RBAC on Azure Cognitive Search with user authentication

Question

RBAC on Azure Cognitive Search with user authentication

Adrien O'Hana 15

I'm building a webapp where users first log-in via the microsoft identity provider, and depending on their assigned "Search Index Contributor" roles they can or can not access some indexes in an azure cognitive search service.

When testing locally, I obtain a credential using the InteractiveBrowserCredential. I then use this credential to access a search service index, if the user has not been given the appropriate role the request return an error, otherwise i can freely search through the index.

This all works perfectly when testing locally. i get the token only once at the start and then can use the credential with azure search python sdk.

credential = InteractiveBrowserCredential()
credential.get_token("https://search.azure.com/.default")

Now I'm deploying this on an azure webapp. Aside from the app registration configurations, redirect link and access token, which i've successfully implemented, how can i convert an access token and expiration date into a credential object that works exactly the same as the interactivebrowsercredential ?

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-11-06T07:24:17.88+00:00
Adrien O'Hana To convert an access token and expiration date into a credential object that works the same as the InteractiveBrowserCredential, you can use the AccessTokenCredential class from the Azure Identity package for Python.

Here's an example of how you can create a credential object using an access token and expiration date:

from azure.core.credentials import AccessTokenCredential from datetime import datetime, timedelta # Replace these values with your access token and expiration date access_token = "" expiration_date = datetime.utcnow() + timedelta(seconds=3600) credential = AccessTokenCredential(access_token, expiration_date)

In this example, we're creating an AccessTokenCredential object using the access token and expiration date. The expiration date is calculated by adding the number of seconds until the token expires (in this case, 3600 seconds or 1 hour) to the current UTC time.

Once you have the credential object, you can use it to authenticate with Azure Cognitive Search in the same way as the InteractiveBrowserCredential.

Let us know.
Adrien O'Hana 15 Reputation points

2023-11-07T16:53:47.7233333+00:00

Thank you for responding. I had already succeeded in generating an AccessToken this way but this is not the same as a credential. I can not find this object you are mentioning ?

ImportError: cannot import name 'AccessTokenCredential' from 'azure.core.credentials' (/Users/......./python3.10/site-packages/azure/core/credentials.py)
SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-11-13T11:12:45.1166667+00:00

@Adrien O'Hana

Could you please reach out to us by sending an email with subject line “Attn:Sneha |thread title” to AzCommunity[at]microsoft[dot]com referencing this thread,

2 answers

Your answer

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-11-06T07:24:17.88+00:00

Adrien O'Hana To convert an access token and expiration date into a credential object that works the same as the InteractiveBrowserCredential, you can use the AccessTokenCredential class from the Azure Identity package for Python.

Here's an example of how you can create a credential object using an access token and expiration date:

from azure.core.credentials import AccessTokenCredential from datetime import datetime, timedelta # Replace these values with your access token and expiration date access_token = "" expiration_date = datetime.utcnow() + timedelta(seconds=3600) credential = AccessTokenCredential(access_token, expiration_date)

In this example, we're creating an AccessTokenCredential object using the access token and expiration date. The expiration date is calculated by adding the number of seconds until the token expires (in this case, 3600 seconds or 1 hour) to the current UTC time.

Once you have the credential object, you can use it to authenticate with Azure Cognitive Search in the same way as the InteractiveBrowserCredential.

Let us know.
Adrien O'Hana 15 Reputation points

2023-11-07T16:53:47.7233333+00:00

Thank you for responding. I had already succeeded in generating an AccessToken this way but this is not the same as a credential. I can not find this object you are mentioning ?

ImportError: cannot import name 'AccessTokenCredential' from 'azure.core.credentials' (/Users/......./python3.10/site-packages/azure/core/credentials.py)
SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-11-13T11:12:45.1166667+00:00

@Adrien O'Hana

Could you please reach out to us by sending an email with subject line “Attn:Sneha |thread title” to AzCommunity[at]microsoft[dot]com referencing this thread,

Answer 1

Adrien O'Hana 15

I finally managed to find a solution.

class SimpleTokenCredential(TokenCredential):
    """Implements a simple token credential for use with Azure SDK clients."""

    def __init__(self, token, expires_on):
        self.token = token
        if isinstance(expires_on, str):
            self.expires_on = (
                datetime.fromisoformat(expires_on.rstrip("Z"))
                .replace(tzinfo=pytz.utc)
                .timestamp()
            )

    def get_token(self, *scopes, **kwargs):
        # Assuming that 'expires_on' is a datetime object representing the expiration time
        expiration_epoch = int(self.expires_on)
        return AccessToken(self.token, expiration_epoch)

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2023-11-20T06:59:00.4233333+00:00

Thanks for sharing the solution that works for you. It will be helpful for other community members having similar issue.

Answer 2

Glad that you were able to resolve your issue and I appreciate your effort in sharing the solution. Your contribution will undoubtedly assist others facing similar challenges. Reposting- Solution-

class SimpleTokenCredential(TokenCredential):
    """Implements a simple token credential for use with Azure SDK clients."""

    def __init__(self, token, expires_on):
        self.token = token
        if isinstance(expires_on, str):
            self.expires_on = (
                datetime.fromisoformat(expires_on.rstrip("Z"))
                .replace(tzinfo=pytz.utc)
                .timestamp()
            )

    def get_token(self, *scopes, **kwargs):
        # Assuming that 'expires_on' is a datetime object representing the expiration time
        expiration_epoch = int(self.expires_on)
        return AccessToken(self.token, expiration_epoch)

As the [Microsoft Q&A community follows a policy where the question author cannot accept their own answer] {https://learn.microsoft.com/en-us/answers/support/accept-answer} , I've reposted your solution. Feel free to consider "Accepting" the answer if you find it suitable.

Share via

RBAC on Azure Cognitive Search with user authentication

2 answers

Your answer