Skip to content

Latest commit

 

History

History
83 lines (53 loc) · 3.47 KB

rest-api-authentication-azure-ad.md

File metadata and controls

83 lines (53 loc) · 3.47 KB
title description author ms.author ms.service ms.topic ms.date
Microsoft Entra REST API - authentication
Use Microsoft Entra ID to authenticate to Azure App Configuration by using the REST API
maud-lv
malev
azure-app-configuration
reference
08/17/2020

Microsoft Entra authentication

You can authenticate HTTP requests by using the Bearer authentication scheme with a token acquired from Microsoft Entra ID. You must transmit these requests over Transport Layer Security (TLS).

Prerequisites

You must assign the principal that's used to request a Microsoft Entra token to one of the applicable Azure App Configuration roles.

Provide each request with all HTTP headers required for authentication. Here's the minimum requirement:

Request header Description
Authorization Authentication information required by the Bearer scheme.

Example:

Host: {myconfig}.azconfig.io
Authorization: Bearer {{AadToken}}

Microsoft Entra token acquisition

Before acquiring a Microsoft Entra token, you must identify what user you want to authenticate as, what audience you're requesting the token for, and what Microsoft Entra endpoint (authority) to use.

Audience

Request the Microsoft Entra token with a proper audience. For Azure App Configuration use the following audience. The audience can also be referred to as the resource that the token is being requested for.

https://azconfig.io

Microsoft Entra authority

The Microsoft Entra authority is the endpoint you use for acquiring a Microsoft Entra token. It's in the form of https://login.microsoftonline.com/{tenantId}. The {tenantId} segment refers to the Microsoft Entra tenant ID to which the user or application who is trying to authenticate belongs.

Authentication libraries

Microsoft Authentication Library (MSAL) helps to simplify the process of acquiring a Microsoft Entra token. Azure builds these libraries for multiple languages. For more information, see the documentation.

Errors

You might encounter the following errors.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: HMAC-SHA256, Bearer

Reason: You haven't provided the authorization request header with the Bearer scheme.

Solution: Provide a valid Authorization HTTP request header.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: HMAC-SHA256, Bearer error="invalid_token", error_description="Authorization token failed validation"

Reason: The Microsoft Entra token isn't valid.

Solution: Acquire a Microsoft Entra token from the Microsoft Entra authority, and ensure that you've used the proper audience.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: HMAC-SHA256, Bearer error="invalid_token", error_description="The access token is from the wrong issuer. It must match the AD tenant associated with the subscription to which the configuration store belongs. If you just transferred your subscription and see this error message, please try back later."

Reason: The Microsoft Entra token isn't valid.

Solution: Acquire a Microsoft Entra token from the Microsoft Entra authority. Ensure that the Microsoft Entra tenant is the one associated with the subscription to which the configuration store belongs. This error can appear if the principal belongs to more than one Microsoft Entra tenant.