How to securely connect to a Function App without AAD Authentication

Question

Hello,

We have an on-premise application that is installed by many of our customers on their own hardware.

We're moving functionality from our on-premise application into Azure. We're currently re-coding this functionality in function apps in Azure. We are looking for the best approach to securely calling the function app without users having to sign in with AAD to obtain a token(as not all our clients are on AAD) and without having to rely on holding a function key on-premise within the database as we feel these would need to be cycled frequently for security. Is there a better way of securely calling the function app from an on-premise application?

Alex

Answer 1

Hello @Alex Curtis Sorry for the late answer. I think that the authentication options & their security strengths will vary depending on how much you can leverage from the existing system you have for the on-prem users. You mentioned that the users have to install an on-prem application in order to be able to connect to the Function Apps -- are they on-prem local network and have to connect via VPN? If so, there are opportunities to leverage plenty of networking features to strengthen the security of your Function App and I highly recommend this option if possible.

If network security options aren't possible, and it's more like any user who installs the application needs to be able to call Function App wherever they are (from the public internet), you might consider exploring certificate authentication next. This option is machine-based and requires your users to install an X509 certificate on their machine. And when users attempt to call Function Apps, the certificate is included in their HTTP request and Azure App Service will perform authentication accordingly. Be aware that any machine that possesses a valid certificate will be able to call your Function App.

Another option is to secure your Function App with API Management (short for APIM) such that only requests from APIM are allowed to call your Function Apps. The requests made by users on-prem will have to pass through APIM during which the APIM will have to perform authentication. The APIM supports many different authentication options with most lose ones being Subscription Key based ones as well as Basic Auth.

Lastly, another thing to note here is that both Function App and APIM can be containerized and can run in an on-prem environment (or anywhere you can run containers). This feature can be instrumental in some situations when putting together on-prem-to-cloud workflows/architectures.

If any of the options above resonate better with what you're trying to accomplish and if you're interested in getting more details, just let me know and I'd be happy to provide more resources.