Getting JWT for Service Account in Azure Active Directory

Getting JWT for Service Account in Azure Active Directory

Protect Function App can use Microsoft identity platform endpoint for identity-as-a-service, available in Azure Active Directory, to implement OpenID Connect and OAuth 2.0 authorization. This section describes how to get JWT using OAuth 2.0 client credentials grant flow in Azure Active Directory and authorize the Client ID in Protegrity Policy.

Suggested reading: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow

High-level design:

1. Active Directory Admin creates App registration for the service account.
2. Active Directory Admin gives consent for the Service Account App ID.
3. Daemon uses the Service Account App ID and the Service Account App ID Secret or Certificate, Protect Function App ID as the scope, and gets back the Access Token (JWT).
4. Daemon sends the request to the Protect Function App, including the access token in the Authorization Bearer header.

Configure the Protect Function App:

1. From the Azure console, navigate to Function App service and select protect function app.

2. Navigate to Settings > Environment variables and click OPENID_ENABLED. Make sure it is set to true.

3. Click on OPENID_AUDIENCES, make sure it is set to the App ID recorded in EntraIDApplicationID.

4. Click or Add the authorization environment variable. Make sure it is set to jwt.

5. Click or Add on jwt_user_claim environment variable, make sure it is set to [“azp”, “appid”]. For more information on claims on AAD access token, refer:

   https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens

To register a Service Account:

1. In the Azure portal navigate to Azure Active Directory.

2. Under Manage, select App registrations > New registration.

3. Enter a Name and select Accounts in any organizational directory.

4. Redirect URI is set to http://localhost.

5. Select Register.

   After registration is complete record Application ID and Directory (tenant) ID displayed in the overview window:

   Service Account App ID: ___________________

   Directory (tenant) ID: ___________________

6. In the Azure portal, in App registrations, select your application.

7. Select Certificates & secrets > New client secret.

8. Add a description for your client secret.

9. Select a duration.

10. Click Add.

11. Record the secret’s value for use in your client application code. This secret value is never displayed again after you leave this page.

    Service Account App Secret: ___________________

For more information on app registration, see Azure documentation Quickstart Registering App

Admin Consent the Service Account:

https://login.microsoftonline.com/{tenant}/adminconsent?
client_id={Service Account App ID}
&state=12345
&redirect_uri=http://localhost

Replace the tenant and the Service Account App ID with the values recorded in the previous step. At this point, Azure AD enforces that only a tenant administrator can sign into complete the request. The administrator will be asked to approve all the direct application permissions that were requested for the app in the app registration portal.

Get the access token

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d 'client_id={Service Account App ID}&scope={EntraIDApplicationID }%2F.default&client_secret={Service Account App Secret}&grant_type=client_credentials' 'https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token'

Replace Service Account App ID, EntraIDApplicationID, Service Account App Secret, and tenant with values recorded in previous steps.

Example for successful response:

{
  "token_type": "Bearer",
  "expires_in": 3599,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1uQ19WWmNBVGZNNXBP..."
}

\

Record the access_token from the response. access_token: ___________________

Use the token

curl -X POST "https://<Protect hostname>/api/v1/protect" -k \
-H 'x-functions-key: <Protect Function app key>' \
-H 'Authorization: Bearer <access_token>' \
-H 'Content-Type: application/json' \
-d '{
  "data": ["hello world!"],
  "data_element": "alpha"
}'

Replace the {Protect hostname}, {Protect Function app key} and {access_token} with the.

Troubleshooting:

• Service Account App ID redirect URL matches the redirect URL in the request for admin consent.
• Active Directory administrator does admin consent.
• JWT aud claim is the same as OPENID_AUDIENCES.
• JWT iss claim is the same as OPENID_ISSUERS.
• Protect Function configuration authorization=JWT
• At least one of thejwt_user_claim exists in the JWT
• The user claim in the token has permissions to make protect request.
• The data element exists in the Protect Function App current policy.
• JWT is not expired