recommend that you use Microsoft Entra ID with your Web PubSub resources when possible.
16
16
17
17
> [!IMPORTANT]
18
-
> Disabling local authentication can have following influences.
18
+
> Disabling local authentication might have the following results:
19
19
>
20
-
> - The current set of access keys will be permanently deleted.
21
-
> - Tokens signed with current set of access keys will become unavailable.
22
-
> -Signature will **NOT** be attached in the upstream request header. Please visit _[how to validate access token](./howto-use-managed-identity.md#validate-access-tokens)_ to learn how to validate requests via Microsoft Entra token.
20
+
> - The current set of access keys is permanently deleted.
21
+
> - Tokens that are signed by using the current set of access keys become unavailable.
22
+
> -A signature will *not* be attached in the upstream request header. Learn how to [validate an access token](./howto-use-managed-identity.md#validate-access-tokens).
23
23
24
-
## Use Azure portal
24
+
## Use the Azure portal
25
25
26
-
In this section, you will learn how to use the Azure portal to disable local authentication.
26
+
To disable local authentication by using the Azure portal:
27
27
28
-
1.Navigate to your Web PubSub Service resource in the [Azure portal](https://portal.azure.com).
28
+
1.In the [Azure portal](https://portal.azure.com), go to your Web PubSub resource.
29
29
30
-
2.in the **Settings** section of the menu sidebar, select **Keys** tab.
30
+
2.On the left menu under **Settings**, select **Keys**.
31
31
32
-
3.Select **Disabled** for local authentication.
32
+
3.For local authentication, select **Disabled**.
33
33
34
-
4.Click**Save** button.
34
+
4.Select**Save**.
35
35
36
-
36
+
37
37
38
-
## Use Azure Resource Manager template
38
+
## Use a Azure Resource Manager template
39
39
40
-
You can disable local authentication by setting `disableLocalAuth` property to true as shown in the following Azure Resource Manager template.
40
+
You can disable local authentication by setting `disableLocalAuth` property to `true` as shown in the following Azure Resource Manager template:
41
41
42
42
```json
43
43
{
@@ -89,13 +89,11 @@ You can disable local authentication by setting `disableLocalAuth` property to t
89
89
90
90
## Use Azure Policy
91
91
92
-
You can assign the [Azure Web PubSub Service should have local authentication methods disabled](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb66ab71c-582d-4330-adfd-ac162e78691e) Azure policy to an Azure subscription or a resource group to enforce disabling of local authentication for all Web PubSub resources in the subscription or the resource group.
92
+
You can assign the policy [Azure Web PubSub Service should have local authentication methods disabled](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb66ab71c-582d-4330-adfd-ac162e78691e)in Azure Policy to an Azure subscription or to a resource group to enforce disabling local authentication for all Web PubSub resources in the subscription or resource group.
93
93
94
-
94
+
95
95
96
-
## Next steps
97
-
98
-
See the following docs to learn about authentication methods.
96
+
## Related content
99
97
100
98
-[Overview of Microsoft Entra ID for Web PubSub](concept-azure-ad-authorization.md)
101
99
-[Authenticate with Azure applications](./howto-authorize-from-application.md)
0 commit comments