Secure Azure Function in Xamarin Forms app.How should it work?

0
votes

In my xamarin forms app I have the need to call some azure functions in a secure way.

What I have done

  1. All my functions have AuthorizationLevel=Function
  2. Get Function Key by making a call to a webApi that is stored on the server
  3. Function Key is passed in the header of the http call (all works!!)

I do not like the above and definitely I do not want to store the function key on the mobile app as an alternative

I have read about Authentication/Authorization but I cannot figure out if it fits my scenario

My Scenario

Ability to call an azure function in a secure way.User should NOT be prompted to login.Its a silent call.

  1. Is there some sort of accessToken I can use and retrieve safely from azure portal and use that in some way to access the function?

  2. How do you securely access an azure function in a mobile app?

  3. Any samples? I have read below and did not help

https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad

Edited

Tried below but I get an error(connection string error) in the mobile app.Also not sure how it works when deployed as in debug it uses the credential of the developer enter image description here

var azureServiceTokenProvider = new AzureServiceTokenProvider();
    var keyVaultClient =
        new KeyVaultClient(
            new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
    var secret = await keyVaultClient.GetSecretAsync("mysecretIdentifier").ConfigureAwait(false);
    var key = secret.Value;
1
xamarin.formsazure-functions
does the function do anything that is specific to a mobile user or it does not matter? - CodeReaper
it does not matter , it just retrieve a json from a blob. - developer9969
@developer9969 are you already use Azure ActiveDirectory authentification within your mobile app ? - Houssem
@HoussemDbira I can use AAD no problem but must be a silent call a user should not be prompted to login using those providers.Reading a value from the vault would be fine but not sure how it works in production see edited question, - developer9969

1 Answers

0
votes

Recommended Approach

The best way to handle authentication for Azure Functions is to leverage the built-in Authentication and Authorization feature. This uses an existing auth provider to authenticate your users allowing you to avoid creating/storing/maintaining user ids & passwords.

Here's a walkthrough adding Azure AD B2C Authentication to Azure Functions: https://github.com/jimbobbennett/MobileAppsOfTomorrow-Lab/blob/master/Workshop/2-SetupAzureFunctions.md#4-setup-function-app-authentication

Alternative Approach

Since it sounds like you aren't using authentication and you want to have a secure API that only your app can access, we can use AuthorizationLevel=Function and inject the API key into our app using our Continuous Integration server at build-time.

I do this for my GitTrends app. Here's how: