Skip to content

Commit b5de928

Browse files
ecfanecfan
committed
Add sample access token
1 parent 9dc3a2c commit b5de928

File tree

1 file changed

+93
-49
lines changed

1 file changed

+93
-49
lines changed

‎articles/logic-apps/logic-apps-securing-a-logic-app.md

Lines changed: 93 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ To control access and protect data in Azure Logic Apps, you can set up security
1616
* [Access to logic app operations](#secure-operations)
1717
* [Access to run history inputs and outputs](#secure-run-history)
1818
* [Access to parameter inputs](#secure-action-parameters)
19-
* [Access to services and systems called from logic apps](#secure-requests)
19+
* [Access to services and systems called from logic apps](#secure-outbound-requests)
2020

2121
<a name="secure-triggers"></a>
2222

@@ -27,6 +27,7 @@ If your logic app uses a request-based trigger, which receives incoming calls or
2727
Here are options that can help you secure access to this trigger type:
2828

2929
* [Generate shared access signatures](#sas)
30+
* [Enable Azure Active Directory Open Authentication (Azure AD OAuth)](#enable-oauth)
3031
* [Restrict inbound IP addresses](#restrict-inbound-ip-addresses)
3132
* [Add Azure Active Directory Open Authentication (Azure AD OAuth) or other security](#add-authentication)
3233

@@ -89,6 +90,93 @@ POST /subscriptions/<Azure-subscription-ID>/resourceGroups/<Azure-resource-group
8990

9091
In the body, include the `KeyType` property as either `Primary` or `Secondary`. This property returns a URL that's signed by the specified security key.
9192

93+
<a name="enable-oauth"></a>
94+
95+
### Enable Azure Active Directory OAuth
96+
97+
If your logic app starts with a Request trigger, you can enable [Azure Active Directory Open Authentication](../active-directory/develop/about-microsoft-identity-platform.md) (Azure AD OAuth) for authorizing inbound calls to the Request trigger. Before you enable this authentication, review these considerations:
98+
99+
* Your logic app can have up to five authorization policies. Each authorization policy can have up to 10 [claims](../active-directory/develop/developer-glossary.md#claim).
100+
101+
* An authorization policy must include at least the **Issuer** claim, which has a value that starts with `https://sts.windows.net/` as the Azure AD issuer ID.
102+
103+
* Your logic app can't use both Azure AD OAuth and [Shared Access Signatures (SAS)](#sas) authorization schemes.
104+
105+
* OAuth tokens are supported only for workflow trigger requests.
106+
107+
* Only Bearer-type authorization schemes are supported for OAuth tokens.
108+
109+
To enable Azure AD OAuth, follow these steps to add one or more authorization policies to your logic app.
110+
111+
1. In the [Azure portal](https://portal.microsoft.com), find and open your logic app in the Logic App Designer.
112+
113+
1. On the logic app menu, under **Settings**, select **Authorization**. After the Authorization pane opens, select **Add policy**.
114+
115+
![Select "Authorization" > "Add policy"](./media/logic-apps-securing-a-logic-app/add-azure-active-directory-authorization-policies.png)
116+
117+
1. Provide information about the authorization policy by specifying the [claim types](../active-directory/develop/developer-glossary.md#claim) and values that your logic app expects in the authentication tokens presented by inbound calls to the Request trigger:
118+
119+
![Provide information for authorization policy](./media/logic-apps-securing-a-logic-app/set-up-authorization-policy.png)
120+
121+
| Property | Required | Description |
122+
|----------|----------|-------------|
123+
| **Policy name** | Yes | The name that you want to use for the authorization policy |
124+
| **Claims** | Yes | The claim types and values that your logic app accepts from inbound calls. Here are the available standard claim types: <p><p>- **Issuer** <br>- **Audience** <br>- **Subject** <br>- **JWT ID** (JSON Web Token ID) <p><p>At the minimum, the **Claims** list must include the **Issuer** claim, which has a value that starts with the `https://sts.windows.net/` Azure AD issuer ID. For more information about these claim types, see [Claims in Azure AD security tokens](../active-directory/azuread-dev/v1-authentication-scenarios.md#claims-in-azure-ad-security-tokens). You can also specify your own claim type and value. |
125+
|||
126+
127+
1. To add another claim, select from these options:
128+
129+
* To add another standard claim type, select **Add standard claim**, select the claim type, and specify the claim value.
130+
131+
* To add your own claim, select **Add custom claim**, and specify the custom claim value.
132+
133+
1. To add another authorization policy, select **Add policy**. Repeat the previous steps to set up the policy.
134+
135+
1. When you're done, select **Save**.
136+
137+
You've now set up your logic app to use Azure AD OAuth for authorizing inbound requests. This example shows a sample decoded [access token](../active-directory/develop/access-tokens.md) that's used for calling a logic app that specifies an authorization policy with an **Issuer**-type claim:
138+
139+
```json
140+
{
141+
"aud": "https://management.core.windows.net/",
142+
"iss": "https://sts.windows.net/<Azure-AD-issuer-ID>/",
143+
"iat": 1582056988,
144+
"nbf": 1582056988,
145+
"exp": 1582060888,
146+
"_claim_names": {
147+
"groups": "src1"
148+
},
149+
"_claim_sources": {
150+
"src1": {
151+
"endpoint": "https://graph.windows.net/7200000-86f1-41af-91ab-2d7cd011db47/users/00000-f433-403e-b3aa-7d8406464625d7/getMemberObjects"
152+
}
153+
},
154+
"acr": "1",
155+
"aio": "AVQAq/8OAAAA7k1O1C2fRfeG604U9e6EzYcy52wb65Cx2OkaHIqDOkuyyr0IBa/YuaImaydaf/twVaeW/etbzzlKFNI4Q=",
156+
"amr": [
157+
"rsa",
158+
"mfa"
159+
],
160+
"appid": "c44b4083-3bb0-00001-b47d-97400853cbdf3c",
161+
"appidacr": "2",
162+
"deviceid": "bfk817a1-3d981-4dddf82-8ade-2bddd2f5f8172ab",
163+
"family_name": "Sophia Owen",
164+
"given_name": "Sophia Owen (Fabrikam)",
165+
"ipaddr": "167.220.2.46",
166+
"name": "sophiaowen",
167+
"oid": "3d5053d9-f433-00000e-b3aa-7d84041625d7",
168+
"onprem_sid": "S-1-5-21-2497521184-1604012920-1887927527-21913475",
169+
"puid": "1003000000098FE48CE",
170+
"scp": "user_impersonation",
171+
"sub": "KGlhIodTx3XCVIWjJarRfJbsLX9JcdYYWDPkufGVij7_7k",
172+
"tid": "72f988bf-86f1-41af-91ab-2d7cd011db47",
173+
"unique_name": "[email protected]",
174+
"upn": "[email protected]",
175+
"uti": "TPJ7nNNMMZkOSx6_uVczUAA",
176+
"ver": "1.0"
177+
}
178+
```
179+
92180
<a name="restrict-inbound-ip"></a>
93181

94182
### Restrict inbound IP addresses
@@ -563,15 +651,15 @@ This example template that has multiple secured parameter definitions that use t
563651
}
564652
```
565653

566-
<a name="secure-requests"></a>
654+
<a name="secure-outbound-requests"></a>
567655

568656
## Access to services and systems called from logic apps
569657

570658
Here are some ways that you can help secure endpoints that receive calls or requests from your logic app:
571659

572660
* Add authentication to outbound requests.
573661

574-
When you work with an HTTP-based trigger or action that makes outbound calls, such as HTTP, HTTP + Swagger, or Webhook, you can add authentication to the request that's sent by your logic app. For example, you can use these authentication types:
662+
When you work with an HTTP-based trigger or action that makes outbound calls, such as HTTP, HTTP + Swagger, or Webhook, you can add authentication to the request that's sent by your logic app. For example, you can select these authentication types:
575663

576664
* [Basic authentication](#basic-authentication)
577665

@@ -615,7 +703,7 @@ HTTP and HTTPS endpoints support various kinds of authentication. Based on the t
615703
|---------------------|--------------|
616704
| [Basic](#basic-authentication) | Azure API Management, Azure App Services, HTTP, HTTP + Swagger, HTTP Webhook |
617705
| [Client Certificate](#client-certificate-authentication) | Azure API Management, Azure App Services, HTTP, HTTP + Swagger, HTTP Webhook |
618-
| [Active Directory OAuth](#azure-active-directory-oauth-authentication) | Azure API Management, Azure App Services, Azure Functions, HTTP, HTTP + Swagger, HTTP Webhook, Request |
706+
| [Active Directory OAuth](#azure-active-directory-oauth-authentication) | Azure API Management, Azure App Services, Azure Functions, HTTP, HTTP + Swagger, HTTP Webhook |
619707
| [Raw](#raw-authentication) | Azure API Management, Azure App Services, Azure Functions, HTTP, HTTP + Swagger, HTTP Webhook |
620708
| [Managed identity](#managed-identity-authentication) | Azure API Management, Azure App Services, Azure Functions, HTTP, HTTP + Swagger, HTTP Webhook |
621709
|||
@@ -730,50 +818,6 @@ When you use [secured parameters](#secure-action-parameters) to handle and prote
730818
}
731819
```
732820

733-
<a name="enable-oauth"></a>
734-
735-
### Enable Azure AD OAuth on Request triggers
736-
737-
When your logic app starts with the Request trigger, you can use [Azure AD OAuth](../active-directory/develop/about-microsoft-identity-platform.md) for authorizing inbound calls to your logic app. Before you enable this authentication, review these considerations:
738-
739-
* Your logic app can have up to five authorization policies. Each authorization policy can have up to 10 [claims](../active-directory/develop/developer-glossary.md#claim).
740-
741-
* An authorization policy must include at least the **Issuer** claim, which has a value that starts with `https://sts.windows.net/` as the Azure AD issuer ID.
742-
743-
* Your logic app can't use both Azure AD OAuth and [Shared Access Signatures (SAS)](#sas) schemes for authorization.
744-
745-
* Currently, OAuth tokens are supported only for workflow trigger requests.
746-
747-
* Only Bearer-type authorization schemes are supported for OAuth tokens.
748-
749-
To set up this authentication, follow these steps to add one or more authorization policies to your logic app.
750-
751-
1. In the [Azure portal](https://portal.microsoft.com), find and open your logic app in the Logic App Designer.
752-
753-
1. On the logic app menu, under **Settings**, select **Authorization**. After the Authorization pane opens, select **Add policy**.
754-
755-
![Select "Authorization" > "Add policy"](./media/logic-apps-securing-a-logic-app/add-azure-active-directory-authorization-policies.png)
756-
757-
1. Provide information about the authorization policy by specifying the [claim types](../active-directory/develop/developer-glossary.md#claim) and values that your logic app expects in the authentication tokens presented by inbound calls to the Request trigger:
758-
759-
![Provide information for authorization policy](./media/logic-apps-securing-a-logic-app/set-up-authorization-policy.png)
760-
761-
| Property | Required | Description |
762-
|----------|----------|-------------|
763-
| **Policy name** | Yes | The name that you want to use for the authorization policy |
764-
| **Claims** | Yes | The claim types and values that your logic app accepts from inbound calls. Here are the available standard claim types: <p><p>- **Issuer** <br>- **Audience** <br>- **Subject** <br>- **JWT ID** (JSON Web Token ID) <p><p>At the minimum, the **Claims** list must include the **Issuer** claim, which has a value that starts with the `https://sts.windows.net/` Azure AD issuer ID. For more information about these claim types, see [Claims in Azure AD security tokens](../active-directory/azuread-dev/v1-authentication-scenarios.md#claims-in-azure-ad-security-tokens). You can also specify your own claim type and value. |
765-
|||
766-
767-
1. To add another claim, select from these options:
768-
769-
* To add another standard claim type, select **Add standard claim**, select the claim type, and specify the claim value.
770-
771-
* To add your own claim, select **Add custom claim**, and specify the custom claim value.
772-
773-
1. To add another authorization policy, select **Add policy**. Repeat the previous steps to set up the policy.
774-
775-
1. When you're done, select **Save**.
776-
777821
<a name="raw-authentication"></a>
778822

779823
### Raw authentication
@@ -833,7 +877,7 @@ If the [Managed Identity](../active-directory/managed-identities-azure-resources
833877
|---------------------|-----------------|----------|-------|-------------|
834878
| **Authentication** | `type` | Yes | **Managed Identity** <br>or <br>`ManagedServiceIdentity` | The authentication type to use |
835879
| **Managed Identity** | `identity` | Yes | * **System Assigned Managed Identity** <br>or <br>`SystemAssigned` <p><p>* <*user-assigned-identity-name*> | The managed identity to use |
836-
| **Audience** | `audience` | Yes | <*target-resource-ID*> | The resource ID for the target resource that you want to access. <p>For example, `https://storage.azure.com/` makes the access tokens for authentication valid for all storage accounts. However, you can also specify a root service URL, such as `https://fabrikamstorageaccount.blob.core.windows.net` for a specific storage account. <p>**Note**: The **Audience** property might be hidden in some triggers or actions. To make this property visible, in the trigger or action, open the **Add new parameter** list, and select **Audience**. <p><p>**Important**: Make sure that this target resource ID *exactly matches* the value that Azure AD expects, including any required trailing slashes. So, the `https://storage.azure.com/` resource ID for all Azure Blob Storage accounts requires a trailing slash. However, the resource ID for a specific storage account doesn't require a trailing slash. To find these resource IDs, see [Azure services that support Azure AD](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication). |
880+
| **Audience** | `audience` | Yes | <*target-resource-ID*> | The resource ID for the target resource that you want to access. <p>For example, `https://storage.azure.com/` makes the [access tokens](../active-directory/develop/access-tokens.md) for authentication valid for all storage accounts. However, you can also specify a root service URL, such as `https://fabrikamstorageaccount.blob.core.windows.net` for a specific storage account. <p>**Note**: The **Audience** property might be hidden in some triggers or actions. To make this property visible, in the trigger or action, open the **Add new parameter** list, and select **Audience**. <p><p>**Important**: Make sure that this target resource ID *exactly matches* the value that Azure AD expects, including any required trailing slashes. So, the `https://storage.azure.com/` resource ID for all Azure Blob Storage accounts requires a trailing slash. However, the resource ID for a specific storage account doesn't require a trailing slash. To find these resource IDs, see [Azure services that support Azure AD](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication). |
837881
|||||
838882

839883
When you use [secured parameters](#secure-action-parameters) to handle and protect sensitive information, for example, in an [Azure Resource Manager template for automating deployment](../logic-apps/logic-apps-azure-resource-manager-templates-overview.md), you can use expressions to access these parameter values at runtime. This example HTTP action definition specifies the authentication `type` as `ManagedServiceIdentity` and uses the [parameters() function](../logic-apps/workflow-definition-language-functions-reference.md#parameters) to get the parameter values:

0 commit comments

Comments
 (0)