Azure / Azure/azure-functions-host

Integrate Easy Auth with Function AuthLevel requirements

Open
#11,394 1 comment 1 reaction 0 assignees View on GitHub
area: authentication enhancement feature-request
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 10h
Merged PRs (30d)
36

Description

Currently the pattern most customers follow when enabling [Easy Auth](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization) on their Function App is to mark their http functions with auth level Anonymous, since upstream Easy Auth is ensuring that no unauthenticated calls are allowed, so additional key auth requirements are unnecessary.

We should consider making changes that would allow such customers to specify an auth level **User** (see existing [AuthorizationLevel.User](https://github.com/Azure/azure-webjobs-sdk-extensions/blob/fab754723aec94be723b489e1cc42f247b199394/src/WebJobs.Extensions.Http/AuthorizationLevel.cs#L19)). We'd do the work in the auth pipeline to identify when the request has an authenticated Easy Auth identity, and add the User auth level claim, similar to how we do for the Admin claim [here](https://github.com/Azure/azure-functions-host/blob/47bc720abde6f88808cb4dd30b3c323612275319/src/WebJobs.Script.WebHost/Security/Authentication/Jwt/ScriptJwtBearerExtensions.cs#L67). Then, then our downstream authorization pipeline would just work.

The benefit is that function metadata correctly reflects the actual authentication requirements.

Contributor guide

Open the contributing guide

Research direction

Start with ScriptJwtBearerExtensions.cs at the existing Admin claim handling and review AuthorizationLevel.cs for the User level. Trace how an authenticated Easy Auth identity moves through the auth and downstream authorization pipelines. Done means authenticated Easy Auth requests receive the User auth level claim and function metadata reflects the authentication requirement.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
authentication, authorization, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.