Open scrocquesel-ml150 opened 1 month ago
Adding a fictitous configuration works.
services.AddAuthentication()
.AddMicrosoftIdentityWebApi(hostBuilderContext.Configuration, jwtBearerScheme: "ForTokenForAppAcquisitionOnly")
.EnableTokenAcquisitionToCallDownstreamApi()
.AddDownstreamApi("test", configure => {
// [...]
configure.AcquireTokenOptions = new AcquireTokenOptions
{
// [...]
AuthenticationOptionsName = "ForTokenForAppAcquisitionOnly"
}
The issue is that despite I don't need a confidential client configuration (and I don't have one either in Entra), I must set a value for required options.
"AzureAd": {
"Instance": "https://invalid.but.not.used",
"TenantId": "invalid but not used",
"ClientId": "invalid but not used"
},
I think that if the forceSdk
is exposed on AddTokenAcquisition
, I would be able to configure the app with:
services
.Configure<MicrosoftIdentityApplicationOptions>(hostBuilderContext.Configuration.GetSection("AzureAd"))
.AddTokenAcquisition(isTokenAcquisitionSingleton: true, disableAspNetCoreAuthenticationServiceSupport: true)
.AddInMemoryTokenCaches()
.AddHttpClient();
I can then configure the Azure Function like a non-protected API, with either a managed identity on AcquireTokenOptions
or an AzureAd
confidential client.
@scrocquesel-ml150 could you try adding
options.AcquireTokenOptions.AuthenticationOptionsName = ""
to your call
var response = await _downstreamApi.CallApiForAppAsync("test", options => options.RelativePath = "api/v1/test");
@scrocquesel-ml150 could you try adding
options.AcquireTokenOptions.AuthenticationOptionsName = ""
to your call
var response = await _downstreamApi.CallApiForAppAsync("test", options => options.RelativePath = "api/v1/test");
This doesn't work,
Exception while executing function: Functions.TestNew Result: Failure
Exception: System.InvalidOperationException: IDW10503: Cannot determine the cloud Instance. The provided authentication scheme was ''. Microsoft.Identity.Web inferred 'OpenIdConnect' as the authentication scheme. Available authentication schemes are ''. See https://aka.ms/id-web/authSchemes.
at Microsoft.Identity.Web.TokenAcquisitionAspnetCoreHost.GetOptions(String authenticationScheme, String& effectiveAuthenticationScheme)
at Microsoft.Identity.Web.TokenAcquisition.GetAuthenticationResultForAppAsync(String scope, String authenticationScheme, String tenant, TokenAcquisitionOptions tokenAcquisitionOptions)
at Microsoft.Identity.Web.DefaultAuthorizationHeaderProvider.CreateAuthorizationHeaderAsync(IEnumerable`1 scopes, AuthorizationHeaderProviderOptions downstreamApiOptions, ClaimsPrincipal claimsPrincipal, CancellationToken cancellationToken)
at Microsoft.Identity.Web.DownstreamApi.UpdateRequestAsync(HttpRequestMessage httpRequestMessage, HttpContent content, DownstreamApiOptions effectiveOptions, Boolean appToken, ClaimsPrincipal user, CancellationToken cancellationToken)
at Microsoft.Identity.Web.DownstreamApi.CallApiInternalAsync(String serviceName, DownstreamApiOptions effectiveOptions, Boolean appToken, HttpContent content, ClaimsPrincipal user, CancellationToken cancellationToken)
Even adding a default (un-named option) MicrosoftIdentityApplicationOptions
.
What I did is to add a named MicrosoftIdentityApplicationOptions
and use its name as the AuthenticationOptionsName
. I still have to provide a value for MicrosoftIdentityApplicationOptions.Instance
despite I'm requesting an AppToken with managed identity but I can live with that. Thought, I'm in between protected app and daemon app for configuration and wiki doesn't address this edge case.
Microsoft.Identity.Web Library
Microsoft.Identity.Web
Microsoft.Identity.Web version
3.0.1
Web app
Sign-in users
Web API
Protected web APIs call downstream web APIs
Token cache serialization
In-memory caches
Description
In a Azure function with ASPNet support (
ConfigureFunctionsWebApplication
) but without authentication, requesting a token fails with errorIDW10503: Cannot determine the cloud Instance. The provided authentication scheme was ''. Microsoft.Identity.Web inferred 'OpenIdConnect' as the authentication scheme. Available authentication schemes are ''. See https://aka.ms/id-web/authSchemes.
Reproduction steps
Create an azure function with http trigger and configure a downstream api with managed identity authentication option
Error message
Id Web logs
No response
Relevant code snippets
Regression
No response
Expected behavior
I should be able to obtain a token.
The error occurs because
AddTokenAcquisition
internally detects a registered service of typeMicrosoft.AspNetCore.Authentication.IAuthenticationService
, which is registered byConfigureFunctionsWebApplication
.Is there an authentication configuration to be added even if it is not used to authenticate the incoming request? I guess this could be also used to describe a confidential client configuration for local development (with certificate or secret).