search

Azure / Azure-Functions

1.11k stars 195 forks source link

Issue w/ authorization on system endpoints #2531

Open cwatson-sidub opened 1 month ago

cwatson-sidub commented 1 month ago

I am experiencing authorization issues when using authorization to access system endpoints (i.e., endpoints under /runtime/ or /admin/).

The specific use case is related to serverless SignalR upstream settings which is documented here (https://learn.microsoft.com/en-us/azure/azure-signalr/howto-use-managed-identity#enable-managed-identity-authentication-in-upstream-settings). This document describes configuring the upstream settings to utilize managed identity for communication with the isolated Azure Function.

Regarding reproduction - if you deploy any serverless SignalR / isolated function sample, confirm it functions using the "runtime/webhooks/signalr?code=" approach. Once that is functional, follow the steps to enable managed identity for upstream communication.

For testing, I've placed an API management layer between my SignalR and function app for upstream communications; this has allowed me to retrieve much greater detail in terms of the actual requests going through and I'm able to log the request / response and the authentication header value. Using this value, I've confirmed that the token works successfully when hitting my "HealthCheck" function endpoint (i.e., "/api/HealthCheck") however the token does not work when trying to access the SignalR webhook endpoint "/runtime/webhooks/signalr" and a 403 forbidden error is thrown.

This issue is also submitted here as I'm unsure if its a functions issue or extensions issue: https://github.com/Azure/azure-functions-signalrservice-extension/issues/294.

Additional note - within the Azure Functions authentication settings, I've configured it loosely; I've allowed access from any application and any identity, ensured the issuer / tenant align with the token, and ensured the audience aligns between the token / Signalr upstream settings.

cwatson-sidub commented 1 month ago

Still need a review on this please.

trydis commented 3 weeks ago

Did you use the signalr_extension system key? You'll get 403 if using a regular host key.

cwatson-sidub commented 3 weeks ago

Did you use the signalr_extension system key? You'll get 403 if using a regular host key.

The linked documentation describes how to configure using managed identity for upstream connectivity, in lieu of using function keys.

The problem with these function / extension keys is they are not generated until the code is deployed. That means I cannot configure the infrastructure in my Marketplace deployment.