Enabling OAuth2 providers for Azure Container Apps authentication

Question

Pulumi · Accepted Answer

OAuth2 is a protocol for authentication and authorization that allows applications to securely access resources without having to handle user credentials. Azure Container Apps is a service that enables you to deploy containerized applications, and you can configure it to use OAuth2 providers for authentication.

Enabling OAuth2 for Azure Container Apps involves setting up an authentication configuration that points to your chosen OAuth2 providers. You can use providers such as Azure Active Directory, Facebook, Google, and others. In Pulumi, this is facilitated by the `ContainerAppsAuthConfig` resource in the `azure-native` package.

In this program, I will demonstrate how to configure OAuth2 providers for Azure Container Apps. Specifically, I'll show how to enable Azure Active Directory as an OAuth2 provider.

Below is a Pulumi program written in TypeScript that sets up authentication for an Azure Container App. Before running this code, you need to have Pulumi installed and be logged into the Azure CLI with an account that has the required permissions to create resources in your subscription.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

// Replace these variables with your own values
const resourceGroupName = "my-resource-group";
const containerAppName = "my-container-app";
const authConfigName = "my-auth-config";
const clientId = "my-client-id"; // Azure AD Application (client) ID
const tenantId = "my-tenant-id"; // Azure AD Tenant ID
const issuerUrl = `https://login.microsoftonline.com/${tenantId}/v2.0`;

const containerAppAuthConfig = new azure_native.app.ContainerAppsAuthConfig(authConfigName, {
    resourceGroupName: resourceGroupName,
    containerAppName: containerAppName,
    globalValidation: {
        unauthenticatedClientAction: "RedirectToLoginPage",
        redirectToProvider: "azureActiveDirectory", // Redirect to Azure AD for unauthenticated requests
    },
    identityProviders: {
        azureActiveDirectory: {
            enabled: true,
            registration: {
                clientId: clientId,
                openIdIssuer: issuerUrl,
            }
        }
    },
});

export const authConfig = containerAppAuthConfig.name;
```

In the script above:

- We import the necessary Pulumi libraries.
- You need to set the `resourceGroupName`, `containerAppName`, `authConfigName`, `clientId`, `tenantId`, and `issuerUrl` variables with the actual values that correspond to your environment and Azure AD app registration.
- The `ContainerAppsAuthConfig` resource is where we specify the authentication configuration for our container app.
  - `globalValidation` specifies what action to take when an unauthenticated client accesses the app. Here, we opt to `RedirectToLoginPage`, with Azure Active Directory being the provider.
  - In the `identityProviders` block, we set up Azure Active Directory by providing the `clientId` and the `issuerUrl`.
- Finally, we export the name of the auth config as a stack output, so you can easily retrieve it after deployment.

Please ensure you have the necessary permissions to create these resources in Azure. The client ID refers to the Application ID of an app registration in Azure Active Directory, which you'll need to create beforehand. The tenant ID refers to the directory ID of your Azure Active Directory instance.

You can deploy this program using the Pulumi CLI. First, navigate to the directory where the file is located, then run the following commands:

1. `pulumi stack init` to create a new stack for your project.
2. `pulumi up` to preview and deploy the changes.

Remember to check the output of the `pulumi up` command to ensure that your authentication settings have been applied correctly.