Securing Azure AD B2C API Connector (Function App) without Error

by Contributed | Apr 12, 2024 | Technology

This article is contributed. See the original author and article here.

I was recently working with a customer who is using Azure AD B2C API Connector to enrich tokens with claims from external sources. They are using Azure Function App as the external source. As this setup demands, they exposed Azure Function App over public IP to work with B2C. But due to enterprise security restriction policy they must remove public endpoint from Function App and use private endpoints to VNET.

They thought of 2 options to expose the Function App securely over internet – using Azure API Management instance to a virtual network – external mode APIM in external mode or using Azure Application Gateway. But in both the cases B2C auth process errors out after adding the API Connector in the user flow:

Initially I investigated on the error messages collected at the B2C, and APIM or Azure Application Gateway end. But later realized the main source of problem lies somewhere else. It is the ASP.NET Core framework used in building the Function App.

We need to modify default FowardedHeaders middleware settings. Otherwise, it will ignore the X-Forwarded headers being sent by APIM or Application Gateway because it isn’t in the list of KnownProxies and KnownNetworks. Please see the following links to understand the concept better:

• Configure ASP.NET Core to work with proxy servers and load balancers | Microsoft Learn


• Using Azure Front Door with .NET Core • Jamie Phillips (phillipsj.net)

So, I did the following changes:

1. Added ASPNETCORE_FORWARDEDHEADERS_ENABLED application setting to my Function App Configuration:

2. Added a Startup.cs file in my function app code.

using System.Collections.Generic;

using Microsoft.AspNetCore.Builder;

using Microsoft.Azure.Functions.Extensions.DependencyInjection;

using Microsoft.Extensions.DependencyInjection;

[assembly: FunctionsStartup(typeof(TestAPIFunctionApp.Startup))]

namespace TestAPIFunctionApp

{

    public class Startup : FunctionsStartup

    {

        public override void Configure(IFunctionsHostBuilder builder)

        {

            builder.Services.Configure(options =>

            {

                options.ForwardedHeaders = Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedFor | Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedProto | Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedHost;

                options.KnownNetworks.Clear();

                options.KnownProxies.Clear();

                // Put your front door, application gateway, APIM, b2clogin FQDN here and any other hosts that will send headers you want respected

                options.AllowedHosts = new List() { “.azurewebsites.net”, “.b2clogin.com”, “.azure-api.net”};

            });

        }

    }

}

That solves our problem. We can now see the “augmented claims”:

General availability: Elastic Jobs in Azure SQL Database

by Contributed | Apr 11, 2024 | Technology

This article is contributed. See the original author and article here.

We are excited to announce the general availability (GA) of Elastic Jobs for Azure SQL Databases.  

Elastic Jobs is a fully integrated Azure SQL database service that allows you to automate and manage administrative tasks across multiple SQL databases in a secure, scalable way. It can run one or more T-SQL job scripts in parallel using Azure portal, PowerShell, REST, or T-SQL APIs. Jobs can be run on a schedule or on-demand, targeting any tier of Azure SQL Database. Job target can include all databases in a server, in an elastic pool, across multiple servers and even databases across different subscriptions and geo regions on Azure. Servers and pools are dynamically enumerated at runtime, so jobs run against all databases that exist in the target group at the time of execution.

Where can you use Elastic Jobs?

Any database administration or management job that can be scripted with a T-SQL script is a good candidate for elastic jobs. Some of these example scenarios include:

• Automate management tasks like deploy schema changes, index rebuilding, performance/telemetry data collection etc.  


• Configure jobs like query execution, collecting results across a collection of databases on a recurring basis.


• Aggregate and collect data for processing and reporting.


• Data movement, ETL processing to extract/process/insert data between tables in a database.


• .. to name a few.

What are some significant capabilities of Elastic Jobs?

Elastic Jobs makes it easy and secure to manage large number of SQL databases across Aure. Some significant security and management capabilities of Elastic Jobs include:

• Microsoft Entra ID (formerly Azure Active Directory) support for central administration of authentication and permissions


• Service-managed Private Link support to securely connect to target databases.


• Integration with Azure Alerts for job execution status notification. 


• Easily scale Job Agent’s tier to connect to hundreds of target databases concurrently across Azure. 


• Dynamic enumeration target databases in target servers and elastic pools


• Jobs can be composed of multiple steps to customize the execution sequence.


• All functionalities can be accessed through portal, PowerShell, T-SQL and REST APIs

How do you setup and use Elastic Jobs?

Setting up and using elastic jobs is simple as described here.

• Job Agent and Job database creation

Job Agent and associated Job database creation experience in portal is similar to a SQL database creation. As part of job agent creation, its service tier can be chosen, and a user assigned managed identity can be added for Entra authentication. Once the job agent is created, its portal page allows easy access to all its capabilities.

• Defining Jobs, their target groups and monitoring them through job agent’s portal page.

Jobs and job steps can be defined, edited and executed through portal page. These jobs can also be scheduled to run at regular intervals and their execution can be monitored.

• Advanced security functionalities, alert notification and scaling are also easily accessed through Job Agent’s portal page.

Job agents Entra ID can be changed and private links to target databases established easily through portal page. Azure Alerts can be defined for getting alert notification on job executions status. Scaling the job agent’s compute tier to enable it to connect to hundreds of target databases concurrently is also easy through portal page links.

Steps described above for creating, configuring, and managing elastic jobs also be accomplished through using PowerShell, REST and T-SQL APIs.

Pricing

Billing for Job agents will start at GA time, April 11th, 2024. Billing cards in the Azure portal page will show estimated cost based on the provisioned job agent tier.

  *Billing for the job agents in national clouds are expected to start a little later, depending on the billing pipeline deployment in those regions.

Regional availability 

The Elastic Jobs is available in all the regions that Azure SQL Database is available. 

Resources 

To get started, access the Elastic Database Jobs in our documentation and follow through with the tutorials.