search

idandaccess / azure-functions-auth

Authentication and Authorization for Azure Functions (with OAuth 2.0 and JWT)
MIT License
18 stars 6 forks source link

Handling multiple public key certs #62

Open hernan-almeida opened 5 years ago

hernan-almeida commented 5 years ago

When implementing with AAD, my tenant has multiple keys that can be used at random to validate JWTs (depending on the kid in the JWT header). Is there a way to setup this module to validate against multiple keys? Or is there a better way to implement bearer auth in this case?

andreasgrimm commented 5 years ago

Hi @hernan-almeida, yes, I actually planned to integrate the lib jwks-rsa that'd make it optional to specify an IDP's (Identity Provider) public key / signing certificate at configuration time. Instead the lib would go and request the right public key from the IDP according to the kid in the JWT header. I just did not yet check if the jwks-rsa lib supports multiple different IDPs (or in Azure terms different tenants/AADs for that matter) with varying "well known endpoint" URIs. If not then I guess it could be implemented in this azure-functions-auth lib.

is there a better way to implement bearer auth in this case?

As you're using the Azure-native IDP "AAD (Azure Active Directory)" you could try to just use the Function App's integrated Authentication functionality.

image

I created this lib mainly for the use case when you're not able to or dont want to use AAD as an IDP.