From 81bc3819a58a675ccc0dcd8806829a78ba628ab5 Mon Sep 17 00:00:00 2001 From: Erich Wang Date: Wed, 9 Mar 2022 17:49:55 +0800 Subject: [PATCH 1/3] Update auth config to use the same auth config in App Service --- .../2022-01-01-preview/AuthConfigs.json | 623 +++++++++++------- .../examples/AuthConfigs_CreateOrUpdate.json | 12 +- .../examples/AuthConfigs_Get.json | 6 +- .../examples/AuthConfigs_ListByContainer.json | 6 +- specification/app/resource-manager/readme.md | 6 + 5 files changed, 425 insertions(+), 228 deletions(-) diff --git a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json index 669a4ec025db..6421aee687f8 100644 --- a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json +++ b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json @@ -232,8 +232,29 @@ } }, "definitions": { + "AuthConfigCollection": { + "description": "AuthConfig collection ARM resource.", + "required": [ + "value" + ], + "type": "object", + "properties": { + "value": { + "description": "Collection of resources.", + "type": "array", + "items": { + "$ref": "#/definitions/AuthConfig" + } + }, + "nextLink": { + "description": "Link to next page of resources.", + "type": "string", + "readOnly": true + } + } + }, "AuthConfig": { - "description": "Configuration settings for the Azure ContainerApp Authentication / Authorization feature.", + "description": "Configuration settings for the Azure ContainerApp Service Authentication / Authorization feature.", "type": "object", "allOf": [ { @@ -242,44 +263,54 @@ ], "properties": { "properties": { - "description": "Auth configuration resource specific properties", + "description": "AuthConfig resource specific properties", "type": "object", "properties": { - "state": { - "description": "Enabled if the Authentication / Authorization feature is enabled for the current app; otherwise, Disabled.", - "type": "string", - "enum": [ - "Enabled", - "Disabled" - ], - "x-ms-enum": { - "name": "AuthConfigState", - "modelAsString": true - } + "platform": { + "$ref": "#/definitions/AuthPlatform", + "description": "The configuration settings of the platform of Containerapp Service Authentication/Authorization." }, "globalValidation": { "$ref": "#/definitions/GlobalValidation", - "description": "The configuration settings that determines the validation flow of users using ContainerApp Authentication/Authorization." + "description": "The configuration settings that determines the validation flow of users using Containerapp Service Authentication/Authorization." }, "identityProviders": { "$ref": "#/definitions/IdentityProviders", - "description": "The configuration settings of each of the identity providers used to configure ContainerApp Authentication/Authorization." + "description": "The configuration settings of each of the identity providers used to configure Containerapp Service Authentication/Authorization." }, "login": { "$ref": "#/definitions/Login", - "description": "The configuration settings of the login flow of users using ContainerApp Authentication/Authorization." + "description": "The configuration settings of the login flow of users using Containerapp Service Authentication/Authorization." }, "httpSettings": { "$ref": "#/definitions/HttpSettings", - "description": "The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Authentication/Authorization." + "description": "The configuration settings of the HTTP requests for authentication and authorization requests made against Containerapp Service Authentication/Authorization." } }, "x-ms-client-flatten": true } } }, + "AuthPlatform": { + "description": "The configuration settings of the platform of Containerapp Service Authentication/Authorization.", + "type": "object", + "properties": { + "enabled": { + "description": "true if the Authentication / Authorization feature is enabled for the current app; otherwise, false.", + "type": "boolean" + }, + "runtimeVersion": { + "description": "The RuntimeVersion of the Authentication / Authorization feature in use for the current app.\nThe setting in this value can control the behavior of certain features in the Authentication / Authorization module.", + "type": "string" + }, + "configFilePath": { + "description": "The path of the config file containing auth settings if they come from a file.\nIf the path is relative, base will the site's root directory.", + "type": "string" + } + } + }, "GlobalValidation": { - "description": "The configuration settings that determines the validation flow of users using ContainerApp Authentication/Authorization.", + "description": "The configuration settings that determines the validation flow of users using Containerapp Service Authentication/Authorization.", "type": "object", "properties": { "unauthenticatedClientAction": { @@ -292,47 +323,113 @@ ], "type": "string", "x-ms-enum": { - "name": "UnauthenticatedClientAction", - "modelAsString": true + "name": "UnauthenticatedClientActionV2", + "modelAsString": false } }, "redirectToProvider": { "description": "The default authentication provider to use when multiple providers are configured.\nThis setting is only needed if multiple providers are configured and the unauthenticated client\naction is set to \"RedirectToLoginPage\".", "type": "string" + }, + "excludedPaths": { + "description": "The paths for which unauthenticated flow would not be redirected to the login page.", + "type": "array", + "items": { + "type": "string" + } } } }, - "Login": { - "description": "The configuration settings of the login flow of users using ContainerApp Authentication/Authorization.", + "HttpSettings": { + "description": "The configuration settings of the HTTP requests for authentication and authorization requests made against Containerapp Service Authentication/Authorization.", "type": "object", "properties": { - "route": { - "$ref": "#/definitions/LoginRoute", - "description": "The route that specify the endpoint used for login and logout requests." + "requireHttps": { + "description": "false if the authentication/authorization responses not having the HTTPS scheme are permissible; otherwise, true.", + "type": "boolean" }, - "preserveUrlFragmentsForLogins": { - "description": "True if the fragments from the request are preserved after the login request is made; otherwise, False.", - "type": "string", + "routes": { + "$ref": "#/definitions/HttpSettingsRoutes", + "description": "The configuration settings of the paths HTTP requests." + }, + "forwardProxy": { + "$ref": "#/definitions/ForwardProxy", + "description": "The configuration settings of a forward proxy used to make the requests." + } + } + }, + "HttpSettingsRoutes": { + "description": "The configuration settings of the paths HTTP requests.", + "type": "object", + "properties": { + "apiPrefix": { + "description": "The prefix that should precede all the authentication/authorization paths.", + "type": "string" + } + } + }, + "ForwardProxy": { + "description": "The configuration settings of a forward proxy used to make the requests.", + "type": "object", + "properties": { + "convention": { + "description": "The convention used to determine the url of the request made.", "enum": [ - "True", - "False" + "NoProxy", + "Standard", + "Custom" ], + "type": "string", "x-ms-enum": { - "name": "PreserveUrlFragmentsForLoginsMode", - "modelAsString": true + "name": "ForwardProxyConvention", + "modelAsString": false } }, + "customHostHeaderName": { + "description": "The name of the header containing the host of the request.", + "type": "string" + }, + "customProtoHeaderName": { + "description": "The name of the header containing the scheme of the request.", + "type": "string" + } + } + }, + "Login": { + "description": "The configuration settings of the login flow of users using Containerapp Service Authentication/Authorization.", + "type": "object", + "properties": { + "routes": { + "$ref": "#/definitions/LoginRoutes", + "description": "The routes that specify the endpoints used for login and logout requests." + }, + "tokenStore": { + "$ref": "#/definitions/TokenStore", + "description": "The configuration settings of the token store." + }, + "preserveUrlFragmentsForLogins": { + "description": "true if the fragments from the request are preserved after the login request is made; otherwise, false.", + "type": "boolean" + }, "allowedExternalRedirectUrls": { "description": "External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored.\nThis is an advanced setting typically only needed by Windows Store application backends.\nNote that URLs within the current domain are always implicitly allowed.", "type": "array", "items": { "type": "string" } + }, + "cookieExpiration": { + "$ref": "#/definitions/CookieExpiration", + "description": "The configuration settings of the session cookie's expiration." + }, + "nonce": { + "$ref": "#/definitions/Nonce", + "description": "The configuration settings of the nonce used in the login flow." } } }, - "LoginRoute": { - "description": "The route that specify the endpoint used for login and logout requests.", + "LoginRoutes": { + "description": "The routes that specify the endpoints used for login and logout requests.", "type": "object", "properties": { "logoutEndpoint": { @@ -341,40 +438,87 @@ } } }, - "HttpSettings": { - "description": "The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Authentication/Authorization.", + "TokenStore": { + "description": "The configuration settings of the token store.", "type": "object", "properties": { - "requireHttps": { - "description": "false if the authentication/authorization responses not having the HTTPS scheme are permissible; otherwise, true.", - "type": "string", + "enabled": { + "description": "true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false.\n The default is false.", + "type": "boolean" + }, + "tokenRefreshExtensionHours": { + "format": "double", + "description": "The number of hours after session token expiration that a session token can be used to\ncall the token refresh API. The default is 72 hours.", + "type": "number" + }, + "fileSystem": { + "$ref": "#/definitions/FileSystemTokenStore", + "description": "The configuration settings of the storage of the tokens if a file system is used." + }, + "azureBlobStorage": { + "$ref": "#/definitions/BlobStorageTokenStore", + "description": "The configuration settings of the storage of the tokens if blob storage is used." + } + } + }, + "FileSystemTokenStore": { + "description": "The configuration settings of the storage of the tokens if a file system is used.", + "type": "object", + "properties": { + "directory": { + "description": "The directory in which the tokens will be stored.", + "type": "string" + } + } + }, + "BlobStorageTokenStore": { + "description": "The configuration settings of the storage of the tokens if blob storage is used.", + "type": "object", + "properties": { + "sasUrlSettingName": { + "description": "The name of the app setting containing the SAS URL of the blob storage containing the tokens.", + "type": "string" + } + } + }, + "CookieExpiration": { + "description": "The configuration settings of the session cookie's expiration.", + "type": "object", + "properties": { + "convention": { + "description": "The convention used when determining the session cookie's expiration.", "enum": [ - "True", - "False" + "FixedTime", + "IdentityProviderDerived" ], + "type": "string", "x-ms-enum": { - "name": "RequireHttpsMode", - "modelAsString": true + "name": "CookieExpirationConvention", + "modelAsString": false } }, - "route": { - "$ref": "#/definitions/HttpSettingsRoute", - "description": "The configuration settings of the paths HTTP requests." + "timeToExpiration": { + "description": "The time after the request is made when the session cookie should expire.", + "type": "string" } } }, - "HttpSettingsRoute": { - "description": "The configuration settings of the paths HTTP requests.", + "Nonce": { + "description": "The configuration settings of the nonce used in the login flow.", "type": "object", "properties": { - "apiPrefix": { - "description": "The prefix that should precede all the authentication/authorization paths.", + "validateNonce": { + "description": "false if the nonce should not be validated while completing the login flow; otherwise, true.", + "type": "boolean" + }, + "nonceExpirationInterval": { + "description": "The time after the request is made when the nonce should expire.", "type": "string" } } }, "IdentityProviders": { - "description": "The configuration settings of each of the identity providers used to configure ContainerApp Authentication/Authorization.", + "description": "The configuration settings of each of the identity providers used to configure Containerapp Service Authentication/Authorization.", "type": "object", "properties": { "azureActiveDirectory": { @@ -401,8 +545,8 @@ "$ref": "#/definitions/Apple", "description": "The configuration settings of the Apple provider." }, - "azureStaticWebApp": { - "$ref": "#/definitions/AzureStaticWebApp", + "azureStaticWebApps": { + "$ref": "#/definitions/AzureStaticWebApps", "description": "The configuration settings of the Azure Static Web Apps provider." }, "customOpenIdConnectProviders": { @@ -414,114 +558,46 @@ } } }, - "CustomOpenIdConnectProvider": { - "description": "The configuration settings of the custom Open ID Connect provider.", + "AzureActiveDirectory": { + "description": "The configuration settings of the Azure Active directory provider.", "type": "object", "properties": { - "state": { - "$ref": "#/definitions/IdentityProviderState", - "description": "Disabled if the custom Open ID Connect provider should not be enabled despite the set registration; otherwise, Enabled." + "enabled": { + "description": "false if the Azure Active Directory provider should not be enabled despite the set registration; otherwise, true.", + "type": "boolean" }, "registration": { - "$ref": "#/definitions/OpenIdConnectRegistration", - "description": "The configuration settings of the app registration for the custom Open ID Connect provider." + "$ref": "#/definitions/AzureActiveDirectoryRegistration", + "description": "The configuration settings of the Azure Active Directory app registration." }, "login": { - "$ref": "#/definitions/OpenIdConnectLogin", - "description": "The configuration settings of the login flow of the custom Open ID Connect provider." - } - } - }, - "OpenIdConnectRegistration": { - "description": "The configuration settings of the app registration for the custom Open ID Connect provider.", - "type": "object", - "properties": { - "clientId": { - "description": "The client id of the custom Open ID Connect provider.", - "type": "string" - }, - "clientCredential": { - "$ref": "#/definitions/OpenIdConnectClientCredential", - "description": "The authentication credentials of the custom Open ID Connect provider." - }, - "openIdConnectConfiguration": { - "$ref": "#/definitions/OpenIdConnectConfig", - "description": "The configuration settings of the endpoints used for the custom Open ID Connect provider." - } - } - }, - "OpenIdConnectClientCredential": { - "description": "The authentication client credentials of the custom Open ID Connect provider.", - "type": "object", - "properties": { - "clientSecretRefName": { - "description": "The app setting that contains the client secret for the custom Open ID Connect provider.", - "type": "string" - } - } - }, - "OpenIdConnectConfig": { - "description": "The configuration settings of the endpoints used for the custom Open ID Connect provider.", - "type": "object", - "properties": { - "authorizationEndpoint": { - "description": "The endpoint to be used to make an authorization request.", - "type": "string" - }, - "tokenEndpoint": { - "description": "The endpoint to be used to request a token.", - "type": "string" - }, - "issuer": { - "description": "The endpoint that issues the token.", - "type": "string" + "$ref": "#/definitions/AzureActiveDirectoryLogin", + "description": "The configuration settings of the Azure Active Directory login flow." }, - "certificationUri": { - "description": "The endpoint that provides the keys necessary to validate the token.", - "type": "string" + "validation": { + "$ref": "#/definitions/AzureActiveDirectoryValidation", + "description": "The configuration settings of the Azure Active Directory token validation flow." }, - "wellKnownOpenIdConfiguration": { - "description": "The endpoint that contains all the configuration endpoints for the provider.", - "type": "string" + "isAutoProvisioned": { + "description": "Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling.\nThis is an internal flag primarily intended to support the Azure Management Portal. Users should not\nread or write to this property.", + "type": "boolean" } } }, - "OpenIdConnectLogin": { - "description": "The configuration settings of the login flow of the custom Open ID Connect provider.", + "AzureActiveDirectoryLogin": { + "description": "The configuration settings of the Azure Active Directory login flow.", "type": "object", "properties": { - "nameClaimType": { - "description": "The name of the claim that contains the users name.", - "type": "string" - }, - "scopes": { - "description": "A list of the scopes that should be requested while authenticating.", + "loginParameters": { + "description": "Login parameters to send to the OpenID Connect authorization endpoint when\na user logs in. Each parameter must be in the form \"key=value\".", "type": "array", "items": { "type": "string" } - } - } - }, - "AzureActiveDirectory": { - "description": "The configuration settings of the Azure Active directory provider.", - "type": "object", - "properties": { - "state": { - "$ref": "#/definitions/IdentityProviderState", - "description": "Disabled if the Azure Active Directory provider should not be enabled despite the set registration; otherwise, Enabled." - }, - "registration": { - "$ref": "#/definitions/AzureActiveDirectoryRegistration", - "description": "The configuration settings of the Azure Active Directory app registration." }, - "login": { - "$ref": "#/definitions/AzureActiveDirectoryLogin", - "description": "The configuration settings of the Azure Active Directory login flow." - }, - "validation": { - "$ref": "#/definitions/AzureActiveDirectoryValidation", - "description": "The configuration settings of the Azure Active Directory token validation flow." + "disableWWWAuthenticate": { + "description": "true if the www-authenticate provider should be omitted from the request; otherwise, false.", + "type": "boolean" } } }, @@ -537,8 +613,8 @@ "description": "The Client ID of this relying party application, known as the client_id.\nThis setting is required for enabling OpenID Connection authentication with Azure Active Directory or \nother 3rd party OpenID Connect providers.\nMore information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html", "type": "string" }, - "clientSecretRefName": { - "description": "The app secret ref name that contains the client secret of the relying party application.", + "clientSecretSettingName": { + "description": "The app setting name that contains the client secret of the relying party application.", "type": "string" }, "clientSecretCertificateThumbprint": { @@ -555,37 +631,77 @@ } } }, - "AzureActiveDirectoryLogin": { - "description": "The configuration settings of the Azure Active Directory login flow.", + "AzureActiveDirectoryValidation": { + "description": "The configuration settings of the Azure Active Directory token validation flow.", "type": "object", "properties": { - "loginParameters": { - "description": "Login parameters to send to the OpenID Connect authorization endpoint when\na user logs in. Each parameter must be in the form \"key=value\".", + "jwtClaimChecks": { + "$ref": "#/definitions/JwtClaimChecks", + "description": "The configuration settings of the checks that should be made while validating the JWT Claims." + }, + "allowedAudiences": { + "description": "The list of audiences that can make successful authentication/authorization requests.", "type": "array", "items": { "type": "string" } }, - "disableWwwAuthenticate": { - "description": "true if the www-authenticate provider should be omitted from the request; otherwise, false.", - "type": "string", - "enum": [ - "True", - "False" - ], - "x-ms-enum": { - "name": "DisableWwwAuthenticateMode", - "modelAsString": true + "defaultAuthorizationPolicy": { + "$ref": "#/definitions/DefaultAuthorizationPolicy", + "description": "The configuration settings of the default authorization policy." + } + } + }, + "JwtClaimChecks": { + "description": "The configuration settings of the checks that should be made while validating the JWT Claims.", + "type": "object", + "properties": { + "allowedGroups": { + "description": "The list of the allowed groups.", + "type": "array", + "items": { + "type": "string" + } + }, + "allowedClientApplications": { + "description": "The list of the allowed client applications.", + "type": "array", + "items": { + "type": "string" } } } }, - "AzureActiveDirectoryValidation": { - "description": "The configuration settings of the Azure Active Directory token validation flow.", + "DefaultAuthorizationPolicy": { + "description": "The configuration settings of the Azure Active Directory default authorization policy.", "type": "object", "properties": { - "allowedAudiences": { - "description": "The list of audiences that can make successful authentication/authorization requests.", + "allowedPrincipals": { + "$ref": "#/definitions/AllowedPrincipals", + "description": "The configuration settings of the Azure Active Directory allowed principals." + }, + "allowedApplications": { + "description": "The configuration settings of the Azure Active Directory allowed applications.", + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "AllowedPrincipals": { + "description": "The configuration settings of the Azure Active Directory allowed principals.", + "type": "object", + "properties": { + "groups": { + "description": "The list of the allowed groups.", + "type": "array", + "items": { + "type": "string" + } + }, + "identities": { + "description": "The list of the allowed identities.", "type": "array", "items": { "type": "string" @@ -597,9 +713,9 @@ "description": "The configuration settings of the Facebook provider.", "type": "object", "properties": { - "state": { - "$ref": "#/definitions/IdentityProviderState", - "description": "Disabled if the Facebook provider should not be enabled despite the set registration; otherwise, Enabled." + "enabled": { + "description": "false if the Facebook provider should not be enabled despite the set registration; otherwise, true.", + "type": "boolean" }, "registration": { "$ref": "#/definitions/AppRegistration", @@ -623,8 +739,8 @@ "description": "The App ID of the app used for login.", "type": "string" }, - "appSecretRefName": { - "description": "The app secret ref name that contains the app secret.", + "appSecretSettingName": { + "description": "The app setting name that contains the app secret.", "type": "string" } } @@ -646,9 +762,9 @@ "description": "The configuration settings of the GitHub provider.", "type": "object", "properties": { - "state": { - "$ref": "#/definitions/IdentityProviderState", - "description": "Disabled if the GitHub provider should not be enabled despite the set registration; otherwise, Enabled." + "enabled": { + "description": "false if the GitHub provider should not be enabled despite the set registration; otherwise, true.", + "type": "boolean" }, "registration": { "$ref": "#/definitions/ClientRegistration", @@ -668,8 +784,8 @@ "description": "The Client ID of the app used for login.", "type": "string" }, - "clientSecretRefName": { - "description": "The app secret ref name that contains the client secret.", + "clientSecretSettingName": { + "description": "The app setting name that contains the client secret.", "type": "string" } } @@ -678,9 +794,9 @@ "description": "The configuration settings of the Google provider.", "type": "object", "properties": { - "state": { - "$ref": "#/definitions/IdentityProviderState", - "description": "Disabled if the Google provider should not be enabled despite the set registration; otherwise, Enabled." + "enabled": { + "description": "false if the Google provider should not be enabled despite the set registration; otherwise, true.", + "type": "boolean" }, "registration": { "$ref": "#/definitions/ClientRegistration", @@ -713,9 +829,9 @@ "description": "The configuration settings of the Twitter provider.", "type": "object", "properties": { - "state": { - "$ref": "#/definitions/IdentityProviderState", - "description": "Disabled if the Twitter provider should not be enabled despite the set registration; otherwise, Enabled." + "enabled": { + "description": "false if the Twitter provider should not be enabled despite the set registration; otherwise, true.", + "type": "boolean" }, "registration": { "$ref": "#/definitions/TwitterRegistration", @@ -731,8 +847,8 @@ "description": "The OAuth 1.0a consumer key of the Twitter application used for sign-in.\nThis setting is required for enabling Twitter Sign-In.\nTwitter Sign-In documentation: https://dev.twitter.com/web/sign-in", "type": "string" }, - "consumerSecretRefName": { - "description": "The app secret ref name that contains the OAuth 1.0a consumer secret of the Twitter\napplication used for sign-in.", + "consumerSecretSettingName": { + "description": "The app setting name that contains the OAuth 1.0a consumer secret of the Twitter\napplication used for sign-in.", "type": "string" } } @@ -741,9 +857,9 @@ "description": "The configuration settings of the Apple provider.", "type": "object", "properties": { - "state": { - "$ref": "#/definitions/IdentityProviderState", - "description": "Disabled if the Apple provider should not be enabled despite the set registration; otherwise, Enabled." + "enabled": { + "description": "false if the Apple provider should not be enabled despite the set registration; otherwise, true.", + "type": "boolean" }, "registration": { "$ref": "#/definitions/AppleRegistration", @@ -755,21 +871,35 @@ } } }, - "AzureStaticWebApp": { + "AppleRegistration": { + "description": "The configuration settings of the registration for the Apple provider", + "type": "object", + "properties": { + "clientId": { + "description": "The Client ID of the app used for login.", + "type": "string" + }, + "clientSecretSettingName": { + "description": "The app setting name that contains the client secret.", + "type": "string" + } + } + }, + "AzureStaticWebApps": { "description": "The configuration settings of the Azure Static Web Apps provider.", "type": "object", "properties": { - "state": { - "$ref": "#/definitions/IdentityProviderState", - "description": "Disabled if the Azure Static Web Apps provider should not be enabled despite the set registration; otherwise, Enabled." + "enabled": { + "description": "false if the Azure Static Web Apps provider should not be enabled despite the set registration; otherwise, true.", + "type": "boolean" }, "registration": { - "$ref": "#/definitions/AzureStaticWebAppRegistration", + "$ref": "#/definitions/AzureStaticWebAppsRegistration", "description": "The configuration settings of the Azure Static Web Apps registration." } } }, - "AzureStaticWebAppRegistration": { + "AzureStaticWebAppsRegistration": { "description": "The configuration settings of the registration for the Azure Static Web Apps provider", "type": "object", "properties": { @@ -779,52 +909,105 @@ } } }, - "AppleRegistration": { - "description": "The configuration settings of the registration for the Apple provider", + "CustomOpenIdConnectProvider": { + "description": "The configuration settings of the custom Open ID Connect provider.", + "type": "object", + "properties": { + "enabled": { + "description": "false if the custom Open ID provider provider should not be enabled; otherwise, true.", + "type": "boolean" + }, + "registration": { + "$ref": "#/definitions/OpenIdConnectRegistration", + "description": "The configuration settings of the app registration for the custom Open ID Connect provider." + }, + "login": { + "$ref": "#/definitions/OpenIdConnectLogin", + "description": "The configuration settings of the login flow of the custom Open ID Connect provider." + } + } + }, + "OpenIdConnectRegistration": { + "description": "The configuration settings of the app registration for the custom Open ID Connect provider.", "type": "object", "properties": { "clientId": { - "description": "The Client ID of the app used for login.", + "description": "The client id of the custom Open ID Connect provider.", "type": "string" }, - "clientSecretRefName": { - "description": "The app secret ref name that contains the client secret.", + "clientCredential": { + "$ref": "#/definitions/OpenIdConnectClientCredential", + "description": "The authentication credentials of the custom Open ID Connect provider." + }, + "openIdConnectConfiguration": { + "$ref": "#/definitions/OpenIdConnectConfig", + "description": "The configuration settings of the endpoints used for the custom Open ID Connect provider." + } + } + }, + "OpenIdConnectClientCredential": { + "description": "The authentication client credentials of the custom Open ID Connect provider.", + "type": "object", + "properties": { + "method": { + "description": "The method that should be used to authenticate the user.", + "enum": [ + "ClientSecretPost" + ], + "type": "string", + "x-ms-enum": { + "name": "ClientCredentialMethod", + "modelAsString": false + } + }, + "clientSecretSettingName": { + "description": "The app setting that contains the client secret for the custom Open ID Connect provider.", "type": "string" } } }, - "AuthConfigCollection": { - "description": "AuthConfig collection ARM resource.", - "required": [ - "value" - ], + "OpenIdConnectConfig": { + "description": "The configuration settings of the endpoints used for the custom Open ID Connect provider.", "type": "object", "properties": { - "value": { - "description": "Collection of resources.", + "authorizationEndpoint": { + "description": "The endpoint to be used to make an authorization request.", + "type": "string" + }, + "tokenEndpoint": { + "description": "The endpoint to be used to request a token.", + "type": "string" + }, + "issuer": { + "description": "The endpoint that issues the token.", + "type": "string" + }, + "certificationUri": { + "description": "The endpoint that provides the keys necessary to validate the token.", + "type": "string" + }, + "wellKnownOpenIdConfiguration": { + "description": "The endpoint that contains all the configuration endpoints for the provider.", + "type": "string" + } + } + }, + "OpenIdConnectLogin": { + "description": "The configuration settings of the login flow of the custom Open ID Connect provider.", + "type": "object", + "properties": { + "nameClaimType": { + "description": "The name of the claim that contains the users name.", + "type": "string" + }, + "scopes": { + "description": "A list of the scopes that should be requested while authenticating.", "type": "array", "items": { - "$ref": "#/definitions/AuthConfig" + "type": "string" } - }, - "nextLink": { - "description": "Link to next page of resources.", - "type": "string", - "readOnly": true } } - }, - "IdentityProviderState": { - "type": "string", - "enum": [ - "Enabled", - "Disabled" - ], - "x-ms-enum": { - "name": "IdentityProviderState", - "modelAsString": true - }, - "description": "Indicate whether identity provider is enabled or disabled." } }, "securityDefinitions": { diff --git a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_CreateOrUpdate.json b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_CreateOrUpdate.json index c3494afcb179..5422803f9e55 100644 --- a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_CreateOrUpdate.json +++ b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_CreateOrUpdate.json @@ -7,7 +7,9 @@ "api-version": "2022-01-01-preview", "authConfigEnvelope": { "properties": { - "state": "Enabled", + "platform": { + "enabled": true + }, "globalValidation": { "unauthenticatedClientAction": "AllowAnonymous" }, @@ -15,7 +17,7 @@ "facebook": { "registration": { "appId": "123", - "appSecretRefName": "facebook-secret" + "appSecretSettingName": "facebook-secret" } } } @@ -30,7 +32,9 @@ "name": "current", "type": "Microsoft.App/containerapps/authconfigs", "properties": { - "state": "Enabled", + "platform": { + "enabled": true + }, "globalValidation": { "unauthenticatedClientAction": "AllowAnonymous" }, @@ -38,7 +42,7 @@ "facebook": { "registration": { "appId": "123", - "appSecretRefName": "facebook-secret" + "appSecretSettingName": "facebook-secret" } } } diff --git a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_Get.json b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_Get.json index 60c9bfef3126..13ea6ad6826e 100644 --- a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_Get.json +++ b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_Get.json @@ -14,7 +14,9 @@ "name": "current", "type": "Microsoft.App/containerapps/authconfigs", "properties": { - "state": "Enabled", + "platform": { + "enabled": true + }, "globalValidation": { "unauthenticatedClientAction": "AllowAnonymous" }, @@ -22,7 +24,7 @@ "facebook": { "registration": { "appId": "123", - "appSecretRefName": "facebook-secret" + "appSecretSettingName": "facebook-secret" } } } diff --git a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_ListByContainer.json b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_ListByContainer.json index f584baf3b6fc..430b204cc013 100644 --- a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_ListByContainer.json +++ b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/examples/AuthConfigs_ListByContainer.json @@ -15,7 +15,9 @@ "name": "current", "type": "Microsoft.App/containerapps/authconfigs", "properties": { - "state": "Enabled", + "platform": { + "enabled": true + }, "globalValidation": { "unauthenticatedClientAction": "AllowAnonymous" }, @@ -23,7 +25,7 @@ "facebook": { "registration": { "appId": "123", - "appSecretRefName": "facebook-secret" + "appSecretSettingName": "facebook-secret" } } } diff --git a/specification/app/resource-manager/readme.md b/specification/app/resource-manager/readme.md index f7a8eeed7f45..7de14ca24114 100644 --- a/specification/app/resource-manager/readme.md +++ b/specification/app/resource-manager/readme.md @@ -72,6 +72,12 @@ directive: - suppress: R3018 from: ContainerApps.json reason: Use of boolean type is required +- suppress: R3018 + from: AuthConfigs.json + reason: Use of boolean type is required +- suppress: R3016 + from: AuthConfigs.json + reason: Use disableWWWAuthenticate to align with AuthSettingV2 ``` --- From c642620695dd7c6372f8a65d994db86496e71165 Mon Sep 17 00:00:00 2001 From: Erich Wang Date: Thu, 10 Mar 2022 08:59:54 +0800 Subject: [PATCH 2/3] Update for spell check --- .../2022-01-01-preview/AuthConfigs.json | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json index 6421aee687f8..307185d26bbd 100644 --- a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json +++ b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json @@ -268,23 +268,23 @@ "properties": { "platform": { "$ref": "#/definitions/AuthPlatform", - "description": "The configuration settings of the platform of Containerapp Service Authentication/Authorization." + "description": "The configuration settings of the platform of ContainerApp Service Authentication/Authorization." }, "globalValidation": { "$ref": "#/definitions/GlobalValidation", - "description": "The configuration settings that determines the validation flow of users using Containerapp Service Authentication/Authorization." + "description": "The configuration settings that determines the validation flow of users using Service Authentication/Authorization." }, "identityProviders": { "$ref": "#/definitions/IdentityProviders", - "description": "The configuration settings of each of the identity providers used to configure Containerapp Service Authentication/Authorization." + "description": "The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization." }, "login": { "$ref": "#/definitions/Login", - "description": "The configuration settings of the login flow of users using Containerapp Service Authentication/Authorization." + "description": "The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization." }, "httpSettings": { "$ref": "#/definitions/HttpSettings", - "description": "The configuration settings of the HTTP requests for authentication and authorization requests made against Containerapp Service Authentication/Authorization." + "description": "The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization." } }, "x-ms-client-flatten": true @@ -292,7 +292,7 @@ } }, "AuthPlatform": { - "description": "The configuration settings of the platform of Containerapp Service Authentication/Authorization.", + "description": "The configuration settings of the platform of ContainerApp Service Authentication/Authorization.", "type": "object", "properties": { "enabled": { @@ -310,7 +310,7 @@ } }, "GlobalValidation": { - "description": "The configuration settings that determines the validation flow of users using Containerapp Service Authentication/Authorization.", + "description": "The configuration settings that determines the validation flow of users using ContainerApp Service Authentication/Authorization.", "type": "object", "properties": { "unauthenticatedClientAction": { @@ -341,7 +341,7 @@ } }, "HttpSettings": { - "description": "The configuration settings of the HTTP requests for authentication and authorization requests made against Containerapp Service Authentication/Authorization.", + "description": "The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization.", "type": "object", "properties": { "requireHttps": { @@ -396,7 +396,7 @@ } }, "Login": { - "description": "The configuration settings of the login flow of users using Containerapp Service Authentication/Authorization.", + "description": "The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization.", "type": "object", "properties": { "routes": { @@ -518,7 +518,7 @@ } }, "IdentityProviders": { - "description": "The configuration settings of each of the identity providers used to configure Containerapp Service Authentication/Authorization.", + "description": "The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization.", "type": "object", "properties": { "azureActiveDirectory": { From 7015b33c6f6e1ff2f2874b42cdc0cfc1dd61e1d8 Mon Sep 17 00:00:00 2001 From: Erich Wang Date: Thu, 10 Mar 2022 14:32:45 +0800 Subject: [PATCH 3/3] Remove TokenStore/ConfigFilePath as not supported for ContainerApp --- .../2022-01-01-preview/AuthConfigs.json | 51 ------------------- 1 file changed, 51 deletions(-) diff --git a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json index 307185d26bbd..3bbe8e1d6082 100644 --- a/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json +++ b/specification/app/resource-manager/Microsoft.App/preview/2022-01-01-preview/AuthConfigs.json @@ -302,10 +302,6 @@ "runtimeVersion": { "description": "The RuntimeVersion of the Authentication / Authorization feature in use for the current app.\nThe setting in this value can control the behavior of certain features in the Authentication / Authorization module.", "type": "string" - }, - "configFilePath": { - "description": "The path of the config file containing auth settings if they come from a file.\nIf the path is relative, base will the site's root directory.", - "type": "string" } } }, @@ -403,10 +399,6 @@ "$ref": "#/definitions/LoginRoutes", "description": "The routes that specify the endpoints used for login and logout requests." }, - "tokenStore": { - "$ref": "#/definitions/TokenStore", - "description": "The configuration settings of the token store." - }, "preserveUrlFragmentsForLogins": { "description": "true if the fragments from the request are preserved after the login request is made; otherwise, false.", "type": "boolean" @@ -438,49 +430,6 @@ } } }, - "TokenStore": { - "description": "The configuration settings of the token store.", - "type": "object", - "properties": { - "enabled": { - "description": "true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false.\n The default is false.", - "type": "boolean" - }, - "tokenRefreshExtensionHours": { - "format": "double", - "description": "The number of hours after session token expiration that a session token can be used to\ncall the token refresh API. The default is 72 hours.", - "type": "number" - }, - "fileSystem": { - "$ref": "#/definitions/FileSystemTokenStore", - "description": "The configuration settings of the storage of the tokens if a file system is used." - }, - "azureBlobStorage": { - "$ref": "#/definitions/BlobStorageTokenStore", - "description": "The configuration settings of the storage of the tokens if blob storage is used." - } - } - }, - "FileSystemTokenStore": { - "description": "The configuration settings of the storage of the tokens if a file system is used.", - "type": "object", - "properties": { - "directory": { - "description": "The directory in which the tokens will be stored.", - "type": "string" - } - } - }, - "BlobStorageTokenStore": { - "description": "The configuration settings of the storage of the tokens if blob storage is used.", - "type": "object", - "properties": { - "sasUrlSettingName": { - "description": "The name of the app setting containing the SAS URL of the blob storage containing the tokens.", - "type": "string" - } - } - }, "CookieExpiration": { "description": "The configuration settings of the session cookie's expiration.", "type": "object",