How to implement silent login/authorization/authentication REST calls for testing azure functions in Github deployment workflow?

Question

I am working on a github workflow deployment script for the azure functions described here: https://learn.microsoft.com/en-us/azure/api-management/howto-protect-backend-frontend-azure-ad-b2c

In addition to Azure Active Directory (AAD) Authentication, I'm implementing authorization with an AAD extension attribute (or JWT claim).

I need some guidance on how to add an automated REST call to test to my deployment script.

To test that the deployment was successful, I want my github workflow to login to my front end application registration, fetch an access (or bearer) token and make REST calls to my azure functions (via my Azure API Mgt). I also want to do this several times with different accounts (that have different claims) to confirm that authorization is working.

Questions:

1. I started to follow this example (https://blog.simonw.se/getting-an-access-token-for-azuread-using-powershell-and-device-login-flow/) but realized that the browser popup would not be compatible with a github workflow. How can my script login in and silently get a bearer token to make the REST call to my azure function? Please point me to an example that specifies the user name & password (via github secrets, of course), silently fetches the bearer token and makes an authenticated REST call using powershell or azure cli.
2. What is your favorite testing framework for github deployment scripts? I found Pester (https://techcommunity.microsoft.com/t5/azure-developer-community-blog/test-your-powershell-code-with-pester/ba-p/2835759) , maybe I'll give it a try. Do you have a testing framework you like better?
3. Normally I do az ad sp create-for-rbac --name $sp --sdk-auth --role contributor --scopes $id` and store the resulting JSON in the github repository secret calls AZURE_CREDENTIALS. Is the role of contributor going to be sufficient for impersonating a user that logs in?

Thanks again!

Siegfried

Answer 1

Siegfried Heintze Thanks for posting your question in Microsoft Q&A. I assume you are using GitHub Actions for Azure to create workflows for your deployment to Azure. From the description above, you are looking to generate access token in the workflow and make a call to Azure APIM (Azure Function as backend API).

Let me start with the part - 1 (generating access token)

Using Azure login action, you can achieve this with two different ways:

1. Service Principal with secrets
2. Connect OpenID Connect with Azure Service Principal using a Federated Identity Credential

Here is doc: Use GitHub Actions to connect to Azure with detailed step by step guide and also, https://github.com/marketplace/actions/azure-login has more info on this scenario. Make sure that you specify optional audience parameter as APIM when generating the token (so that it rightly validates in APIM via validate-jwt policy).

part -2 (make REST API call)

You can make a rest API call to API Management from Azure CLI action with inline script or explore HTTP Request Action if it fits your scenario with generated access token.

To answer your questions (in the order)

1. The device login flow cannot be used in your scenario and client credential flow is the best option for web application/non-interactive scenario as described in the doc.
2. Not really an expert in GitHub actions or related testing framework. I suggest you explore https://docs.github.com/en/actions/automating-builds-and-tests/about-continuous-integration or https://github.com/orgs/community/discussions and community experts can help in answering this.
3. The role contributor should be sufficient, and you can add --json-auth parameter as described in the doc: Configure a service principal with a secret or pass as individual parameters to address security concerns (the same has been described in the referenced doc).

I hope this helps and let me know if you have any questions.