Azure Functions secured with Azure AD - Getting HTTP 401 when calling from native app

Question

My goal is to secure my Azure Functions with Azure AD and call them from a WPF application.

I have an Azure Function with the following definition :

public IActionResult Run(
        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = null)]
        HttpRequest req,
        ILogger log,
        ExecutionContext context,
        ClaimsPrincipal claimsPrincipal)

I registered an Azure AD App and configured the settings for Native App Authentication :

I configured my app in the "Expose an API" bladd

I also added an API Permissions

I associated my app in my Azure Functions App in the Authentication / Authorization blade.

I am getting a token from Azure AD like this in a WPF app (using the Microsoft.Identity.Client library)

            string applicationID = "***"; // My AppID Guid
            PublicClientApp = PublicClientApplicationBuilder.Create(applicationID)
                .WithRedirectUri("https://login.microsoftonline.com/common/oauth2/nativeclient")
                .Build();

            var listScopes = new List<string>
            {
                //"user.read" - Removed based on @tony-yu recommendation
                $"api://{applicationID}/MyScope"
            };

            var authResult = await PublicClientApp.AcquireTokenInteractive(listScopes)
                                      .ExecuteAsync();

            var myToken = authResult.AccessToken;

I can authenticate without any problem and I am successfully getting a token but whenever I call my function and I provide my token in the Authorization header (Authorization = Bearer ****), I get :

401 - You do not have permission to view this directory or page.

Here's how I call it (Postman) :

Here is the WWW-Authenticate header content when the call returns

When I check the token I got, it seems legit

Any idea what I am doing wrong?

score 0 · Answer 1 · answered May 29 '20 at 02:34

0

The scope is not correct. As you want to access your function which is protected by ad, you need to use

var listScopes = new List<string>
            {
                "{applicationID}/.default"
            };

instead.

user.read is the permission for Microsoft Graph API.

answered May 29 '20 at 02:34

Tony Ju

14,891
3
17
31

it doesn't work I still get the 401 unauthorized after changing the scopes – 2d1b May 29 '20 at 10:22
@alexbf How did you call the function? Will the function url work in the browser? – Tony Ju May 30 '20 at 02:00
I call my function from Postman (I added some details in the post). The function will not work from a browser as it is configured to be called from a NativeApp – 2d1b May 31 '20 at 17:50

score 0 · Accepted Answer · answered Jun 07 '20 at 18:41

0

So I finally made it work thanks to this SO article here by ambrose-leung

answered Jun 07 '20 at 18:41

2d1b

595
1
6
24

Azure Functions secured with Azure AD - Getting HTTP 401 when calling from native app

2 Answers2

Linked