Calling Azure function using AAD securing client ID and Secret

Question

Calling Azure function using AAD securing client ID and Secret

Rajeev Kumar Dave 21

I want to call the Azure function using AAD from Jquery but for token generation, I need to provide the client Id and secret which I want to secure. How can I secure the client id and secret while calling token generation API?

MayankBargali-MSFT 71,011 Reputation points Moderator

2024-03-27T11:05:05.1633333+00:00

@Rajeev Kumar Dave The query is more towards jquery usage and how to secure Azure AD application secrets in jQuery.

You should not store the secrets in client-side code, as this would expose them to potential attackers. Instead, you should store the secrets securely on the server-side and use server-side code to retrieve them when needed.

One way to achieve this is to use an API endpoint on your server that returns the Azure AD application secret when called or generate the token that can be further used. You can then make an AJAX request to this endpoint from your jQuery code to retrieve the secret. To ensure that only authorized users can access the secret, you should implement authentication and authorization checks on the server-side API endpoint.

In any case, it is important to follow security best practices when handling secrets, such as encrypting them at rest and in transit, and limiting access to only authorized users and applications.

I will suggest you to reach out to stackoverflow for the jquery experts for their input and suggestion.
Rajeev Kumar Dave 21 Reputation points

2024-03-27T12:27:57.2966667+00:00

Thanks !! Can we use key vault for client id and secret.
MayankBargali-MSFT 71,011 Reputation points Moderator

2024-03-28T03:39:37.2733333+00:00

@Rajeev Kumar Dave If you want to use the key vault client id and secret still you can access them through your API endpoint on your server. You cannot use it directly from the jquery call as it will sill expose your client id and secret

1 answer

Your answer

MayankBargali-MSFT 71,011 Reputation points Moderator

2024-03-27T11:05:05.1633333+00:00

@Rajeev Kumar Dave The query is more towards jquery usage and how to secure Azure AD application secrets in jQuery.

You should not store the secrets in client-side code, as this would expose them to potential attackers. Instead, you should store the secrets securely on the server-side and use server-side code to retrieve them when needed.

One way to achieve this is to use an API endpoint on your server that returns the Azure AD application secret when called or generate the token that can be further used. You can then make an AJAX request to this endpoint from your jQuery code to retrieve the secret. To ensure that only authorized users can access the secret, you should implement authentication and authorization checks on the server-side API endpoint.

In any case, it is important to follow security best practices when handling secrets, such as encrypting them at rest and in transit, and limiting access to only authorized users and applications.

I will suggest you to reach out to stackoverflow for the jquery experts for their input and suggestion.
Rajeev Kumar Dave 21 Reputation points

2024-03-27T12:27:57.2966667+00:00

Thanks !! Can we use key vault for client id and secret.
MayankBargali-MSFT 71,011 Reputation points Moderator

2024-03-28T03:39:37.2733333+00:00

@Rajeev Kumar Dave If you want to use the key vault client id and secret still you can access them through your API endpoint on your server. You cannot use it directly from the jquery call as it will sill expose your client id and secret

Answer 1

Deepanshu katara 18,145 MVP Volunteer Moderator

Hi Rajeev, Thanks for reaching to us

Please check my blog related to this situation which involve step by step process to do same https://medium.com/@dkatara.pandit/securing-your-function-app-api-using-aad-88cc14d3c39f

Kindly accept answer if it helps, Thanks!

Rajeev Kumar Dave 21 Reputation points

2024-03-27T10:50:38.3966667+00:00

Hi Deepanshu,

Thanks !!

Look like your article is around old version of Azure. Not able to match anything. Could you please explain more as per current.
Deepanshu katara 18,145 Reputation points MVP Volunteer Moderator

2024-03-27T11:05:46.3933333+00:00
Steps to Secure Azure Functions with Azure AD

In the Azure portal, navigate to your Azure Function App.

In the left-hand menu, click on “Authentication / Authorization”.

Under “Authentication Providers”, click on “Azure Active Directory”.

In the “Azure Active Directory” settings, configure the following options: Management Mode: Select “Express” or “Advanced” depending on your needs. Advanced mode offers more granular control over authentication settings. Action to take when request is not authenticated: Choose the appropriate action when an unauthenticated request is received.

Click on “Save” to enable authentication for your Azure Function App.
Rajeev Kumar Dave 21 Reputation points

2024-03-27T11:38:28.0666667+00:00

Thanks I got this but for the bearer token I need to pass client ID and secret which I do not want to do. Ultimetly I need to save somewhere client ID and secret.
Aminu Abubakar 0 Reputation points

2024-03-27T17:47:20.83+00:00

Yes I understanded

Share via

Calling Azure function using AAD securing client ID and Secret

1 answer

Your answer