Securing Azure Function endpoints with OAuth providers

Question

Pulumi · Accepted Answer

To secure Azure Function endpoints with OAuth providers, you need to set up an identity provider that will handle the OAuth flow, validate users, and issue tokens that your Azure Function can understand and trust.

In the context of Azure, this can be accomplished by leveraging Azure API Management as a gatekeeper to your Azure Functions. Azure API Management can be integrated with various OAuth providers, such as Azure Active Directory (AAD), and it will handle the authentication and authorization concerns, ensuring that only authenticated requests reach your function app.

Here's how you'd set this up using Pulumi:

Create an Azure Function app.
Configure Azure API Management to protect your function app.
Set up an OAuth provider (in this case, we'll use Azure Active Directory).
Configure the Azure API Management to validate tokens from the OAuth provider.

Below is a sample TypeScript program demonstrating this setup. We'll be using Pulumi's azure-native provider:

import * as pulumi from "@pulumi/pulumi";
import * as azureNative from "@pulumi/azure-native";

// Step 1: Create an Azure Function App
const resourceGroup = new azureNative.resources.ResourceGroup("myResourceGroup");

const storageAccount = new azureNative.storage.StorageAccount("mystorageaccount", {
    resourceGroupName: resourceGroup.name,
    kind: "StorageV2",
    sku: {
        name: "Standard_LRS",
    },
});

const appInsights = new azureNative.insights.Component("myAppInsights", {
    resourceGroupName: resourceGroup.name,
    kind: "web",
    applicationType: "web",
});

const appServicePlan = new azureNative.web.AppServicePlan("myAppServicePlan", {
    resourceGroupName: resourceGroup.name,
    kind: "FunctionApp",
    sku: {
        name: "Y1",
        tier: "Dynamic",
    },
});

const functionApp = new azureNative.web.WebApp("myFunctionApp", {
    resourceGroupName: resourceGroup.name,
    serverFarmId: appServicePlan.id,
    siteConfig: {
        appSettings: [
            { name: "FUNCTIONS_WORKER_RUNTIME", value: "node" },
            { name: "APPINSIGHTS_INSTRUMENTATIONKEY", value: appInsights.instrumentationKey },
            { name: "AzureWebJobsStorage", value: storageAccount.primaryConnectionString },
        ],
    },
});

// Step 2: Configure Azure API Management
const apimService = new azureNative.apimanagement.ApiManagementService("myApimService", {
    resourceGroupName: resourceGroup.name,
    publisherName: "My Company",
    publisherEmail: "admin@example.com",
    sku: {
        name: "Consumption",
        capacity: 0,
    },
});

// Step 3: Set up an OAuth provider by creating an authorization server
//          in this case, we'll use Azure Active Directory
const authServer = new azureNative.apimanagement.AuthorizationServer("myAuthServer", {
    resourceGroupName: resourceGroup.name,
    serviceName: apimService.name,
    authorizationEndpoint: "https://login.microsoftonline.com/<tenant-id>/oauth2/authorize",
    clientId: "<client-id-from-AzureAD-app-registration>",
    // Use Pulumi's built-in secret handling to avoid exposing sensitive information
    clientSecret: pulumi.secret("<client-secret-from-AzureAD-app-registration>"),
    defaultScope: "user_impersonation",
    displayName: "Azure AD OAuth2",
    // It's advisable to enable state validation for security purposes
    supportState: true,
    tokenEndpoint: "https://login.microsoftonline.com/<tenant-id>/oauth2/token",
    grantTypes: ["authorizationCode"],
});

// Export the API Management service URL, which is the endpoint users will hit
export const apiEndpoint = apimService.gatewayUrl;

Explanation

Resource Group: This is a container that holds related resources for an Azure solution.
Storage Account: Azure Function App requires a storage account to operate.
App Insights: This service is used for monitoring your function app.
App Service Plan: Defines the pricing tier of the Azure Function. The Y1 tier is cost-effective for small-scale functions.
Azure Function App: This is the serverless compute service where our code runs.
Azure API Management (APIM) Service: Sits in front of the Azure Function and handles incoming API requests. It authenticates each call and routes it to the backend function.
Authorization Server: Registers an OAuth provider with APIM to manage OAuth2 flows. Replace <tenant-id>, <client-id-from-AzureAD-app-registration>, and <client-secret-from-AzureAD-app-registration> with actual values from your Azure AD application registration.

Note that in this program, you have to replace placeholder values with actual configuration parameters from your environment, like client ID and client secret from Azure Active Directory.

Remember to replace placeholders with actual values from your Azure AD tenant and app registration. Please also ensure that proper redirect URLs are configured in your Azure AD app for the OAuth flow to work correctly. This Pulumi program will create the necessary cloud resources, but additional setup on the Azure portal might be required to ensure everything is configured correctly.