You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-signalr/howto-use-managed-identity.md
+69-47Lines changed: 69 additions & 47 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,111 +3,133 @@ title: Managed identities in Azure SignalR Service
3
3
description: Learn how managed identities work in Azure SignalR Service, and how to use a managed identity in serverless scenarios.
4
4
author: vicancy
5
5
ms.service: signalr
6
-
ms.topic: article
7
-
ms.date: 06/8/2020
6
+
ms.topic: how-to
7
+
ms.date: 12/09/2022
8
8
ms.author: lianwei
9
9
---
10
10
11
11
# Managed identities for Azure SignalR Service
12
12
13
-
This article shows you how to create a managed identity for Azure SignalR Service and how to use it in serverless scenarios.
13
+
In Azure SignalR Service, you can use a managed identity from Azure Active Directory to:
14
14
15
-
> [!Important]
16
-
> Azure SignalR Service can support only one managed identity. That means you can add either a system-assigned identity or a user-assigned identity.
15
+
- Obtain access tokens
16
+
- Access secrets in Azure Key Vault
17
17
18
-
## Add a system-assigned identity
18
+
The service supports only one managed identity; you can create either a system-assigned or user-assigned identity. A system-assigned identity is dedicated to your SignalR instance and is deleted when you delete the instance. A user-assigned identity is managed independently of your SignalR resource.
19
19
20
-
To set up a managed identity in the Azure portal, you'll first create an Azure SignalR Service instance and then enable the feature.
20
+
This article shows you how to create a managed identity for Azure SignalR Service and how to use it in serverless scenarios.
21
21
22
-
1. Create an Azure SignalR Service instance in the portal as you normally would. Browse to it in the portal.
22
+
## Prerequisites
23
23
24
-
2. Select **Identity**.
24
+
To use a managed identity, you must have the following items:
25
25
26
-
4. On the **System assigned** tab, switch **Status** to **On**. Select **Save**.
26
+
- An Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
27
+
- An Azure SignalR resource.
28
+
- Upstream resources that you want to access. For example, an Azure Key Vault resource.
29
+
- An Azure Function app.
27
30
28
-
:::image type="content" source="media/signalr-howto-use-managed-identity/system-identity-portal.png" alt-text="Add a system-assigned identity in the portal":::
29
31
30
-
## Add a user-assigned identity
32
+
## Add a managed identity to Azure SignalR Service
31
33
32
-
Creating an Azure SignalR Service instance with a user-assigned identity requires that you create the identity and then add its resource identifier to your service.
34
+
You can add a managed identity to Azure SignalR Service in the Azure portal or the Azure CLI. This article shows you how to add a managed identity to Azure SignalR Service in the Azure portal.
33
35
34
-
1. Create a user-assigned managed identity resource according to [these instructions](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#create-a-user-assigned-managed-identity).
36
+
### Add a system-assigned identity
35
37
36
-
2. Create an Azure SignalR Service instance in the portal as you normally would. Browse to it in the portal.
38
+
To add a system-managed identity to your SignalR instance:
37
39
38
-
3. Select **Identity**.
40
+
1. Browse to your SignalR instance in the Azure portal.
41
+
1. Select **Identity**.
42
+
1. On the **System assigned** tab, switch **Status** to **On**.
43
+
1. Select **Save**.
39
44
40
-
4. On the **User assigned** tab, select **Add**.
45
+
:::image type="content" source="media/signalr-howto-use-managed-identity/system-identity-portal.png" alt-text="Add a system-assigned identity in the portal":::
46
+
47
+
1. Select **Yes** to confirm the change.
41
48
42
-
5. Search for the identity that you created earlier and selects it. Select **Add**.
49
+
### Add a user-assigned identity
43
50
51
+
To add a user-assigned identity to your SignalR instance, you need to create the identity then add it to your service.
52
+
53
+
1. Create a user-assigned managed identity resource according to [these instructions](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#create-a-user-assigned-managed-identity).
54
+
1. Browse to your SignalR instance in the Azure portal.
55
+
1. Select **Identity**.
56
+
1. On the **User assigned** tab, select **Add**.
57
+
1. Select the identity from the **User assigned managed identities** drop down menu.
58
+
1. Select **Add**.
44
59
:::image type="content" source="media/signalr-howto-use-managed-identity/user-identity-portal.png" alt-text="Add a user-assigned identity in the portal":::
45
60
46
61
## Use a managed identity in serverless scenarios
47
62
48
-
Azure SignalR Service is a fully managed service, so you can't use a managed identity to get tokens manually. Instead, Azure SignalR Service uses the managed identity that you set to obtain an access token. The service then sets the access token into an`Authorization` header in an upstream request in serverless scenarios.
63
+
Azure SignalR Service is a fully managed service. It uses a managed identity to obtain an access token. In serverless scenarios, the service adds the access token into the`Authorization` header in an upstream request.
49
64
50
65
### Enable managed identity authentication in upstream settings
51
66
52
-
1. Add a system-assigned identity or user-assigned identity.
67
+
Once you've added a [system-assigned identity](#add-a-system-assigned-identity) or [user-assigned identity](#add-a-user-assigned-identity) to your SignalR instance, you can enable managed identity authentication in the upstream settings.
53
68
54
-
2. Add one Upstream Setting and click any asterisk to get into a detailed page as shown below.
69
+
1. Browse to your SignalR instance.
70
+
1. Select **Settings** from the menu.
71
+
1. Select the **Serverless** service mode.
72
+
1. Enter the upstream URL pattern in the **Add an upstream URL pattern** text box. See [URL template settings](concept-upstream.md#url-template-settings)
73
+
1. Select Add one Upstream Setting and select any asterisk to get into a detailed page as shown below.
3. In the managed identity authentication settings, for **Resource**, you can specify the target resource. The resource will become an `aud` claim in the obtained access token, which can be used as a part of validation in your upstream endpoints. The resource can be one of the following:
80
+
1. In the managed identity authentication settings, for **Resource**, you can specify the target resource. The resource will become an `aud` claim in the obtained access token, which can be used as a part of validation in your upstream endpoints. The resource can be one of the following formats:
60
81
- Empty
61
82
- Application (client) ID of the service principal
62
83
- Application ID URI of the service principal
63
-
-[Resource ID of an Azure service](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication)
84
+
- Resource ID of an Azure service (For a list of Azure services that support managed identities, see [Azure services that support managed identities](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication).)
64
85
65
86
> [!NOTE]
66
-
> If you validate an access token by yourself in your service, you can choose any one of the resource formats. Just make sure that the **Resource** value in **Auth** settings and the validation are consistent. If you use Azure role-based access control (Azure RBAC) for a data plane, you must use the resource that the service provider requests.
87
+
> If you manually validate an access token your service, you can choose any one of the resource formats. Make sure that the **Resource** value in **Auth** settings and the validation are consistent. When you use Azure role-based access control (Azure RBAC) for a data plane, you must use the resource format that the service provider requests.
67
88
68
89
### Validate access tokens
69
90
70
91
The token in the `Authorization` header is a [Microsoft identity platform access token](../active-directory/develop/access-tokens.md).
71
92
72
-
To validate access tokens, your app should also validate the audience and the signing tokens. These need to be validated against the values in the OpenID discovery document. For example, see the [tenant-independent version of the document](https://login.microsoftonline.com/common/.well-known/openid-configuration).
93
+
To validate access tokens, your app should also validate the audience and the signing tokens. These tokens need to be validated against the values in the OpenID discovery document. For example, see the [tenant-independent version of the document](https://login.microsoftonline.com/common/.well-known/openid-configuration).
73
94
74
95
The Azure Active Directory (Azure AD) middleware has built-in capabilities for validating access tokens. You can browse through our [samples](../active-directory/develop/sample-v2-code.md) to find one in the language of your choice.
75
96
76
-
We provide libraries and code samples that show how to handle token validation. There are also several open-source partner libraries available for JSON Web Token (JWT) validation. There's at least one option for almost every platform and language out there. For more information about Azure AD authentication libraries and code samples, see [Microsoft identity platform authentication libraries](../active-directory/develop/reference-v2-libraries.md).
97
+
Libraries and code samples that show how to handle token validation are available. There are also several open-source partner libraries available for JSON Web Token (JWT) validation. There's at least one option for almost every platform and language. For more information about Azure AD authentication libraries and code samples, see [Microsoft identity platform authentication libraries](../active-directory/develop/reference-v2-libraries.md).
77
98
78
99
#### Authentication in Function App
79
100
80
-
Setting access token validation in Function App is easy and efficient without code works.
81
-
82
-
1. In the **Authentication** page, click **Add identity provider**
83
-
84
-
2. Select **Log in with Azure Active Directory** in **Action to take when request is not authenticated**.
101
+
You can easily set access validation for a Function App without code changes using the Azure portal.
85
102
86
-
3. Select **Microsoft** in the identity provider dropdown. The option to create a new registration is selected by default. You can change the name of the registration. For more details on enabling Azure AD provider, please refer to [Configure your App Service or Azure Functions app to use Azure AD login](../app-service/configure-authentication-provider-aad.md)
103
+
1. Go to the Function App in the Azure portal.
104
+
1. In the **Authentication** page, select **Add identity provider**
105
+
1. Select **Log in with Azure Active Directory** in **Action to take when request is not authenticated**.
106
+
1. Select **Microsoft** in the identity provider dropdown. The option to create a new registration is selected by default. You can change the name of the registration. For more information on enabling Azure AD provider, see [Configure your App Service or Azure Functions app to use Azure AD login](../app-service/configure-authentication-provider-aad.md)
1. Navigate to SignalR Service and follow the [steps](howto-use-managed-identity.md#add-a-system-assigned-identity) to add a system-assigned identity or user-assigned identity.
109
+
1. go to **Upstream settings** in SignalR Service and choose **Use Managed Identity** and **Select from existing Applications**. Select the application you created previously.
88
110
89
-
4. Navigate to SignalR Service and follow [steps](howto-use-managed-identity.md#add-a-system-assigned-identity) to add a system-assigned identity or user-assigned identity.
111
+
After you configure these settings, the Function App will reject requests without an access token in the header.
90
112
91
-
5. Get into **Upstream settings** in SignalR Service and choose **Use Managed Identity** and **Select from existing Applications**. Select the application you created previously.
113
+
> [!IMPORTANT]
114
+
> To pass the authentication, the *Issuer Url* must match the *iss* claim in token. Currently, we only support v1 endpoint (see [v1.0 and v2.0](../active-directory/develop/access-tokens.md)).
92
115
93
-
After these settings, the Function App will reject requests without an access token in the header.
94
-
95
-
> [!Important]
96
-
> To pass the authentication, the *Issuer Url* must match the *iss* claim in token. Currently, we only support v1 endpoint (see [v1.0 and v2.0](../active-directory/develop/access-tokens.md)), so the *Issuer Url* should look like `https://sts.windows.net/<tenant-id>/`. Check the *Issuer Url* configured in Azure Function. For **Authentication**, go to *Identity provider* -> *Edit* -> *Issuer Url*
116
+
To verify the *Issuer Url* format in your Function app:
97
117
118
+
1. Go to the Function app in the portal.
119
+
1. Select **Authentication**.
120
+
1. Select **Identity provider**.
121
+
1. Select **Edit**.
122
+
1. Select **Issuer Url**.
123
+
1. Verify that the *Issuer Url* has the format `https://sts.windows.net/<tenant-id>/`.
98
124
99
125
## Use a managed identity for Key Vault reference
100
126
101
-
SignalR Service can access Key Vault to get secret using the managed identity.
102
-
103
-
1. Add a system-assigned identity or user-assigned identity for Azure SignalR Service.
104
-
105
-
2. Grant secret read permission for the managed identity in the Access policies in the Key Vault. See [Assign a Key Vault access policy using the Azure portal](../key-vault/general/assign-access-policy-portal.md)
106
-
107
-
Currently, this feature can be used in the following scenarios:
127
+
SignalR Service can access Key Vault to get secrets using the managed identity.
108
128
109
-
-[Reference secret in Upstream URL Pattern](./concept-upstream.md#key-vault-secret-reference-in-url-template-settings)
129
+
1. Add a [system-assigned identity](#add-a-system-assigned-identity) or [user-assigned identity](#add-a-user-assigned-identity) to your SignalR instance.
130
+
1. Grant secret read permission for the managed identity in the Access policies in the Key Vault. See [Assign a Key Vault access policy using the Azure portal](../key-vault/general/assign-access-policy-portal.md)
110
131
132
+
Currently, this feature can be used to [Reference secret in Upstream URL Pattern](./concept-upstream.md#key-vault-secret-reference-in-url-template-settings)
Copy file name to clipboardExpand all lines: articles/azure-signalr/signalr-howto-authorize-managed-identity.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,9 @@ ms.custom: subject-rbac-steps
11
11
---
12
12
13
13
# Authorize request to SignalR resources with Azure AD from managed identities
14
-
Azure SignalR Service supports Azure Active Directory (Azure AD) authorizing requests from [Managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).
14
+
15
+
Azure SignalR Service supports Azure Active Directory (Azure AD) authorizing requests from Azure resources using [Managed identities for Azure resources
0 commit comments