Search code examples
azureazure-web-app-service

Access Azure App Service with Client ID & Secret

I have created an App Service with Microsoft Authentication (Entra ID) in Azure. So while trying to browse the app, I am directly getting this You do not have permission to view this directory or page. Now if I generate OAuth2.0 Token in Postman and access the App, it is working. Now question is -

  1. Is it possible to setup the app service so that it will automatically prompt for login while browsing rather than You do not have permission to view this directory or page?
  2. I am able to create a bearer token from https://login.microsoftonline.com/tenant ID/oauth2/v2.0/token with App Registration Client ID & Secret. Is it possible to access the App Service via this Token without user login like OAuth?
Solution
    1. Is it possible to setup the app service so that it will automatically prompt for login while browsing rather than You do not have permission to view this directory or page?

    Yes, it is possible to set up an automatic login prompt for Azure App Service.

    • By default, Azure App service provides Authorization and Authentication without using any code.
    • It provides a simple, code-free way to authenticate users. It can be enabled via Azure Portal, where we can configure identity providers like Microsoft Entra ID (Azure AD), Facebook, Google, etc.
    • It handles all aspects of login like user prompts, redirection to identity providers, token validation.

    After creating an Azure Web App in Azure, navigate to Settings -> Authentication -> Add Identity Provider.

    enter image description here

    I selected Microsoft as Identity Provider.

    enter image description here

    I Used Workforce configuration for current tenant.

    enter image description here

    In App registration type I selected create new app registration and supported account type is current tenant-single tenant.

    enter image description here

    enter image description here

    After selecting the required fields, I clicked the Add button.

    enter image description here

    It successfully Added the Identity provider to Azure Web app as shown below.

    enter image description here

    After browsing the Azure Web App URL, I was prompted with a page requesting permission for the app registration.

    After Successful login I am redirect to my web page.

    enter image description here

    Is it possible to access the App Service via this Token without user login like OAuth?

    Yes, it is possible to access App service Via Access Token without user Login.

    Thank you @Intelli Tech for clear explanation.

    I added App role to my App registration as shown below.

    enter image description here

    I created New App registration, I added Above App role to Api permissions.

    Go to API permission -> Add a Permission -> My Apis ->Azure web app App registration ->Application permission-> Role -> Add Permission.

    Make sure to Grant Admin Consent for App role.

    enter image description here

    In Postman or VS code thunder client extension I pass the below values to get the Access token.

    In scope Client id should be the Azure web app Client Id.

    Post:https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

grant_type=client_credentials
client_id={client-app-id}
client_secret={client-secret}
scope=api://{AzureWebApp-api-client-id}/.default

    enter image description here

    I used the access token above and was able to authenticate.

    enter image description here