You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/concept-azure-ad-authorization.md
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Authorize access with Azure Active Directory for Azure Web PubSub
3
-
description: This article provides information on authorizing access to Azure Web PubSub Service resources using Azure Active Directory.
2
+
title: Authorize access with Microsoft Entra ID for Azure Web PubSub
3
+
description: This article provides information on authorizing access to Azure Web PubSub Service resources using Microsoft Entra ID.
4
4
author: terencefan
5
5
6
6
ms.author: tefa
@@ -9,39 +9,39 @@ ms.service: azure-web-pubsub
9
9
ms.topic: conceptual
10
10
---
11
11
12
-
# Authorize access to Web PubSub resources using Azure Active Directory
12
+
# Authorize access to Web PubSub resources using Microsoft Entra ID
13
13
14
-
The Azure Web PubSub Service allows for the authorization of requests to Web PubSub resources by using Azure Active Directory (Azure AD).
14
+
The Azure Web PubSub Service enables the authorization of requests to Azure Web PubSub resources by utilizing Microsoft Entra ID.
15
15
16
-
By utilizing role-based access control (RBAC) within Azure AD, permissions can be granted to a security principal<sup>[<ahref="#security-principal">1</a>]</sup>. Azure AD authenticates this security principal and returns an OAuth 2.0 token, which Web PubSub resources can then use to authorize a request.
16
+
By utilizing role-based access control (RBAC) with Microsoft Entra ID, permissions can be granted to a security principal<sup>[<ahref="#security-principal">1</a>]</sup>. Microsoft Entra authorizes this security principal and returns an OAuth 2.0 token, which Web PubSub resources can then use to authorize a request.
17
17
18
-
Using Azure AD for authorization of Web PubSub requests offers improved security and ease of use compared to Access Key authorization. Microsoft recommends utilizing Azure AD authorization with Web PubSub resources when possible to ensure access with the minimum necessary privileges.
18
+
Using Microsoft Entra ID for authorization of Web PubSub requests offers improved security and ease of use compared to Access Key authorization. Microsoft recommends utilizing Microsoft Entra ID authorization with Web PubSub resources when possible to ensure access with the minimum necessary privileges.
19
19
20
20
<aid="security-principal"></a>
21
21
_[1] security principal: a user/resource group, an application, or a service principal such as system-assigned identities and user-assigned identities._
22
22
23
-
## Overview of Azure AD for Web PubSub
23
+
## Overview of Microsoft Entra ID for Web PubSub
24
24
25
-
Authentication is necessary to access a Web PubSub resource when using Azure AD. This authentication involves two steps:
25
+
Authentication is necessary to access a Web PubSub resource when using Microsoft Entra ID. This authentication involves two steps:
26
26
27
27
1. First, Azure authenticates the security principal and issues an OAuth 2.0 token.
28
28
2. Second, the token is added to the request to the Web PubSub resource. The Web PubSub service uses the token to check if the service principal has the access to the resource.
29
29
30
-
### Client-side authentication while using Azure AD
30
+
### Client-side authentication while using Microsoft Entra ID
31
31
32
32
The negotiation server/Function App shares an access key with the Web PubSub resource, enabling the Web PubSub service to authenticate client connection requests using client tokens generated by the access key.
33
33
34
-
However, access key is often disabled when using Azure AD to improve security.
34
+
However, access key is often disabled when using Microsoft Entra ID to improve security.
35
35
36
36
To address this issue, we have developed a REST API that generates a client token. This token can be used to connect to the Azure Web PubSub service.
37
37
38
-
To use this API, the negotiation server must first obtain an **Azure AD Token** from Azure to authenticate itself. The server can then call the Web PubSub Auth API with the **Azure AD Token** to retrieve a **Client Token**. The **Client Token** is then returned to the client, who can use it to connect to the Azure Web PubSub service.
38
+
To use this API, the negotiation server must first obtain an **Microsoft Entra Token** from Azure to authenticate itself. The server can then call the Web PubSub Auth API with the **Microsoft Entra Token** to retrieve a **Client Token**. The **Client Token** is then returned to the client, who can use it to connect to the Azure Web PubSub service.
39
39
40
40
We provided helper functions (for example `GenerateClientAccessUri) for supported programming languages.
41
41
42
42
## Assign Azure roles for access rights
43
43
44
-
Azure Active Directory (Azure AD) authorizes access rights to secured resources through [Azure role-based access control](../role-based-access-control/overview.md). Azure Web PubSub defines a set of Azure built-in roles that encompass common sets of permissions used to access Web PubSub resources. You can also define custom roles for access to Web PubSub resources.
44
+
Microsoft Entra ID authorizes access rights to secured resources through [Azure role-based access control](../role-based-access-control/overview.md). Azure Web PubSub defines a set of Azure built-in roles that encompass common sets of permissions used to access Web PubSub resources. You can also define custom roles for access to Web PubSub resources.
45
45
46
46
### Resource scope
47
47
@@ -65,7 +65,7 @@ You can scope access to Azure SignalR resources at the following levels, beginni
65
65
66
66
At this scope, a role assignment applies to all of the resources in all of the resource groups in all of the subscriptions in the management group.
67
67
68
-
## Azure built-in roles for Web PubSub resources.
68
+
## Azure built-in roles for Web PubSub resources
69
69
70
70
-`Web PubSub Service Owner`
71
71
@@ -81,13 +81,13 @@ You can scope access to Azure SignalR resources at the following levels, beginni
81
81
82
82
## Next steps
83
83
84
-
To learn how to create an Azure application and use Azure AD auth, see
84
+
To learn how to create an Azure application and use Microsoft Entra authorization, see
85
85
86
-
-[Authorize request to Web PubSub resources with Azure AD from Azure applications](howto-authorize-from-application.md)
86
+
-[Authorize request to Web PubSub resources with Microsoft Entra ID from applications](howto-authorize-from-application.md)
87
87
88
-
To learn how to configure a managed identity and use Azure AD auth, see
88
+
To learn how to configure a managed identity and use Microsoft Entra ID auth, see
89
89
90
-
-[Authorize request to Web PubSub resources with Azure AD from managed identities](howto-authorize-from-managed-identity.md)
90
+
-[Authorize request to Web PubSub resources with Microsoft Entra ID from managed identities](howto-authorize-from-managed-identity.md)
91
91
92
92
To learn more about roles and role assignments, see
93
93
@@ -97,6 +97,6 @@ To learn how to create custom roles, see
97
97
98
98
-[Steps to create a custom role](../role-based-access-control/custom-roles.md#steps-to-create-a-custom-role)
99
99
100
-
To learn how to use only Azure AD authentication, see
100
+
To learn how to use only Microsoft Entra authorization, see
101
101
102
102
-[Disable local authentication](./howto-disable-local-auth.md)
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/concept-service-internals.md
+10-4Lines changed: 10 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -88,27 +88,33 @@ var pubsub = new WebSocket(
88
88
A PubSub WebSocket client can:
89
89
90
90
- Join a group, for example:
91
+
91
92
```json
92
93
{
93
94
"type": "joinGroup",
94
95
"group": "<group_name>"
95
96
}
96
97
```
98
+
97
99
- Leave a group, for example:
100
+
98
101
```json
99
102
{
100
103
"type": "leaveGroup",
101
104
"group": "<group_name>"
102
105
}
103
106
```
107
+
104
108
- Publish messages to a group, for example:
109
+
105
110
```json
106
111
{
107
112
"type": "sendToGroup",
108
113
"group": "<group_name>",
109
114
"data": { "hello": "world" }
110
115
}
111
116
```
117
+
112
118
- Send custom events to the upstream server, for example:
113
119
114
120
```json
@@ -123,7 +129,7 @@ A PubSub WebSocket client can:
123
129
124
130
You may have noticed that for a [simple WebSocket client](#the-simple-websocket-client), the _server_ is a **must have** role to receive the `message` events from clients. A simple WebSocket connection always triggers a `message` event when it sends messages, and always relies on the server-side to process messages and do other operations. With the help of the `json.webpubsub.azure.v1` subprotocol, an authorized client can join a group and publish messages to a group directly. It can also route messages to different event handlers / event listeners by customizing the _event_ the message belongs.
125
131
126
-
#### Scenarios:
132
+
#### Scenarios
127
133
128
134
Such clients can be used when clients want to talk to each other. Messages are sent from `client2` to the service and the service delivers the message directly to `client1` if the clients are authorized to do so.
129
135
@@ -242,13 +248,13 @@ When doing the validation, the `{event}` parameter is resolved to `validate`. Fo
242
248
243
249
For now, we don't support [WebHook-Request-Rate](https://github.com/cloudevents/spec/blob/v1.0/http-webhook.md#414-webhook-request-rate) and [WebHook-Request-Callback](https://github.com/cloudevents/spec/blob/v1.0/http-webhook.md#413-webhook-request-callback).
244
250
245
-
#### Authentication between service and webhook
251
+
#### Authentication/Authorization between service and webhook
246
252
247
253
- Anonymous mode
248
254
- Simple authentication that `code` is provided through the configured Webhook URL.
249
-
- Use Azure Active Directory (Azure AD) authentication. For more information, see [how to use managed identity](howto-use-managed-identity.md) for details.
255
+
- Use Microsoft Entra authorization. For more information, see [how to use managed identity](howto-use-managed-identity.md) for details.
250
256
- Step1: Enable Identity for the Web PubSub service
251
-
- Step2: Select from existing Azure AD application that stands for your webhook web app
257
+
- Step2: Select from existing Microsoft Entra application that stands for your webhook web app
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/howto-authorize-from-application.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Authorize request to Web PubSub resources with Azure AD from Azure applications
3
-
description: This article provides information about authorizing request to Web PubSub resources with Azure AD from Azure applications
2
+
title: Authorize request to Web PubSub resources with Microsoft Entra ID from applications
3
+
description: This article provides information about authorizing request to Web PubSub resources with Microsoft Entra ID from applications
4
4
author: terencefan
5
5
6
6
ms.author: tefa
@@ -9,17 +9,17 @@ ms.service: azure-web-pubsub
9
9
ms.topic: conceptual
10
10
---
11
11
12
-
# Authorize request to Web PubSub resources with Azure AD from Azure applications
12
+
# Authorize request to Web PubSub resources with Microsoft Entra ID from Azure applications
13
13
14
-
Azure Web PubSub Service supports Azure Active Directory (Azure AD) authorizing requests from [Azure applications](../active-directory/develop/app-objects-and-service-principals.md).
14
+
Azure Web PubSub Service supports Microsoft Entra ID for authorizing requests from [applications](../active-directory/develop/app-objects-and-service-principals.md).
15
15
16
16
This article shows how to configure your Web PubSub resource and codes to authorize the request to a Web PubSub resource from an Azure application.
17
17
18
18
## Register an application
19
19
20
20
The first step is to register an Azure application.
21
21
22
-
1. On the [Azure portal](https://portal.azure.com/), search for and select **Azure Active Directory**
22
+
1. On the [Azure portal](https://portal.azure.com/), search for and select **Microsoft Entra ID**
23
23
2. Under **Manage** section, select **App registrations**.
24
24
3. Click **New registration**.
25
25
@@ -66,7 +66,7 @@ To learn more about adding credentials, see
66
66
67
67
This sample shows how to assign a `Web PubSub Service Owner` role to a service principal (application) over a Web PubSub resource.
68
68
69
-
> [!Note]
69
+
> [!NOTE]
70
70
> A role can be assigned to any scope, including management group, subscription, resource group or a single resource. To learn more about scope, see [Understand scope for Azure RBAC](../role-based-access-control/scope-overview.md)
71
71
72
72
1. On the [Azure portal](https://portal.azure.com/), navigate to your Web PubSub resource.
@@ -111,7 +111,7 @@ This sample shows how to assign a `Web PubSub Service Owner` role to a service p
111
111
-[Assign Azure roles using Azure CLI](../role-based-access-control/role-assignments-cli.md)
112
112
-[Assign Azure roles using Azure Resource Manager templates](../role-based-access-control/role-assignments-template.md)
113
113
114
-
## Use Postman to get the Azure AD token
114
+
## Use Postman to get the Microsoft Entra token
115
115
116
116
1. Launch Postman
117
117
@@ -121,7 +121,7 @@ This sample shows how to assign a `Web PubSub Service Owner` role to a service p
121
121
122
122
4. On the **Headers** tab, add **Content-Type** key and `application/x-www-form-urlencoded` for the value.
123
123
124
-
124
+
125
125
126
126
5. Switch to the **Body** tab, and add the following keys and values.
127
127
1. Select **x-www-form-urlencoded**.
@@ -130,13 +130,13 @@ This sample shows how to assign a `Web PubSub Service Owner` role to a service p
130
130
4. Add `client_secret` key, and paste the value of client secret you noted down earlier.
131
131
5. Add `resource` key, and type `https://webpubsub.azure.com` for the value.
132
132
133
-
133
+
134
134
135
135
6. Select **Send** to send the request to get the token. You see the token in the `access_token` field.
136
136
137
-
137
+
138
138
139
-
## Sample codes using Azure AD auth
139
+
## Sample codes using Microsoft Entra authorization
140
140
141
141
We officially support 4 programming languages:
142
142
@@ -149,6 +149,6 @@ We officially support 4 programming languages:
149
149
150
150
See the following related articles:
151
151
152
-
-[Overview of Azure AD for Web PubSub](concept-azure-ad-authorization.md)
153
-
-[Authorize request to Web PubSub resources with Azure AD from managed identities](howto-authorize-from-managed-identity.md)
152
+
-[Overview of Microsoft Entra ID for Web PubSub](concept-azure-ad-authorization.md)
153
+
-[Authorize request to Web PubSub resources with Microsoft Entra ID from managed identities](howto-authorize-from-managed-identity.md)
154
154
-[Disable local authentication](./howto-disable-local-auth.md)
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/howto-authorize-from-managed-identity.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Authorize request to Web PubSub resources with Azure AD from managed identities
3
-
description: This article provides information about authorizing request to Web PubSub resources with Azure AD from managed identities
2
+
title: Authorize request to Web PubSub resources with Microsoft Entra ID from managed identities
3
+
description: This article provides information about authorizing request to Web PubSub resources with Microsoft Entra ID from managed identities
4
4
author: terencefan
5
5
6
6
ms.author: tefa
@@ -9,9 +9,9 @@ ms.service: azure-web-pubsub
9
9
ms.topic: conceptual
10
10
---
11
11
12
-
# Authorize request to Web PubSub resources with Azure AD from managed identities
12
+
# Authorize request to Web PubSub resources with Microsoft Entra ID from managed identities
13
13
14
-
Azure Web PubSub Service supports Azure Active Directory (Azure AD) authorizing requests from [Managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).
14
+
Azure Web PubSub Service supports Microsoft Entra ID for authorizing requests from [managed identities](../active-directory/managed-identities-azure-resources/overview.md).
15
15
16
16
This article shows how to configure your Web PubSub resource and codes to authorize the request to a Web PubSub resource from a managed identity.
17
17
@@ -109,6 +109,6 @@ We officially support 4 programming languages:
109
109
110
110
See the following related articles:
111
111
112
-
-[Overview of Azure AD for Web PubSub](concept-azure-ad-authorization.md)
113
-
-[Authorize request to Web PubSub resources with Azure AD from Azure applications](howto-authorize-from-application.md)
112
+
-[Overview of Microsoft Entra ID for Web PubSub](concept-azure-ad-authorization.md)
113
+
-[Authorize request to Web PubSub resources with Microsoft Entra ID from Azure applications](howto-authorize-from-application.md)
114
114
-[Disable local authentication](./howto-disable-local-auth.md)
0 commit comments