Allow Keyless Authorization from Managed Service Identity to Azure Function

0
votes

Imagine that I have:

An Azure Function (func) that exposes an http endpoint (api1)
An Azure App Service (service1) that has a Managed Service Identity configured (msi1)

I would like to configure everything in such a way that service1 can make an HTTP request to api1, and api1 knows that the request is coming from msi1. Furthermore, I would like to be able to configure service1 in the Azure portal to either allow or disallow access to api1.

Basically I want to configure which app services have access to which functions (or vice-versa) as much as possible in the Azure portal, without having to create and manage API tokens or keys in application settings.

I would like to stress that this is service-to-service - service1 does not request any login information from its users.

I believe that this should be possible, but most of the documentation that I have come across describes situations in which a user logs in via Microsoft/Facebook/Google/Whatever and gets an access token in that way. I know that I can use client credentials on an application registration to create a valid bearer token; but that shouldn't be necessary because service1 is executing under the security context of msi1.

1
azureazure-active-directoryazure-web-app-serviceazure-functions
My article on using MSI to call your own APIs might at least give you some pointers: joonasw.net/view/…. You can register your api1 as an app in AAD. Then use PowerShell to assign access to the MSI. Sadly there is no way to assign permissions from the portal at the moment. – juunas
@juunas's answer seems to have done exactly what I was looking for! I definitely need to do some more reading on Azure Active Directory, the documentation and terminology seems to be all over the place. – Nelson L

1 Answers

0
votes

As juunas said, you could refer to his article to secure azure function from app service using a managed identity.

Register your api1 as app in AAD and using powershell to assign permission to the service1 MSI. It seems that assigning permission to MSI is not supported on Portal, so you could just use powershell to assign it. Here is a similar thread that assign permission to MSI you could refer to.