When working in Azure, storing secrets in Key Vault is a good idea. And to make it better, there’s the Key Vault Reference notation. This feature makes sure no one can read the secret(s) unless someone grants permission.
For storing configuration, values a different service is available, called Azure App Configuration.
Both services are excellent for storing & sharing the values of your cloud services.
Wouldn’t it be great to be able to combine the two?
Read more →A couple of days ago a friend asked me the question ‘How should I authenticate services with each other using roles’. I wanted to point him to a post I wrote last year, ‘Using an Azure Managed Identity to authenticate on a different App Service’, but I noticed this post wasn’t as complete as I remembered it to be.
While it does explain how to enable authentication in your service and using a Managed Identity for this, it doesn’t cover how to add roles in your application and assign them to a user or service principal (like a Managed Identity).
Read more →A couple of weeks ago, I was tasked to implement authentication between the services we have in our Azure landscape. I knew this can be done by using the Managed Identity, as we were doing this on a project I was involved with in the past.
However, I had never actually done this myself. Most of the time the System Administrators were configuring everything and I just had to copy-paste some Guids in a configuration file.
Read more →I started working on some internal web applications for a customer. For these types of applications, it makes a lot of sense to use Azure Active Directory to authenticate users and use their AAD groups/roles to authorize them on specific pages.
I wanted to authorize users by the AAD groups they are placed in. Some users can access Production data, while others are only allowed to access data from the Test environment, all based on the groups they are in.
Read more →If you’ve read my earlier post on authentication of actions invoked in a Microsoft Teams MessageCard, you’ve probably seen the only useful information we get in the user’s token is the Object Id (oid).
{ "iat": 1560799130, "ver": "STI.ExternalAccessToken.V1", "appid": "48afc8dc-f6d2-4c5f-bca7-069acd9cc086", "sub": "bc6c3ca0-5acd-4cd4-b54c-f9c83925e7e3", "appidacr": "2", "acr": "0", "tid": "4b1fa0f3-862b-4951-a3a8-df1c72935c79", "oid": "b26c3c10-5fad-4cd3-b54c-f9283922e7e2", "iss": "https://substrate.office.com/sts/", "aud": "https://serverlessdevops.azurewebsites.net", "exp": 1560800030, "nbf": 1560799130 } While this is nice, it doesn’t really tell us much.
Read more →