Authentication differences between isolated and in-process?

[mronnblom-ith]

Hello!

I have an injected mode FunctionApp hosting DfMon. Currently it's using in-process mode (DurableFunctionsMonitor.DotNetBackend v6.7.1) and I have gotten server-directed login flow working, in accordance with the documentation.

Then, I tried switching to DfMon Isolated (DurableFunctionsMonitor.DotNetIsolated v6.7.3), but then the authentication breaks (401). Are there any differences in authentication configuration between in-process and isolated? How about the redirect URL? Should it still be this for isolated:
https://<my-dfm-function-app-name>.azurewebsites.net/.auth/login/aad/callback

Any help with troubleshooting appreciated!

[scale-tone]

Hi @mronnblom-ith , there is no difference in auth process/config between InProc and Isolated.
I suggest you check logs for the exact reason of those 401s.

[mronnblom-ith]

This is the error from the logs:

Result: DFM failed to authenticate request
Type:
Exception: DurableFunctionsMonitor.DotNetIsolated.DfmUnauthorizedException: User myemail@mydomain.com doesn't have any of roles mentioned in DFM_ALLOWED_APP_ROLES, DFM_ALLOWED_FULL_ACCESS_APP_ROLES or DFM_ALLOWED_READ_ONLY_APP_ROLES config setting. Call is rejected
at DurableFunctionsMonitor.DotNetIsolated.Auth.ValidateIdentityAsync(HttpRequestData request, OperationKind operationKind, DfmSettings settings, DfmExtensionPoints extensionPoints)
at DurableFunctionsMonitor.DotNetIsolated.ExtensionMethods.<>c__DisplayClass0_0.<<UseDurableFunctionsMonitor>b__1>d.MoveNext()
Stack: at DurableFunctionsMonitor.DotNetIsolated.Auth.ValidateIdentityAsync(HttpRequestData request, OperationKind operationKind, DfmSettings settings, DfmExtensionPoints extensionPoints)
at DurableFunctionsMonitor.DotNetIsolated.ExtensionMethods.<>c__DisplayClass0_0.<<UseDurableFunctionsMonitor>b__1>d.MoveNext()

The thing is that the same config is used for in-process mode, which works. The pipeline and biceps (including bicepparam where the role app settings are) are identical, except for:
FUNCTIONS_WORKER_RUNTIME: 'dotnet-isolated'
and

  siteConfig: {
    linuxFxVersion: 'DOTNET-ISOLATED|8.0'

[mronnblom-ith]

Here are the packages used for each:

in-proc:

	<ItemGroup>
		<PackageReference Include="Azure.Identity" Version="1.17.1" />
		<PackageReference Include="Fluid.Core" Version="2.31.0" />
		<PackageReference Include="DurableFunctionsMonitor.DotNetBackend" Version="6.7.3" />
		<PackageReference Include="Microsoft.Azure.Functions.Extensions" Version="1.1.0" />
		<PackageReference Include="Microsoft.Azure.WebJobs.Extensions.DurableTask" Version="3.8.0" />
		<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.15.0" />
		<PackageReference Include="Microsoft.NET.Sdk.Functions" Version="4.6.0" />
	</ItemGroup>

isolated:

	<ItemGroup>
		<FrameworkReference Include="Microsoft.AspNetCore.App" />
		<PackageReference Include="Azure.Identity" Version="1.17.1" />
		<PackageReference Include="Fluid.Core" Version="2.31.0" />
		<PackageReference Include="DurableFunctionsMonitor.DotNetIsolated" Version="6.7.3" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker" Version="2.51.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.DurableTask" Version="1.11.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http" Version="3.3.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="2.0.7" />
		<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.15.0" />
	</ItemGroup>