Automate deployment of AD B2C for use with Function App

Question

Automate deployment of AD B2C for use with Function App

Markus Tacker 21

I've been pulling my hairs out this week writing down the setup guide for an Azure Function App that uses AD B2C authentication.

This is the sad state of affairs right now to get it set up: https://bifravst.gitbook.io/bifravst/bifravst-on-azure-wip/continuousdeployment
... because it cannot be automated.

Yes, AWS Cognito is a beast as well, but at least it can be deployed through code... which makes the whole setup process a one liner with AWS CDK...

Is there by any chance a "Deploy to Azure" button sample of a Function App with AD B2C authentication that I can have a look at? It must be possible to make it simpler ...

Imagine I want to continuously test the solution in blank Azure Accounts to ensure it works and that the configuring the Function App authentication is done properly for new setups.

How do you achieve that?

0 comments

3 answers

Your answer

Answer 1

Markus Tacker 21

I have started to implement end-to-end tests for the solution, where I need to acquire user credentials programmatically to interact with the Function API endpoint programmatically to enable continuous integration of the solution (which is the goal, as mentioned in the initial post).

For that I need to go through yet another manual process to set up programmatic access to AD B2C: https://learn.microsoft.com/en-us/azure/active-directory-b2c/microsoft-graph-get-started?tabs=app-reg-ga

Anonymous

2020-07-15T19:18:21.127+00:00

Probably you can do it once with the Portal, then generate a template to provision via ARM API. For more information on ARM Template please refer this document.
Markus Tacker 21 Reputation points

2020-08-03T14:11:45.277+00:00

No, it is not possible.
Tristan Lymbery@MS 1 Reputation point Microsoft Employee

2020-08-31T01:08:09.303+00:00

You can check here for an Azure Function using MSAL: https://github.com/Azure-Samples/ms-identity-dotnet-webapi-azurefunctions/tree/master/.

You don't generally want to provision new B2C instances on-the-fly - at worse, have one per environment, at best have one for production and 1-2 for 'kitchen sink'. Yes, you will have to manually setup each tenant, but this takes 2 seconds to do and you generally do once.

You can programmatically interface with B2C via the graph API, like you've mentioned. What's the issue there? Again, you do this once and it's done.

For the user credentials, create an 'integration user' or 'test user' and store those credentials in your CI/CD tool of choice. You cannot retrospectively get user credential in plain-text, this is terrible security.
Nick Randolph 6 Reputation points MVP

2020-11-14T21:41:43.053+00:00

@Tristan Lymbery@MS The problem is that there's no way, with either ARM templates or scripts, to automate the deployment of Azure B2C.

This isn't about wanting to standup and teardown instances in an ad-hoc manner, it's about having the entire infrastructure defined in a way that a new instance can be stood up with 0 manual intervention and is 100% reproducible. This is a crucial part of disaster recovery for a site, not to mention ensuring a way for policies etc to be migrated from dev to test to prod etc.

Are you able to provide any solution for automating the deployment of an Azure B2C tenant?

Answer 2

Anonymous

I have attached the documentation on how to configure an Azure function for B2C authentication. This documentation should help you to secure your function app with Azure AD B2C authentication.

Markus Tacker 21 Reputation points

2020-07-03T09:47:29.407+00:00

This is not helpful.

I ask for a way to set up a way that does not involve manually clicking through the Azure Portal.
You provide a solution that asks me to click through the Portal.

Answer 3

Saurabh Sharma 23,866 Microsoft Employee Moderator

@Markus Tacker Unfortunately, I do not see any sample for automatic deployment of Azure AD B2C with Function App. I, however, am checking internally with the products team the possibility of automating this along with public availability of any samples for the same.

0 comments