How to authenticate external id users with azure blob storage in another tenant via a server side application

Question

I have a server side application which receives a users access token from a front end application.

Both applications are registered in an azure entra external id tenant. The access tokens are issued using CIAM config from these apps.

I want to be able to authenticate users from the server side application with azure blob storage in another tenant (which i also own).

What is the recommended authentication flow for doing this?

Answer 1

I think

Register service principal in Blob Storage tenant.

1. Permissions: Grant access to storage.
2. Token: Get access token using client credentials flow.
3. Access: Use token to authenticate and access Blob Storage.

Answer 2

Hello ND-4812,

Greetings! Welcome to Microsoft Q&A Platform.

 

To authenticate users from your server-side application with Azure Blob Storage in another tenant using CIAM-configured access tokens, there are different types of authentication processes they are Azure AD B2C (Entra External ID), Azure AD app registrations, and Managed Identity or service principals.

 

Azure AD B2C collects information from a user during registration or profile editing, then hand that data off to an external system via API. Then, during future authentications, Azure AD B2C can retrieve that data from the external system and, if needed, include it as a part of the authentication token response it sends to your application. https://learn.microsoft.com/en-us/azure/active-directory-b2c/overview.

 

Registering Applications in Azure AD B2C (Entra External ID Tenant) from frontend application it is already configured to get the access tokens using CIAM.  Make sure backend application is also registered in the Azure AD B2C tenant. Configure with the necessary API permissions. From frontend application get an access token from Azure AD B2C and sends it to the backend application. The backend application validates the access token to check whether it is authentic and has the necessary permissions. Now connect the Azure AD B2C tenant and the Azure AD tenant where the blob storage will be present, Register and configure the application to accept tokens from your Azure AD B2C tenant. Grant the necessary permissions to the registered application in the Azure AD tenant to access Blob Storage.You require a permission like "Blob Storage Contributor".

 

In the Azure AD tenant, use Managed Identity, Assign the required roles like Storage Blob Data Contributor to the service principal for the Blob Storage.

 

Managed identities provide an automatically managed identity in Microsoft Entra ID for applications to use when connecting to resources that support Microsoft Entra authentication. Applications can use managed identities to obtain Microsoft Entra tokens without having to manage any credentials.

 

Managed Identities will allow to perform different operations Enable or disable managed identities at the resource level. Use role-based access control (RBAC) to grant permissions. View the create, read, update, and delete (CRUD) operations in Azure Activity logs. View sign in activity in Microsoft Entra ID sign in logs. https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview.

 

Then Configure your server-side application to use the client credentials to obtain an access token from the Azure AD tenant where Blob Storage is present.

 

A similar issue is discussed in the Answer section of the following SO thread: https://stackoverflow.com/questions/63206596/authenticate-to-blobserviceclient-using-clientsecretcredential-in-a-native-app

 

Here is the doc for your reference: https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory

 

 

Hope this answer helps! please let us know if you have any further queries. I’m happy to assist you further.

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.