You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/howto-authorize-from-application.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.topic: conceptual
12
12
13
13
Azure Web PubSub supports Microsoft Entra ID for authorizing requests from [applications](../active-directory/develop/app-objects-and-service-principals.md).
14
14
15
-
This article shows you how to configure your Web PubSub resource and codes to authorize the request to a Web PubSub resource from an Azure application.
15
+
This article shows you how to configure your Web PubSub resource and code to authorize the request to a Web PubSub resource from an Azure application.
16
16
17
17
## Register an application
18
18
@@ -24,10 +24,10 @@ The first step is to register an Azure application.
24
24
25
25
26
26
27
-
1.Enter a display **Name** for your application.
27
+
1.For **Name**, enter a name to use for your application.
28
28
1. Select **Register** to confirm the register.
29
29
30
-
When your application is registered, go to the application **Overview** pane to view the values for **Application (client) ID** and **Directory (tenant) ID**. You use these values in the following sections.
30
+
When your application is registered, go to the application overview to view the values for **Application (client) ID** and **Directory (tenant) ID**. You use these values in the following sections.
31
31
32
32
33
33
@@ -59,7 +59,7 @@ You can also upload a certificate instead of creating a client secret.
59
59
60
60
61
61
62
-
For information about adding credentials, see [Add credentials](../active-directory/develop/quickstart-register-app.md#add-credentials).
62
+
For more information about adding credentials, see [Add credentials](../active-directory/develop/quickstart-register-app.md#add-credentials).
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/howto-authorize-from-managed-identity.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,31 +1,31 @@
1
1
---
2
-
title: Authorize a managed identity request to Web PubSub resources
3
-
description: Learn how to authorize a managed identity request to Web PubSub resources by using Microsoft Entra ID.
2
+
title: Authorize a managed identity request
3
+
description: Learn how to authorize a managed identity request to your Web PubSub resources by using Microsoft Entra ID.
4
4
author: terencefan
5
5
ms.author: tefa
6
6
ms.date: 08/16/2024
7
7
ms.service: azure-web-pubsub
8
8
ms.topic: conceptual
9
9
---
10
10
11
-
# Authorize a managed identity request to Web PubSub resources by using Microsoft Entra ID
11
+
# Authorize a managed identity request by using Microsoft Entra ID
12
12
13
13
Azure Web PubSub Service supports Microsoft Entra ID for authorizing requests from [managed identities](../active-directory/managed-identities-azure-resources/overview.md).
14
14
15
-
This article shows you how to configure your Web PubSub resource and codes to authorize the request to a Web PubSub resource from a managed identity.
15
+
This article shows you how to configure your Web PubSub resource and code to authorize the request to a Web PubSub resource from a managed identity.
16
16
17
17
## Configure managed identities
18
18
19
19
The first step is to configure managed identities.
20
20
21
-
In this section, you set a system-assigned managed identity on a virtual machine by using the Azure portal.
21
+
In this section, you set up a system-assigned managed identity on a virtual machine by using the Azure portal.
22
22
23
23
1. In the [Azure portal](https://portal.azure.com/), search for and then select a virtual machine (VM).
24
24
1. Under **Settings**, select **Identity**.
25
25
1. On the **System assigned** tab, set **Status** to **On**.
26
26
27
27
28
-
1. Select the **Save** button to confirm the change.
28
+
1. Select **Save** to confirm the change.
29
29
30
30
### Create a user-assigned managed identity
31
31
@@ -37,7 +37,7 @@ Learn how to [create a user-assigned managed identity](../active-directory/manag
37
37
-[Configure managed identities for Azure resources on an Azure VM by using Azure PowerShell](../active-directory/managed-identities-azure-resources/qs-configure-powershell-windows-vm.md)
38
38
-[Configure managed identities for Azure resources on an Azure VM by using the Azure CLI](../active-directory/managed-identities-azure-resources/qs-configure-cli-windows-vm.md)
39
39
-[Configure managed identities for Azure resources on an Azure VM by using a template](../active-directory/managed-identities-azure-resources/qs-configure-template-windows-vm.md)
40
-
-[Configure a VM with managed identities for Azure resources by using an Azure SDK](../active-directory/managed-identities-azure-resources/qs-configure-sdk-windows-vm.md)
40
+
-[Configure managed identities for Azure resources on a VM by using the Azure SDK](../active-directory/managed-identities-azure-resources/qs-configure-sdk-windows-vm.md)
41
41
42
42
### Configure managed identities for Azure App Service and Azure Functions
43
43
@@ -52,7 +52,7 @@ This section demonstrates how to assign the Web PubSub Service Owner role to a s
52
52
53
53
1. In the [Azure portal](https://portal.azure.com/), go to your Web PubSub resource.
54
54
55
-
1. On the left menu, select **Access control (IAM)** to display access control settings for your Web PubSub service.
55
+
1. On the left menu, select **Access control (IAM)** to display access control settings for your Web PubSub instance.
56
56
57
57
1. Select the **Role assignments** tab and view the role assignments at this scope.
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/howto-client-certificate.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,25 +1,25 @@
1
1
---
2
-
title: Enable client certificate authentication for Azure Web PubSub (Preview)
3
-
titleSuffix: Azure Web PubSub Service
4
-
description: Learn how to enable client certificate authentication for Azure Web PubSub (Preview)
2
+
title: Turn on client certificate authentication (preview)
3
+
titleSuffix: Azure Web PubSub
4
+
description: Learn how to turn on client certificate authentication for Azure Web PubSub (preview).
5
5
author: ArchangelSDY
6
6
ms.service: azure-web-pubsub
7
7
ms.topic: how-to
8
8
ms.date: 06/20/2023
9
9
ms.author: dayshen
10
10
---
11
11
12
-
# Enable client certificate authentication for Azure Web PubSub (Preview)
12
+
# Turn on client certificate authentication (preview)
13
13
14
-
You can restrict access to your instance of Azure Web PubSub by enabling different types of authentication for it. One authentication method is to request a client certificate and validate the certificate in event handlers. This mechanism is called *client certificate authentication* or *Transport Layer Security (TLS) mutual authentication*. This article shows you how to set up your Web PubSub instance to use client certificate authentication.
14
+
You can restrict access to your instance of Azure Web PubSub by turning on different types of authentication for the resource. One authentication method is to request a client certificate and validate the certificate in event handlers. This mechanism is called *client certificate authentication* or *Transport Layer Security (TLS) mutual authentication*. This article shows you how to set up your Web PubSub instance to use client certificate authentication.
15
15
16
16
> [!NOTE]
17
17
> Enabling client certificate authentication in a browser scenario generally is not recommended. Different browsers have different behaviors when they process a client certificate request, and you have little control in a JavaScript application. If you want to enable client certificate authentication, we recommend that you use it in scenarios in which you have strong control over TLS settings. An example is in a native application.
18
18
19
19
## Prerequisites
20
20
21
21
* An Azure account with an active subscription. If you don't have an Azure account, you can [create an account for free](https://azure.microsoft.com/free/).
22
-
* An Azure Web PubSub instance (must be minimum Standard tier).
22
+
* An Azure Web PubSub instance at a minimum Standard tier.
23
23
* A function created in Azure Functions to handle connect events.
24
24
* A client certificate. You need to know its SHA-1 thumbprint.
Copy file name to clipboardExpand all lines: articles/azure-web-pubsub/howto-custom-domain.md
+46-39Lines changed: 46 additions & 39 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,56 +1,65 @@
1
1
---
2
-
title: Configure a custom domain for Azure Web PubSub
3
-
titleSuffix: Azure Web PubSub Service
4
-
description: Learn how to configure a custom domain for Azure Web PubSub.
2
+
title: Add a custom domain
3
+
titleSuffix: Azure Web PubSub
4
+
description: Learn how to create and configure a custom domain for Azure Web PubSub.
5
5
author: ArchangelSDY
6
6
ms.service: azure-web-pubsub
7
7
ms.topic: how-to
8
-
ms.date: 03/30/2023
8
+
ms.date: 08/16/2024
9
9
ms.author: dayshen
10
10
---
11
11
12
-
# Configure a custom domain for Azure Web PubSub
12
+
# Add a custom domain
13
13
14
-
In addition to the default domain that the Azure Web PubSub service provides, you can add a custom domain. A custom domain is a domain name that you own and manage. You can use a custom domain to access your Web PubSub resource. For example, you can use `contoso.example.com` instead of `contoso.webpubsub.azure.com` to access your Azure Web PubSub resource.
14
+
In addition to the default domain that is included in an instance of Azure Web PubSub, you can add a custom domain. A custom domain is a domain name that you own and manage. You can use a custom domain to access your Web PubSub resources. For example, you can use `contoso.example.com` instead of `contoso.webpubsub.azure.com` to access your resources.
15
15
16
16
## Prerequisites
17
17
18
18
* An Azure account with an active subscription. If you don't have an Azure account, you can [create an account for free](https://azure.microsoft.com/free/).
19
-
* An Azure Web PubSub service (must be minimum Premium tier).
19
+
* An Azure Web PubSub resource at a minimum Premium tier.
20
20
* An Azure Key Vault resource.
21
21
* A custom certificate matching custom domain that is stored in Azure Key Vault.
22
22
23
23
## Add a custom certificate
24
24
25
25
Before you can add a custom domain, add a matching custom certificate. A custom certificate is a resource of your instance of Web PubSub. It references a certificate in your key vault. For security and compliance, Web PubSub doesn't permanently store your certificate. Instead, it fetches the certificate from your key vault and keeps it in memory.
26
26
27
-
### Grant your Web PubSub resource access to the key vault
27
+
##Give access to a managed identity
28
28
29
-
Azure Web PubSub Service uses Managed Identity to access your Key Vault. In order to authorize, it needs to be granted permissions.
29
+
Azure Web PubSub uses a managed identity to access your key vault. To authorize access, it must be granted permissions.
30
30
31
-
1. In the Azure portal, go to your Azure Web PubSub resource.
32
-
1. On the left pane, select **Identity**.
31
+
### Create a managed identity
33
32
34
-
1. Select the type of identity to use: **System assigned** or **User assigned**. To use a user-assigned identity, first you create one.
33
+
1. In the Azure portal, go to your Web PubSub resource.
34
+
35
+
1. On the left menu, select **Identity**.
36
+
37
+
1. Select the type of identity to use: **System assigned** or **User assigned**. To use a user-assigned identity, you create one first.
35
38
36
-
To use a system-assigned identity:
39
+
To use a system-assigned identity:
37
40
38
41
1. Select **On**.
42
+
39
43
1. Select **Yes** to confirm.
44
+
40
45
1. Select **Save**.
41
46
42
-
:::image type="content" alt-text="Screenshot of enabling a system-assigned managed identity." source="media\howto-custom-domain\portal-identity.png" :::
47
+
:::image type="content" alt-text="Screenshot that shows adding a system-assigned managed identity." source="media\howto-custom-domain\portal-identity.png" :::
43
48
44
-
To use a user-assigned identity:
49
+
To add a user-assigned identity:
45
50
46
51
1. Select **Add user assigned managed identity**.
52
+
47
53
1. Select an existing identity.
54
+
48
55
1. Select **Add**.
49
56
50
-
:::image type="content" alt-text="Screenshot of enabling a user-assigned managed identity." source="media\howto-custom-domain\portal-user-assigned-identity.png" :::
57
+
:::image type="content" alt-text="Screenshot that shows adding a user-assigned managed identity." source="media\howto-custom-domain\portal-user-assigned-identity.png" :::
51
58
52
59
1. Select **Save**.
53
60
61
+
### Grant permissions to the key vault
62
+
54
63
Depending on how you configure your Azure Key Vault permissions model, you might need to grant permissions at different locations in the Azure portal.
@@ -59,7 +68,7 @@ If you use a key vault built-in access policy as a key vault permissions model:
59
68
60
69
:::image type="content" alt-text="Screenshot of a built-in access policy selected as the key vault permissions model." source="media\howto-custom-domain\portal-key-vault-perm-model-access-policy.png" :::
61
70
62
-
1. Go to your Key Vault resource.
71
+
1. Go to your key vault resource.
63
72
1. On the left menu, select **Access configuration**.
64
73
1. Select **Vault access policy**.
65
74
1. Select **Go to access policies**.
@@ -81,11 +90,11 @@ If you use a key vault built-in access policy as a key vault permissions model:
If you're using Azure role-based access control as Key Vault permission model:
93
+
If you use Azure role-based access control (Azure RBAC) as a key vault permissions model:
85
94
86
-
:::image type="content" alt-text="Screenshot of Azure RBAC selected as the key vault permission model." source="media\howto-custom-domain\portal-key-vault-perm-model-rbac.png" :::
95
+
:::image type="content" alt-text="Screenshot of Azure RBAC selected as the key vault permissions model." source="media\howto-custom-domain\portal-key-vault-perm-model-rbac.png" :::
87
96
88
-
1. Go to your Key Vault resource.
97
+
1. Go to your key vault resource.
89
98
1. On the left menu, select **Access control (IAM)**.
90
99
1. Select **Add** > **Add role assignment**.
91
100
@@ -122,50 +131,48 @@ If you're using Azure role-based access control as Key Vault permission model:
122
131
123
132
Web PubSub fetches the certificate and validates its contents. When certificate validation succeeds, **Provisioning State** for the certificate is **Succeeded**.
124
133
125
-
:::image type="content" alt-text="Screenshot of an added custom certificate." source="media\howto-custom-domain\portal-custom-certificate-added.png" :::
134
+
:::image type="content" alt-text="Screenshot that shows an added custom certificate." source="media\howto-custom-domain\portal-custom-certificate-added.png" :::
126
135
127
136
## Create a custom domain CNAME
128
137
129
-
To validate the ownership of your custom domain, you need to create a CNAME record for the custom domain and point it to the default domain of your Web PubSub resource.
138
+
To validate the ownership of your custom domain, create a CNAME record for the custom domain and point it to the default domain of your Web PubSub resource.
130
139
131
140
For example, if your default domain is `contoso.webpubsub.azure.com` and your custom domain is `contoso.example.com`, create a CNAME record on `example.com` like in this example:
132
141
133
-
```plaintext
134
-
contoso.example.com. 0 IN CNAME contoso.webpubsub.azure.com.
135
-
```
142
+
`contoso.example.com. 0 IN CNAME contoso.webpubsub.azure.com`
136
143
137
-
If you're using Azure DNS Zone, see [Manage DNS records](../dns/dns-operations-recordsets-portal.md) to learn how to add a CNAME record.
144
+
If you use Azure DNS Zone, to learn how to add a CNAME record, see [Manage DNS records](../dns/dns-operations-recordsets-portal.md).
138
145
139
-
:::image type="content" alt-text="Screenshot of adding a CNAME record in Azure DNS Zone." source="media\howto-custom-domain\portal-dns-cname.png" :::
146
+
:::image type="content" alt-text="Screenshot that shows adding a CNAME record in Azure DNS Zone." source="media\howto-custom-domain\portal-dns-cname.png" :::
140
147
141
-
If you use other DNS providers, use the provider's documentation to create a CNAME record.
148
+
If you use other DNS providers, follow guidance in the provider's documentation to create a CNAME record.
142
149
143
-
## Add a custom domain
150
+
## Add a custom domain to Web PubSub
144
151
145
152
A custom domain is another sub resource of your Web PubSub instance. It contains all configurations that are required for a custom domain.
146
153
147
154
1. In the Azure portal, go to your Web PubSub resource.
148
155
1. On the left menu, select **Custom domain**.
149
156
1. On the **Custom domain** pane, select **Add**.
150
157
151
-
:::image type="content" alt-text="Screenshot of custom domain management." source="media\howto-custom-domain\portal-custom-domain-management.png" :::
158
+
:::image type="content" alt-text="Screenshot that shows custom domain management." source="media\howto-custom-domain\portal-custom-domain-management.png" :::
152
159
153
160
1. Enter a name for the custom domain. Use the sub resource name.
154
161
1. Enter the domain name. Use the full domain name of your custom domain, for example, `contoso.com`.
155
162
1. Select a custom certificate that applies to this custom domain.
156
163
1. Select **Add**.
157
164
158
-
:::image type="content" alt-text="Screenshot of adding a custom domain." source="media\howto-custom-domain\portal-custom-domain-add.png" :::
165
+
:::image type="content" alt-text="Screenshot that shows adding a custom domain." source="media\howto-custom-domain\portal-custom-domain-add.png" :::
159
166
160
167
## Verify a custom domain
161
168
162
169
You can now access your Web PubSub endpoint by using the custom domain.
163
170
164
-
To verify the domain, you can access the health API. The following examples use cURL.
171
+
To verify the domain, you can access the Health API. The following examples use cURL.
The health API should return a `200` status code without any certificate errors.
202
+
The Health API should return a `200` status code without any certificate errors.
196
203
197
204
## Private network key vault
198
205
199
-
If you configure a [private endpoint](../private-link/private-endpoint-overview.md) to your key vault, Web PubSub can't access the key vault by using a public network. You must set up a [shared private endpoint](./howto-secure-shared-private-endpoints-key-vault.md) to let Web PubSub access your key vault via a private network.
206
+
If you configure a [private endpoint](../private-link/private-endpoint-overview.md) to your key vault, Web PubSub can't access the key vault by using a public network. You must set up a [shared private endpoint](./howto-secure-shared-private-endpoints-key-vault.md) to give Web PubSub access to your key vault via a private network.
200
207
201
-
After you create a shared private endpoint, you can create a custom certificate as usual. *You don't have to change the domain in the key vault URI.* For example, if your key vault base URI is `https://contoso.vault.azure.net`, you still use this URI to configure a custom certificate.
208
+
After you create a shared private endpoint, you can create a custom certificate as usual. You *don't have to change the domain in the key vault URI*. For example, if your key vault base URI is `https://contoso.vault.azure.net`, continue to use this URI to configure a custom certificate.
202
209
203
-
You don't have to explicitly allow Web PubSub IP addresses in your key vault firewall settings. For more information, see [Key Vault private link diagnostics](/azure/key-vault/general/private-link-diagnostics).
210
+
You don't have to explicitly allow Web PubSub IP addresses in your key vault firewall settings. For more information, see [Key vault private link diagnostics](/azure/key-vault/general/private-link-diagnostics).
204
211
205
212
## Certificate rotation
206
213
207
-
If you don't specify a secret version when you create custom certificate, Web PubSub periodically checks latest version in Key Vault. When a new version is detected, it's automatically applied. The delay is usually within an hour.
214
+
If you don't specify a secret version when you create a custom certificate, Web PubSub periodically checks for the latest version in the key vault. When a new version is detected, it's automatically applied. The delay is usually within an hour.
208
215
209
-
Alternatively, you can also pin a custom certificate to a specific secret version in your key vault. When you need to apply a new certificate, you can edit the secret version, and then update the custom certificate proactively.
216
+
Alternatively, you can pin a custom certificate to a specific secret version in your key vault. When you need to apply a new certificate, you can edit the secret version, and then update the custom certificate proactively.
0 commit comments