Azure / Azure/azure-functions-host
Integrate Easy Auth with Function AuthLevel requirements
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 36
Description
Currently the pattern most customers follow when enabling [Easy Auth](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization) on their Function App is to mark their http functions with auth level Anonymous, since upstream Easy Auth is ensuring that no unauthenticated calls are allowed, so additional key auth requirements are unnecessary.
We should consider making changes that would allow such customers to specify an auth level **User** (see existing [AuthorizationLevel.User](https://github.com/Azure/azure-webjobs-sdk-extensions/blob/fab754723aec94be723b489e1cc42f247b199394/src/WebJobs.Extensions.Http/AuthorizationLevel.cs#L19)). We'd do the work in the auth pipeline to identify when the request has an authenticated Easy Auth identity, and add the User auth level claim, similar to how we do for the Admin claim [here](https://github.com/Azure/azure-functions-host/blob/47bc720abde6f88808cb4dd30b3c323612275319/src/WebJobs.Script.WebHost/Security/Authentication/Jwt/ScriptJwtBearerExtensions.cs#L67). Then, then our downstream authorization pipeline would just work.
The benefit is that function metadata correctly reflects the actual authentication requirements.
Contributor guide
Research direction
Start with ScriptJwtBearerExtensions.cs at the existing Admin claim handling and review AuthorizationLevel.cs for the User level. Trace how an authenticated Easy Auth identity moves through the auth and downstream authorization pipelines. Done means authenticated Easy Auth requests receive the User auth level claim and function metadata reflects the authentication requirement.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp
- Domain
- authentication, authorization, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100