Search code examples
azure-active-directoryazure-functionsazure-function-appazure-digital-twins

How to access azure digital twin API using Service Principal?

My use case is whenever i get a trigger from Cosmos DB in Azure functions, need to interact with Azure digital twin APIs without any human interaction.
From the below link, I understood we can use service principal to achieve it.
Is it possible to configure Azure Digital Twins API access for a Daemon App?

But I don't know how to authenticate service principal with digital twin APIs.
1)What type of authentication is required and how the flow will be?
2)If it is Oauth2, what is the grant type and scope for accessing digital twin?

Thanks in advance.

Solution

  • There is an (almost) undocumented way to use the Digital Twins API without an On-Behalf-Of flow. I use it for automated tasks to manipulate the contents of ADT or to give certain applications read-only view of the data. It all starts with a role assignment. See this snippet from the YAML that I use to provision my ADT instance when I first make it.

    - roleId: 98e44ad7-28d4-4007-853b-b9968ad132d1 # Space Administrator
  objectId: abcd1234-5556-44a2-1234-402dbd999619 # Service Principal object ID
  objectIdType: ServicePrincipalId
  tenantId: 1234567-8901-2345-abcd-123456789 # Azure subscription tenant

    The ServicePrincipalId object type is described on this page but is never mentioned in any of the samples again. This snippet gives Space Administrator rights to a service principal. You can then use a client secret to retrieve an access token that will allow you access to ADT. When making an app registration for ADT in your Azure Active Directory, go to Certificates & Secrets and make a new client secret. enter image description here

    The next step is to retrieve the objectId of the Service Principal, this is not the objectId of the application registration. When you go to the Overview tab of your App Registration you can copy the Application ID and perform the following command in the cloud console:

    az ad sp show --id {the id you copied}

    This will show a lot of details about your Service Principal including the objected. Copy this as well. Almost there, to retrieve an Access Token you need 4 things:

    1. Authority: https://login.microsoftonline.com/{your tenant id}
    2. ClientId: The application id of your app registration.
    3. ClientSecret: The client secret you created.
    4. DigitalTwinsAppId: This is always 0b07f429-9f4b-4714-9392-cc5e8e80c8b0

    Retrieving the Access Token in .NET Core

    var authContext = new AuthenticationContext({Authority});
var clientCredential = new ClientCredential({ClientId}, {ClientSecret});
var result = await authContext.AcquireTokenAsync({DigitalTwinsAppId}, clientCredential);
return result.AccessToken;

    Add that to your headers (HttpClient example below) and you are good to go!

    httpClient.DefaultRequestHeaders.Add("Authorization", "Bearer " + accessToken);