Validating Access Tokens in Azure Functions using .NET 8 (Isolated Mode) and OpenID Connect (2024)

Abstract: In this article, we will explore how to validate access tokens received in the headers of every request in an Azure Function using .NET 8 and OpenID Connect in Isolated Mode.

2024-06-19 by Try Catch Debug

Introduction

In this article, we will explore how to validate access tokens in Azure Functions using .NET 8 (Isolated Mode) with OpenID Connect. We will cover key concepts, subtitles, and provide detailed context on the topic. By the end of this article, you will have a solid understanding of how to implement this functionality in your own projects.

What are Access Tokens?

Access tokens are security credentials that allow clients to access protected resources on a server. They are issued by an authorization server, such as Azure Active Directory (AAD), after a successful authentication request. Access tokens are typically short-lived and must be periodically refreshed.

What is OpenID Connect?

OpenID Connect is a simple identity layer on top of the OAuth 2.0 protocol. It allows clients to verify the identity of the end-user based on the authentication performed by an authorization server. OpenID Connect is widely used in web and mobile applications for user authentication and authorization.

Validating Access Tokens in Azure Functions

Azure Functions are serverless compute services that allow you to run code in response to events. In this section, we will explore how to validate access tokens in Azure Functions using .NET 8 (Isolated Mode) with OpenID Connect.

Creating an Azure Function

To create an Azure Function, you can use the Azure Functions Core Tools. First, install the tools using the following command:

npm install -g azure-functions-core-tools@4

Next, create a new function using the following command:

func init MyFunctionProj --worker-runtime dotnet-isolated

This will create a new Azure Functions project using the .NET 8 (Isolated Mode) worker runtime.

Installing NuGet Packages

To validate access tokens in Azure Functions, you will need to install the following NuGet packages:

Microsoft.AspNetCore.Authentication.OpenIdConnect
Microsoft.AspNetCore.Authorization
Microsoft.Identity.Web

You can install these packages using the following commands:

dotnet add package Microsoft.AspNetCore.Authentication.OpenIdConnectdotnet add package Microsoft.AspNetCore.Authorizationdotnet add package Microsoft.Identity.Web

Configuring OpenID Connect

To configure OpenID Connect, you will need to create an OpenIdConnectOptions object. This object contains the configuration settings for the OpenID Connect middleware.

Here is an example of how to create an OpenIdConnectOptions object:

var openIdConnectOptions = new OpenIdConnectOptions{ Authority = $"https://login.microsoftonline.com/{configuration["AzureAd:TenantId"]}", ClientId = configuration["AzureAd:ClientId"], ClientSecret = configuration["AzureAd:ClientSecret"], ResponseType = OpenIdConnectResponseType.Code, Scope = new List<string> { "openid", "profile", "email" }, GetClaimsFromUserInfoEndpoint = true, SaveTokens = true, TokenValidationParameters = new TokenValidationParameters { NameClaimType = "name", RoleClaimType = "roles" }};

In this example, we are configuring the OpenID Connect middleware to use Azure Active Directory as the authorization server. We are also specifying the client ID and client secret, as well as the scopes and response type.

Configuring Authorization

To configure authorization, you will need to create an AuthorizationOptions object. This object contains the configuration settings for the authorization middleware.

Here is an example of how to create an AuthorizationOptions object:

var authorizationOptions = new AuthorizationOptions{ DefaultPolicy = new AuthorizationPolicyBuilder() .RequireAuthenticatedUser() .Build()};

In this example, we are configuring the authorization middleware to require an authenticated user.

Validating Access Tokens

To validate access tokens, you will need to create an OpenIdConnectHandler object. This object contains the logic for validating access tokens.

Here is an example of how to create an OpenIdConnectHandler object:

var openIdConnectHandler = new OpenIdConnectHandler();await openIdConnectHandler.InitializeAsync(request);await openIdConnectHandler.ValidateTokenReceptionAsync(request);await openIdConnectHandler.HandleRemoteAuthenticateAsync(request);await openIdConnectHandler.HandleAuthenticationAsync();

In this example, we are initializing the OpenIdConnectHandler object, validating the token reception, handling remote authentication, and handling authentication.

Implementing the Function

To implement the function, you can use the following code:

public static async Task<IActionResult> Run( [HttpTrigger(AuthorizationLevel.Function, "get", Route = null)] HttpRequestData req, FunctionContext executionContext){ var claimsPrincipal = executionContext.GetHttpContext().User; if (!claimsPrincipal.Identity.IsAuthenticated) { return new UnauthorizedResult(); } var name = claimsPrincipal.FindFirst(ClaimTypes.Name)?.Value; var email = claimsPrincipal.FindFirst(ClaimTypes.Email)?.Value; return new OkObjectResult(new { Name = name, Email = email });}

In this example, we are checking if the user is authenticated. If the user is not authenticated, we return a 401 Unauthorized response. If the user is authenticated, we retrieve the name and email from the claims principal and return a 200 OK response.

Conclusion

In this article, we have explored how to validate access tokens in Azure Functions using .NET 8 (Isolated Mode) with OpenID Connect. We have covered key concepts, such as access tokens and OpenID Connect, and provided detailed context on the topic. We have also provided code examples for creating an Azure Function, configuring OpenID Connect and authorization, validating access tokens, and implementing the function.

References

Learn how to secure your Azure Functions by validating access tokens in each request with .NET 8 and OpenID Connect. Read the full article for a step-by-step guide.

Extending a Type in GraphQL/Apollo Federation: Syntax and Example
In this article, we'll discuss how to extend an existing type in a GraphQL schema using Apollo Federation and provide an example using C#.
Turning on Error Background Highlight in Visual Studio Code: A Solution
In this article, we will discuss how to enable error background highlighting in Visual Studio Code, which can help developers identify and address issues more efficiently.
Getting Started with VSC and Wix Website: Adding Custom Code Sections
Learn how to add custom code sections to your Wix website using Visual Studio Code and a server URL.