FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix: Fix authentication Script by Vamshi-Microsoft · Pull Request #710 · microsoft/content-processing-solution-accelerator · GitHub

/ content-processing-solution-accelerator Public

fix: Fix authentication Script #710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Prajwal-Microsoft merged 2 commits into from
Sep 28, 2026
Conversation 0 Commits 2 Checks 2 Files changed
Merged

fix: Fix authentication Script #710

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
75f24e7
fix: Improve SPA redirect URI registration and enable ID token issuan…
Vamshi-Microsoft Sep 28, 2026
5cf1eed
fix: Update Web client application configuration for API authentication
Vamshi-Microsoft Sep 28, 2026
File filter

Filter by extension

Filter by extension .ps1  (1) .sh  (1) All 2 file types selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
71 changes: 62 additions & 9 deletions infra/scripts/configure_app_authentication.ps1
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -202,8 +202,44 @@ if (-not $WebClientId) {
}

# Register the SPA redirect URI so MSAL can complete the login flow.
# Use a Microsoft Graph PATCH via `az rest`; `az ad app update --set spa=...`
# is unreliable and fails with "Property spa in payload does not match schema".
# The JSON body is written to a temp file (--body @file) because passing inline
# JSON to az on Windows gets mangled by shell quoting.
Write-Host " Setting SPA redirect URI: $WebUri"
az ad app update --id $WebClientId --set "spa={`"redirectUris`":[`"$WebUri`"]}" | Out-Null
$webObjectId = az ad app show --id $WebClientId --query id --output tsv
$spaBody = @{ spa = @{ redirectUris = @($WebUri) } } | ConvertTo-Json -Compress -Depth 5
$spaBodyFile = New-TemporaryFile
Set-Content -Path $spaBodyFile -Value $spaBody -Encoding utf8 -NoNewline
try {
az rest `
--method PATCH `
--uri "https://graph.microsoft.com/v1.0/applications/$webObjectId" `
--headers "Content-Type=application/json" `
--body "@$spaBodyFile" | Out-Null
} finally {
Remove-Item -Path $spaBodyFile -ErrorAction SilentlyContinue
}

# Enable ID token issuance for the implicit grant. Container Apps Easy Auth
# requests an id_token during the login redirect; without this Entra returns
# AADSTS700054 "response_type 'id_token' is not enabled for the application".
# The Easy Auth callback (/.auth/login/aad/callback) must also be registered as
# a Web-platform redirect URI, otherwise login fails with AADSTS50011.
Write-Host " Enabling ID token issuance and Web redirect URI on the Web app..."
$easyAuthRedirect = "$WebUri/.auth/login/aad/callback"
$implicitBody = @{ web = @{ redirectUris = @($easyAuthRedirect); implicitGrantSettings = @{ enableIdTokenIssuance = $true } } } | ConvertTo-Json -Compress -Depth 5
$implicitBodyFile = New-TemporaryFile
Set-Content -Path $implicitBodyFile -Value $implicitBody -Encoding utf8 -NoNewline
try {
az rest `
--method PATCH `
--uri "https://graph.microsoft.com/v1.0/applications/$webObjectId" `
--headers "Content-Type=application/json" `
--body "@$implicitBodyFile" | Out-Null
} finally {
Remove-Item -Path $implicitBodyFile -ErrorAction SilentlyContinue
}

# Grant the Web app permission to call the API's user_impersonation scope.
$scopeGuid = az ad app show --id $ApiClientId --query "api.oauth2PermissionScopes[?value=='user_impersonation'].id | [0]" --output tsv
Expand Down Expand Up @@ -271,15 +307,32 @@ az containerapp auth update `
# ---------------------------------------------------------------------------
Write-Step "Step 4: Allowing the Web client on the API"

# The `--allowed-client-applications` flag is not available in older containerapp
# CLI extensions. The authConfigs resource does not support PATCH, so GET the
# current config, merge in the allowed application, and PUT it back.
Write-Host " Adding Web client id to the API allowed client applications..."
az containerapp auth microsoft update `
--name $ApiAppName `
--resource-group $ResourceGroup `
--client-id $ApiClientId `
--issuer $Issuer `
--allowed-audiences $ApiIdentifierUri `
--allowed-client-applications $WebClientId `
--yes | Out-Null
$authConfigUri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.App/containerApps/$ApiAppName/authConfigs/current?api-version=2024-03-01"
$authConfig = az rest --method GET --uri $authConfigUri | ConvertFrom-Json
$aad = $authConfig.properties.identityProviders.azureActiveDirectory
if (-not $aad.validation) {
$aad | Add-Member -NotePropertyName validation -NotePropertyValue ([pscustomobject]@{}) -Force
}
if (-not $aad.validation.defaultAuthorizationPolicy) {
$aad.validation | Add-Member -NotePropertyName defaultAuthorizationPolicy -NotePropertyValue ([pscustomobject]@{}) -Force
}
$aad.validation.defaultAuthorizationPolicy | Add-Member -NotePropertyName allowedApplications -NotePropertyValue @($WebClientId) -Force
$allowedAppsBody = @{ properties = $authConfig.properties } | ConvertTo-Json -Compress -Depth 20
$allowedAppsFile = New-TemporaryFile
Set-Content -Path $allowedAppsFile -Value $allowedAppsBody -Encoding utf8 -NoNewline
try {
az rest `
--method PUT `
--uri $authConfigUri `
--headers "Content-Type=application/json" `
--body "@$allowedAppsFile" | Out-Null
} finally {
Remove-Item -Path $allowedAppsFile -ErrorAction SilentlyContinue
}

# ---------------------------------------------------------------------------
# Step 5: Update Web container environment variables
Expand Down
53 changes: 44 additions & 9 deletions infra/scripts/configure_app_authentication.sh
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -151,8 +151,35 @@ else
echo " Reusing Web app registration: $WEB_CLIENT_ID"
fi

# Register the SPA redirect URI via a Microsoft Graph PATCH; `az ad app update
# --set spa=...` is unreliable and fails with "Property spa in payload does not
# match schema". The JSON body is written to a temp file (--body @file) to avoid
# shell-quoting issues.
echo " Setting SPA redirect URI: $WEB_URI"
az ad app update --id "$WEB_CLIENT_ID" --set "spa={\"redirectUris\":[\"$WEB_URI\"]}"
WEB_OBJECT_ID=$(az ad app show --id "$WEB_CLIENT_ID" --query id --output tsv)
SPA_BODY_FILE=$(mktemp)
printf '{"spa":{"redirectUris":["%s"]}}' "$WEB_URI" > "$SPA_BODY_FILE"
az rest \
--method PATCH \
--uri "https://graph.microsoft.com/v1.0/applications/$WEB_OBJECT_ID" \
--headers "Content-Type=application/json" \
--body "@$SPA_BODY_FILE"
rm -f "$SPA_BODY_FILE"

# Enable ID token issuance for the implicit grant. Container Apps Easy Auth
# requests an id_token during the login redirect; without this Entra returns
# AADSTS700054 "response_type 'id_token' is not enabled for the application".
# The Easy Auth callback (/.auth/login/aad/callback) must also be registered as
# a Web-platform redirect URI, otherwise login fails with AADSTS50011.
echo " Enabling ID token issuance and Web redirect URI on the Web app..."
IMPLICIT_BODY_FILE=$(mktemp)
printf '{"web":{"redirectUris":["%s/.auth/login/aad/callback"],"implicitGrantSettings":{"enableIdTokenIssuance":true}}}' "$WEB_URI" > "$IMPLICIT_BODY_FILE"
az rest \
--method PATCH \
--uri "https://graph.microsoft.com/v1.0/applications/$WEB_OBJECT_ID" \
--headers "Content-Type=application/json" \
--body "@$IMPLICIT_BODY_FILE"
rm -f "$IMPLICIT_BODY_FILE"

SCOPE_GUID=$(az ad app show --id "$API_CLIENT_ID" --query "api.oauth2PermissionScopes[?value=='user_impersonation'].id | [0]" --output tsv)
echo " Adding API permission to the Web app..."
Expand Down Expand Up @@ -215,15 +242,23 @@ az containerapp auth update \
# ---------------------------------------------------------------------------
step "Step 4: Allowing the Web client on the API"

# The --allowed-client-applications flag is not available in older containerapp
# CLI extensions. The authConfigs resource does not support PATCH, so GET the
# current config, merge in the allowed application with jq, and PUT it back.
echo " Adding Web client id to the API allowed client applications..."
az containerapp auth microsoft update \
--name "$API_APP_NAME" \
--resource-group "$RESOURCE_GROUP" \
--client-id "$API_CLIENT_ID" \
--issuer "$ISSUER" \
--allowed-audiences "$API_IDENTIFIER_URI" \
--allowed-client-applications "$WEB_CLIENT_ID" \
--yes
AUTH_CONFIG_URI="https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.App/containerApps/$API_APP_NAME/authConfigs/current?api-version=2024-03-01"
CURRENT_AUTH_FILE=$(mktemp)
ALLOWED_APPS_FILE=$(mktemp)
az rest --method GET --uri "$AUTH_CONFIG_URI" > "$CURRENT_AUTH_FILE"
jq --arg app "$WEB_CLIENT_ID" \
'{properties: (.properties | .identityProviders.azureActiveDirectory.validation.defaultAuthorizationPolicy.allowedApplications = [$app])}' \
"$CURRENT_AUTH_FILE" > "$ALLOWED_APPS_FILE"
az rest \
--method PUT \
--uri "$AUTH_CONFIG_URI" \
--headers "Content-Type=application/json" \
--body "@$ALLOWED_APPS_FILE"
rm -f "$CURRENT_AUTH_FILE" "$ALLOWED_APPS_FILE"

# ---------------------------------------------------------------------------
# Step 5: Update Web container environment variables
Expand Down
Loading
Back | FazBrowse Home | New Git URL