Massimo Bonanni: Easy-Auth: The Easiest Way to Secure Your Application in Azure App Service

This talk presents the Easy Out feature for Azure App Service, designed to simplify the implementation of authentication in applications. The speaker discusses the challenges developers face when integrating authentication, particularly the complexity of handling various protocols and securely managing sensitive data such as tokens and passwords. Easy Out aims to alleviate these challenges by allowing developers to set up authentication with minimal code or even through configuration alone. The speaker explains how Easy Out integrates with multiple identity providers, such as Microsoft Entra ID, Google, and GitHub, enabling seamless authentication flows for different scenarios. The middleware manages user authentication, token validation, and session management, ensuring a secure experience for both app services and APIs. Demos showcase how to set up Easy Out with various identity providers and highlight its utility in legacy applications.

hi everyone welcome to this session my name is mimo I'm an Italian trainer I work in Microsoft as technical trainer and also I'm also a speaker um in the last uh 10 years I provided several session in in different conferences but it's not important Who I Am the most important think is I want I want you to present this feature on the app service easy out as

you can understand by the name easy out is a way to simplify to make authentication easy in your app service and not only so I start with the typical uh posture of the of a developer when you ask him or her to implement authentication or managing Authentication in your in your solution just because just because for developer the uh the authentication process the authentication implementation is a

complex timec consuming task because it needs needs a lot of knowledge about different protocols I know I know that the everyone that work in this world need to knows these uh uh these things these topics about authentication but uh I'm a developer I trust me it's very difficult to know every single uh protocol not just because the protocol is uh difficult but because when you implement authentication

you manage sensitive information and like passwords access tokens and so on and you need to have a high level of expertise otherwise if you have an errors if you make an errors you can uh have a breach a security bridge and data liix so it's yeah it's if you if you if you miss to put the right button in your interface is not a problem but if

you lose or someone can take the uh token access token and point or password of your user you have some some very very big uh problem so Authentication for the develop is very um very difficult to implement and just to recap what is the flow uh of oout authentication this is this flow is very easy in this slide I just want to emphasize what is the part

of this flow uh in which the developer need to put their hands so first of all your user ask for the hom page or ask for and an authenticated uh resource maybe an on page but but also maybe um an end point a rest and point is not important and because the request doesn't contains a valid token or contains a token that is expired this request will

be redirect to the identity provider I will show you what kind of identity provider you can use in Easy out but just in in general this request write to the identity provider and the user Make login using username password multiactor authenticator as you prefer as you configuring the identity provider then there is another uh another uh uh ex inter interaction between the user and the identity provider

I mean when I talk about the user I talking about the frontend part of your application not necessarily the user the the number three is the uh the uh the call that right from the front end to the identity provider giving the authorization token to receive the access token the access token is the most important thing because uh using the access token finally your user can retrieve

the own page or the yeah the the resource that are authenticated there is another thing you need to do frequently you need to refresh the token because uh the token has all the token has an exp expiration time when the expiration time is reach the token is not valid so the next request to the H page or the to the to the uh to the resource uh

that is authenticated is like the first one so the user will be redirected to the login and so on so uh refresh token is one of the most important thing and also it's not in this um graph but you need to store this token in a session related to the user and this session must be secure all this part is more or less developer responsibility you have

a lot of framework that help you easy out is not the only uh the only way you can implement this all this part you have a lot of framework I will show you in the in the the final part of this uh session yeah but you need to manage all these things so it's uh this is the the reason why the these tasks are very difficult for

a develop because yeah you can imagine that if I uh miss something someone can take the the access token for the for the user what is easy out as you can buil-in capability feature in UPS Service as up service so we are talking about Azure UPS service and uh the idea is to simplify uh the uh the authentication so you can Implement all the flow I mentioned

before without writing code or with minimal code I will show you in in a while and not only in AB service but also in UPS service Azure function and container apps so you can use in a different scenario of course course if your code if your front end I don't know you write a front end in angular I don't know uh already Implement all the uh the

authentication probably this is not the right session you have all your uh uh all you need to to to make an authentication but there are some scenarios I will show you in a while in which you need to you have a a solution you need to authenticate that solution but you don't want or you cannot right code so in that way if you go to Azure up

service you can leverage easy out feature um why uh because Easy E out allow you to integrate uh a lot of out uh capabilities so for example you can have a frontend that call an API so the passing the the the token so making an approach on behalf of between the front end and the API is something you have built in in E out so it's very

easy second um you don't need any language you don't need any uh expertise you don't need uh I know that it's better that you have expertise but you don't need security expertise or SDK or something external to uh write your authentication you just simply configure I will show you in a in in a demo and also you have multiple login providers identity providers Microsoft ENT ID Facebook

uh Google Twitter um GitHub and also every e every open ID connect authentication okay so it's uh it's very very easy as uh you can understand is not for every solution because we we recap at the end this is on aure this is only up service Azure function and container apps and also it's helpful if you don't have an implementation by yourself but probably you have some

scenarios in which you can leverage this is the architecture when you create your up service you know and if you don't know I will tell you now you know you have the up service service in aure that OST your code and expose The Listener so this listener here let me go there this listen The Listener here is exposed by the app service but your code will run

in the MS that are in the up service plan service in Azure when you configure this out the platform put a middleware between your code and the listener so every request arrived from The Listener so from the outside your application will will throw through the apps the out middleware and arrive to your code and this e out middleware manage for you or the all the things the

out so uh redirect the request checking the token first of all then redirect the request to the identity provider the right identity provider then manage the token store if you want you can configure a token store managed by the app service and refresh the token um when it needs so it's something that will be for you by the the the platform so just to to clear this

is what the middleware um does authenticate user and clients just because you can use for a front end but also for API so users mean a user arrive on your page and your page is an up or a client call your API and your API is an up service okay uh validate store and refresh ow tokens okay and manage authenticated session so it means for each user

uh unique user you have an authenticated session managed by the middleware for you and then your code will receive information about identity because the the the whereare inject this um this information in the adders of the request I will show in a while before we go to the uh demos and to the uh way uh this middleware implement the the injection of the of the security information

just to um have a diff there is a different if you work on an up service plan based on Windows or if you work on an up service plan based on Linux and container because just to be clear you can use this feature also for containers so it's not mandatory that you deploy a code your code in I don't know Java or nodejs it works also for

container if you're using an up service plan based on Windows uh your the middleware run in I in the same sand sandbox of your application and uh every request go through this uh uh this this mware and arrive to your application as as usual as I said you before information will be um added to the request as eers if you work in Linux or container you don't

have a native module because you are not have you don't have a behind the scene um the platform run these middleware a separate container isolated from your application and use the Ambassador pattern when you receive the slide or if you want you can search this link will uh will drive you to the Ambassador pattern page in the architect in the in the Azure architectural portal um because

is not in the same process the the the the disadvantage of this approach because it is not it is not running in the same Pro or your application you don't have a direct integration with this with your application but as the as up uped in the windows you receive information the identity information in the U in the adders claim the code um as I said you the

request arrive to the middleware the middleware manages manages for you all the SEC security stuff with the identity providers and then inject the claim inject identity information into the request adders and as this request arrive to your code so if you want you can uh care about the the identity so for example you want to write in the name of the user or for example show the

image the Avatar the user have has in gab I don't know I will show you in a while because you can take this information from the from the others nobody can set this kind of uh header outside the the the the ab service so if you try to make a request and put the the together the same header that the uh the middleware set for you the

middle will remove all this kind of um of the this kind of adders so you cannot inject from outside it's very important because otherwise you have a bridge okay basically you have um four adders I will show in a while that depends on the on the provider you use you have more than four but basically for all the providers you have four um adders uh XMS client

principle contains the uh the token basically I will show you in a while principal ID contain the identifier um for the caller so yeah the yeah the ID in the in the platform in the identity provider the name is a human readible so you have the ID for the user and the name depends on the platform depends on the identity provider what you have in the name

sometimes you have name name and S name other in another in another platform you have the email depend and the IDP the principal IDP is the name of the identity provider because remember you can have more than one identity in the same OB service so you can have a a uh a solution that allow the user to to log in with the entry ID Google and GitHub

okay so you know what kind of um identity provider is used by the by the user okay token store you can uh um enable is just a check in the in the configuration you can enable the token store it allow you allows you to manage the collection of the token for the user in the in a safe authenticated session and refresh the token for you okay it's

a buil-in uh store so it is not no matter no matter what kind of um storage is this one you can manage by yourself if you enable it the platform you and uh of course only the user can read its data the session for the user is safely saved in the storage how you can read you can read all information just simply make a request to this

endpoint so if you are in your site your site SL SL slme allow you to retrieve the information about the token so it is something that the platform manag for you but if you need to know more information about the user you need to retrieve all the information in your code if you want about all the claims you uh have in the authentication process you can do

making a request on these endpoint it's not a public endpoint of course otherwise it's a problem is an internal end point that app service Expos for you so you can I way some scenarios let me drink uh water when use EAS out I don't want to write code to manage authentication example I have a lot of Demos in Azure for my technical sessions and these sessions are

about different topics respect to the uh to the security so for example a demos about a solution to add a feedback from a user and uh analyze the sentiment of this feedback and write in a cosmos when I run in my machine there is no problem about security because I am the only one that I can run F5 in visual studio if I put on Azure I

don't want to implement security because I it is not a demo about security so I put in app service and configure the uh yeah easy out in this way just only the people that I want to uh give the access to the application can use the application but not the other otherwise it is a public uh solution and then everyone can try and use my uh service

right maybe one shenar second one I'm using a language SDK that uh doesn't provide uh sinin authorization part is not uh more the most important sdks and languages support uh support signing authorization but if you have I don't know uh classic ASP for example maybe a good idea uh you cannot change your app if you cannot change your app and you want to for example if you

have a legacy app uh in opem and you want to uh save secure the app you can use the uh the easy out uh if you want just handling authentication using configuration and you don't want to to put a code maybe another one and finally if you want to um use social user external not enter ID because in ENT is easy because you can configure you can

have other sdks but external social User it's or multiple providers maybe another another sh just to be clear imagine you have Legacy app just a scenario about Legacy app imagine you have on Prem a web server in which you running an application and imagine this web server is based on IIs and your application is using the IIs the windows authentication so it means you have a users

in active directory domain service and say Hey I want that this kind of user can join can enter can login in the in the solution now I want to move this uh solution this application in cloud in Azure how can I do first of all I can synchronize the user in ENT ID there is an ENT idid called connect it is a you have a couple of

these uh you can synchronize part of your users in entro ID so they become users in both the words then you can move your app service imagine it is a Java spring Java Java application you can move in in the app service but your application in code in your code has uh not the capability to make uh to to to to implement the authentication because uh you

don't need on Prem on Prem you can use you can leverage the windows authentication on IAS for example then your user an ENT ID your application is on app service so you can say hey I want to uh use the users in my ENT ID uh in this application and then finally you can remove from uh your opram word we can go to the demo okay uh

first one I go to the oh come on here um simple site I want to configure out um just to be sure let me copy this one I open another site in navigation in private navigation it is open because probably I receive okay this is open because uh um it uh um didn't request me any login just to be clear then go here you can find the

configuration in this uh in this option go to the authentication add identity provider here you can have Microsoft Android ID Apple Facebook GitHub Google Twitter with the old logo but it's okay okay and also uh open ID connect so if you have your open ID connect service I don't know whatever you want you can use it let me use use Google just to uh to to to

make a different when you use a different when you use an external provider not an enter ID you need to create an application an app registration an application in the uh Source platform so you need to go to the developer Google developer platform and Google developer console create a new app registration and when you create the app registration Google gives to you a couple of ID and

client ID and secret let me put the this one and then this other one perfect then you need to choose what you want to do so required authentication means every every page or your website needs login allow unauthenticated address means it's up to you redir making a a redir inside your code that uh uh to start uh authentication so it means you have a part of your

website that are not need that don't need authentication this part is interesting because if you are on a website probably you want to have an http uh 302 so it means that the user arrive on your page the user doesn't have the token it will be redirect to the identity provider but if you have an API is not the same if you have an API and a

client make a request without token you need to return HTTP 401 or if you want to re uh ret this kind of this kind of uh status no depends on the scenario you have so it means you can use in website with a UI you can use an API you can using different scenario then okay I I choose Google it's okay and I enable the token store

if you if I if I want I can remove but if I make the call to the the end point I show you in the in the slides you don't rece you don't receive anything I don't know if you receive an error or not but you you cannot receive the claim just because uh you don't have the claim you don't have the token store it's something you

need to manage by want I think it's okay because now the Scopes Scopes means uh what you read of your user when the user Make login is something you cannot configure here you need to configure to Google in this case this Scopes is valid only if you use entra ID because entra ID is an app registration managed by entra ID okay I don't remember what kind of

Scopes I um I use but probably only the name and the email as you can see here you can add other provider if you want the same add provider choose provider setups the information and that's all the most important thing is I go there I copy the link the URL the fully qualified domain name I open a new private windows and then I take the phone because

I need to make multiactor this is the login as you can see here this is the login in Google so I'm I am redirecting to Google so it's okay it's natural because I it's it is what I configured come on password and then let me go and here wait for a moment just to show you that it it works three two one yes I'm I'm the right

one that's all that's all okay you can see here I am M bonani I am um authenticated and also here you can see the adder so you have all the standard addit and and so here principal name my name principal ID the internal ID for the user uh the IDP is Google okay and this is the the token you can trust me but I know you don't

trust me contrl c i open this one I suppose you know jbt doio I put the here and this is Google uh you can see for example the email you can see for example the picture if I move if I copy this one in a new page you can see my beautiful face and so on so you you have all the information this is a real token

so you can uh you can extract data from there another demo another demo let me close this one and uh go to the other one yes is one I configur already configured here the um the authentication let me show you what I used um in this case I used Microsoft so I use the uh enter ID okay I don't remember probably I use the only Microsoft account

you can choose when you use the Microsoft you can choose if you want the Microsoft account or other but I use only Microsoft account and before I run I open the code I write some three samples you can find in the in the slide you can find the link to the gab repo and in this one I create a where is this one I create a middleware

by myself when I receive a I make the request to the um out/ me to retrieve all the information and I create an identity to put in the context of the of the request this is a um asp.net core yeah the latest this mean that if I'm using all the feature of the asp.net regarding the identity when my request arrive to the back end the identity will

be um full will be empty will be completed so you have an identity so you can manage for example authentication um attribute and so on you can see the the code it's just simple I make the request I retrieve information from the Json and I create a new identity and then I put in the context it's very very easy okay if you want you can use this

uh this Middle where it's very easy it's not so so difficult to implement I want to show you what's happened I go there I um copy the link come on maximum you can do it I copy this one I open a new okay now probably I will redirect to um um ENT ID as you can see on top it's login microsoft.com now I need to remember my

okay this one this is my personal account yes and notification multiactor it's good think yes 58 on okay it's okay it's the same the the the result is the same reest detail but also here you can find the claim I put in the identity I read these claims directly from the Json that the platform retrieve from the identity provider for me and store in the token store

for example the mail the name and uh no other things just because uh for the scope I just choose to have the name and and the username if you uh try to do the same for example with the GitHub I will show in a while you also have the Avatar you have the repositories the the the public repositories of the user and so on the third demo

is about multi provider so I go there I copy this link come on again I open a new in private now I enter on the page and I show the page so it means uh that the page is not authenticated because otherwise the pages will redirected me to the login now I can choose for example I can choose to login with gab I put the name prob

probably I need to verify sorry again but it's a it's the right thing okay a02 okay user info the same exactly the same and here you can see for example the followers yeah the following URL the GS and the the Avatar and so on so depends on the platform you are using okay this use the same the same approach I show you in the second demo but

here I would like to show you how you can Implement multi provider in my page hom page this one I just put this link if I redirect if I use this link so this is an internal um endpoint provided by the app I want to authenticate with a ID so enter ID this is uh I want to of course if I configure the right provider I want

to log in with Google I want to log in with GitHub and so on I can put also the redirect URL so I can say hey go to the identity provider and when the provider the the user will be authenticated authenticate show the other pages so this is the way you can do it simply redirect to an internal Lo internal and point just the same the only

thing is Chang is the this one this one and this one and then the middleware redir to the right and point okay okay go ahead a couple of things and we close you can manage these configuration by bicep or asly so you can automatize the the creation of the of this uh identity configuration and then you what you can choose if you want to to to implement

authentication you can use the built-in authentication very easy uh managed by the platform I will show in a while what are the uh the limitation you have um that's all you also have authentication Microsoft authentication Library it is used by the uh the the the middleware if you use this microsof authentication Library you need to write a code of course because you have um an SDK for

several languages that allow you to interact with the U with the providers it is also a multi-provider so you can use ENT ID Facebook Google and Twitter if you are working on.net so you are in the net word you can use that package a Microsoft identity web is something are created on top of Microsoft authentication Library give you some other um feature like controls you can put

in the page and so on but yeah the second and the third needs you need to use that the second and the third if you want to write code the first one is just configuration pros and AOS very very easy uh so if you have just uh add the an authentication process it's very easy support for multiple identity providers and virtually for any open ID connect providers

even if you have an internal uh on Prem identity provider you suppose you can interact with the app service just because open ID is open ID is not is a standard the integration with the app service the uh asure service is easy so the app service what I mentioned the app service is exactly the same if you use Azure function or if you use container apps it's

just a configuration and the middle is the same and answer security because in some scenario you don't have security uh on the beginning In My Demo I don't put security not because I'm not able probably yes I'm a developer so I'm not able but just because my demos is not for that kind of topic it's for something different but when I put on Azure because I want

to show to my uh attendees I want to put uh to to make uh them secure I don't want to spend my my my money because someone else can use uh the authentication the application so I take my application say hey put the ENT ID only for user in my domain in my inter so it's very very easy it's it's perfect cons limited customization the only thing

you can do say I want to um have all my website authenticator or not or some part I want to redirect or uh return HTTP 41 you cannot do anything different of course depend on Azure you can use in Azure app service in Azure uh Azure function app or Azure container uh apps you cannot use on on Prem this is something you have a problem you can

have during a test because you need to create your own middleware to inject in when you make test on your machine to inject the right or fake uh security Fair security erors just to to to test okay it depends on Azure so it is a great limitation and also because depends on Azure maybe a vendor lock in because it works only on Azure okay make sense uh

so we have five minutes so if you have any question first of all this the you can find in the slide my um my references the mail the mail on LinkedIn and if you want we can join uh in LinkedIn if you have any question you can put on the chat and if I have a answer I will answer to you I don't see question while people

think you will also this reference in the slide um the slide contains the sample this is my uh repository with the with the sample and also uh the documentation for scenarios and the app service and aure function and the user authentication authorization means the way you can uh log in directly using the internal uh internal login and point so thank you for the session if you have

any question after the session you can send me in email or using LinkedIn I appreciate your patience uh see you next time I have a question probably let me check no question so have a good day see you next time bye bye-bye [Music]