You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the [Fluid Framework](https://fluidframework.com/), TokenProviders are responsible for creating and signing tokens that the `@fluidframework/azure-client` uses to make requests to the Azure Fluid Relay service. The Fluid Framework provides a simple, insecure TokenProvider for development purposes, aptly named **InsecureTokenProvider**. Each Fluid service must implement a custom TokenProvider based on the particulars service's authentication and security considerations.
19
19
20
-
Each Azure Fluid Relay service tenant you create is assigned a **tenant ID** and its own unique **tenant secret key**.
21
-
The secret key is a **shared secret**. Your app/service knows it, and the Azure Fluid Relay service knows it.
22
-
TokenProviders must know the secret key to sign requests, but the secret key cannot be included in client code.
20
+
Each Azure Fluid Relay service tenant you create is assigned a **tenant ID** and its own unique **tenant secret key**. The secret key is a **shared secret**. Your app/service knows it, and the Azure Fluid Relay service knows it. TokenProviders must know the secret key to sign requests, but the secret key cannot be included in client code.
23
21
24
22
## Implementing an Azure Function to sign tokens
25
23
26
-
One option for building a secure token provider is to create HTTPS endpoint and create a TokenProvider implementation
27
-
that makes authenticated HTTPS requests to that endpoint to retrieve tokens. This enables you to store the *tenant secret key* in a
28
-
secure location, such as [Azure Key Vault](../../key-vault/general/overview.md).
24
+
One option for building a secure token provider is to create HTTPS endpoint and create a TokenProvider implementation that makes authenticated HTTPS requests to that endpoint to retrieve tokens. This enables you to store the *tenant secret key* in a secure location, such as [Azure Key Vault](../../key-vault/general/overview.md).
The `generateToken` function, found in the `@fluidframework/azure-service-utils` package, generates a token for the given user that is signed using the tenant's secret key. This
102
-
enables the token to be returned to the client without exposing the secret. Instead, the token is generated server-side
103
-
using the secret to provide scoped access to the given document. The example ITokenProvider below makes HTTP requests to
104
-
this Azure Function to retrieve tokens.
97
+
The `generateToken` function, found in the `@fluidframework/azure-service-utils` package, generates a token for the given user that is signed using the tenant's secret key. This enables the token to be returned to the client without exposing the secret. Instead, the token is generated server-side using the secret to provide scoped access to the given document. The example ITokenProvider below makes HTTP requests to this Azure Function to retrieve tokens.
105
98
106
99
### Deploy the Azure Function
107
100
108
101
Azure Functions can be deployed in several ways. See the **Deploy** section of the [Azure Functions documentation](../../azure-functions/functions-continuous-deployment.md) for more information about deploying Azure Functions.
109
102
110
103
### Implement the TokenProvider
111
104
112
-
TokenProviders can be implemented in many ways, but must implement two separate API calls: `fetchOrdererToken` and
113
-
`fetchStorageToken`. These APIs are responsible for fetching tokens for the Fluid orderer and storage services respectively. Both functions return `TokenResponse`
114
-
objects representing the token value. The Fluid Framework runtime calls these two APIs as needed to retrieve tokens.
105
+
TokenProviders can be implemented in many ways, but must implement two separate API calls: `fetchOrdererToken` and `fetchStorageToken`. These APIs are responsible for fetching tokens for the Fluid orderer and storage services respectively. Both functions return `TokenResponse` objects representing the token value. The Fluid Framework runtime calls these two APIs as needed to retrieve tokens.
115
106
116
107
117
-
To ensure that the tenant secret key is kept secure, it is stored in a secure backend location and is only accessible
118
-
from within the Azure Function. To retrieve tokens, you need to make a `GET` or `POST` request to your deployed Azure Function, providing the `tenantID` and
119
-
`documentId`, and `userID`/`userName`. The Azure Function is responsible for the mapping between the tenant ID and a
120
-
tenant key secret to appropriately generate and sign the token.
108
+
To ensure that the tenant secret key is kept secure, it is stored in a secure backend location and is only accessible from within the Azure Function. To retrieve tokens, you need to make a `GET` or `POST` request to your deployed Azure Function, providing the `tenantID` and `documentId`, and `userID`/`userName`. The Azure Function is responsible for the mapping between the tenant ID and a tenant key secret to appropriately generate and sign the token.
121
109
122
-
This example implementation below uses the [`axios`](https://www.npmjs.com/package/axios) library to make HTTP requests. You can use
123
-
other libraries or approaches to making an HTTP request from server code.
110
+
This example implementation below uses the [axios](https://www.npmjs.com/package/axios) library to make HTTP requests. You can use other libraries or approaches to making an HTTP request from server code.
0 commit comments