0

I am using the below design to secure communication between Azure Function and Web API

enter image description here

  • Step 1 - Request token from AD
  • Step 2 - Use token to request web api

Code to call the API

   public static async Task<IActionResult> Run(HttpRequest req, ILogger log)
   {
     log.LogInformation("C# HTTP trigger function processed a request.");
     var endpoint = Environment.GetEnvironmentVariable("IDENTITY_ENDPOINT");
     var identity_header = Environment.GetEnvironmentVariable("IDENTITY_HEADER");
 
     var resource = "4df52c7e-3d6f-4865-a499-cebbb2f79d26"; //how to secure this ID
     var requestURL = endpoint + "?resource=" + resource + "&api-version=2019-08-01";

     HttpClient httpClient = new HttpClient();
     httpClient.DefaultRequestHeaders.Add("X-IDENTITY-HEADER", identity_header);
     HttpResponseMessage response = await httpClient.GetAsync(requestURL);
     response.EnsureSuccessStatusCode();

     string responseBody = await response.Content.ReadAsStringAsync();
     var access_token = JsonConvert.DeserializeObject<TokenResp>(responseBody).access_token;


     var APIURL = "https://frankapp.azurewebsites.net";
     HttpClient callAPI = new HttpClient();
     callAPI.DefaultRequestHeaders.Add("Authorization","Bearer "+ access_token);
     HttpResponseMessage APIResponse = await callAPI.GetAsync(APIURL);
     return new OkObjectResult(APIResponse.StatusCode);
   }

Question

The solution works as planned, However, I see a security loophole here. That is, any azure function that has the above code or resource id can call this API!!!

How can I solve this security issue? How can I make only listed azure functions to call the API?

kudlatiger
  • 3,028
  • 8
  • 48
  • 98
  • 1
    If you want only some specific Azure function(managed identity) could access your API, you can check the access token claim from the function request. For instance, if your web API only allows managed identity with a specifc object ID to access, you can check the oid(object ID of managed identity) claim of the access token. You can also define a ip whitelist in for your API app: https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions#manage-access-restriction-rules-in-the-portal – Stanley Gong Apr 02 '21 at 06:16

2 Answers2

1

There are several solutions to secure the API App, as mentioned in the comment, you could validate the token via the claims, use the access restriction rules, etc.

From your code, it uses the MSI(managed identity) to get the token for the AD App of the API App, then uses the token to call the API. In this case, I recommend you to use User assignment required setting to restrict the access of the API App, after doing the steps below, just the MSI of the function can get the token for the API App, no need to do anything else.

1.Navigate to the AD App of your API App in the Azure Active Directory in the portal -> click the Managed application in local directory -> Properties -> set the User assignment required to Yes.

enter image description here

enter image description here

2.Create a security group in AAD and add the MSI service principal as a member to it, then add the group to the Users and groups, then the MSI will also be able to call the function.(For the user, it can be added directly, MSI is different, you need to use this nested way, or leverage the App role)

enter image description here

After the steps above, just the MSI added to the Users and groups can get the token successfully and call the API, there are two similar issues I have answered, here and here. In the two posts, they want to secure the function app, in your case, it is the same logic.

Joy Wang
  • 39,905
  • 3
  • 30
  • 54
  • Is this line has a typo ? "then add the group to the Users and groups" - adding group to the group? step 2 is slightly not clear. – kudlatiger Apr 02 '21 at 13:07
  • @kudlatiger It is not a typo, `Users and groups` is a blade in the enterprise application page, see the image in step 2. – Joy Wang Apr 02 '21 at 13:49
  • 1
    @kudlatiger We could not add the MSI directly to it, so we need to create a security group in AAD, add the MSI to the group, then add the group to the `Users and groups` blade. – Joy Wang Apr 02 '21 at 13:56
  • 1
    I was on dental treatment break, I shall try out today and keep you posted. – kudlatiger Apr 06 '21 at 09:22
0

Security between Azure Function and API app using AAD can be done in multiple ways:

  1. Claims in access token
  2. Whitelist all the IP range where azure function is hosted, deny others.
  3. Users and group policy in AAD as security group.
  4. Put App service and AF in a single VNET (though that restricts multi-region)
  5. Object ID verification

Read more: https://www.tech-findings.com/2020/01/securing-function-app-with-azure-active-directory.html

Biplab Sah
  • 81
  • 3