Azure Function Authentication: Azure Active Directory: Use Security Group to include identities (users and service principals) to access Function

Question

I have an Azure Function with Azure Active Directory authentication enabled (including "Action to take when request is not authenticated" = "Log in with Azure Active Directory"). Additionally the option "User assignment required?" of the Azure Function related service principal (sp_func) is set to "Yes" to avoid everybody in the tenant being able to in the end run the function.

The goal is to have a single security group (that can include users as well as service principals) that is added to "Users and groups" of sp_func so that the assignment to the group decides if the function can be accessed or not. With users this works fine but not with service principals (sp_nonfunc). For them (sp_nonfunc) to work I have to set the permissions for them (sp_nonfunc) what in the end allows them to interact with the Azure Function no matter if they (sp_nonfunc) are assigned to the group or not.

Is it possible that I can just add a service principal (sp_nonfunc) to a group with the group being added to sp_func and then be able to execute the Function by using sp_nonfunc (without giving explicit permissions to sp_nonfunc)?

EDIT: it also does not seem to be possible to add sp_nonfunc to sp_func directly even if I defined an own appRole in the Manifest. The only way currently seems to be to add permissions on sp_nonfunc for sp_func - but that is what I want to avoid.

EDIT2: here how I have defined the role in the sp_func manifest

"appRoles": [
    {
        "allowedMemberTypes": [
            "Application"
        ],
        "displayName": "AzureFunctionAccess",
        "id": "xxx-xxx-xxx-xxx-xxx",
        "isEnabled": true,
        "description": "Access Azure Function.",
        "value": "AzureFunctionAccess"
    }
]

EDIT3: when I don't assign a role directly to sp_nonfunc but just add sp_nonfunc to the security group I get, when making a request to https://login.microsoftonline.com/<tenant id>/oauth2/token with resource = Application ID URI of the registered app of sp_func:

{
    "error": "invalid_grant",
    "error_description": "AADSTS501051: Application 'xxx-xxx-xx-xx-xx'(xxx) is not assigned to a role for the application 'https://xxx'(xxx).\r\nTrace ID: xxx-xxx-xx-xx-xx\r\nCorrelation ID: xxx-xxx-xx-xx-xx\r\nTimestamp: xx-xx-xx xx:xx:xxZ",
    "error_codes": [
        501051
    ],
    "timestamp": "xx-xx-xx xx:xx:xxZ",
    "trace_id": "5xxx-xxx-xx-xx-xx",
    "correlation_id": "xxx-xxx-xx-xx-xx",
    "error_uri": "https://login.microsoftonline.com/error?code=501051"
}

Could you clarify what you mean by "add sp_nonfunc to sp_func directly"? Could you share how you've defined the app role on the app for "sp_func"? — Philippe Signoret, Jul 02 '20 at 20:38
@PhilippeSignoret I have the service principal "sp_func" that is created in the context when enabling authentication through AAD for Azure Functions. This service principal is used for authentication purposes. As I enabled "User assignment" I need (and want) to add identities to the service principals "Users and groups". And it is not possible to add another service principal to that users and groups directly. — quervernetzt, Jul 03 '20 at 04:52

score 1 · Accepted Answer · answered Jul 03 '20 at 06:29

1

This way will not work, to use a service principal(in your case, the sp_nonfunc) get the token for the function app(sp_func), you need to give the API permission for the sp_nonfunc.

Navigate to the App Registration related to the sp_nonfunc in the portal -> API permissions -> add the AzureFunctionAccess you defined, at last click the Grant admin consent for xxx button.

Then get the token with the client credential flow, it will work fine. (I use the v2.0 endpoint, if you use the v1.0, it will also work.)

For more details about the steps, I wrote in this post before, you could refer to it.

answered Jul 03 '20 at 06:29

Joy Wang

39,905
3
30
54

Thank you for your response. This is the way I was aware of but what I want to avoid. The group assignment should be the deciding factor, not if sp_nonfunc has the permissions assigned. The goal is that the group membership decides if you can execute the function or not. But this is not possible or? – quervernetzt Jul 03 '20 at 07:49
1

@quervernetzt If you give the api permission, you will find the sp_nonfunc exists in the `Users and groups` of sp_func. But if you just add the group which includes the service principal, there is no api permission in sp_nonfunc, I don't think you can get the token without the permission. – Joy Wang Jul 03 '20 at 07:55

Azure Function Authentication: Azure Active Directory: Use Security Group to include identities (users and service principals) to access Function

1 Answers1