Skip to content

Latest commit

 

History

History
149 lines (106 loc) · 16.7 KB

authenticate-with-entra-id-namespaces.md

File metadata and controls

149 lines (106 loc) · 16.7 KB
Raw
title description ms.topic ms.custom ms.date
Authenticate publishing namespace clients using Microsoft Entra ID
This article describes how to authenticate Azure Event Grid publishing clients using Microsoft Entra ID that publish events to topics in Event Grid namespaces.
conceptual
build-2023
ignite-2023
11/15/2023

Authentication and authorization with Microsoft Entra ID when using Event Grid namespaces

This article describes how to authenticate clients publishing events to Azure Event Grid namespaces using Microsoft Entra ID.

Overview

The Microsoft Identity platform provides an integrated authentication and access control management for resources and applications that use Microsoft Entra ID as their identity provider. Use the Microsoft Identity platform to provide authentication and authorization support in your applications. It's based on open standards such as OAuth 2.0 and OpenID Connect and offers tools and open-source libraries that support many authentication scenarios. It provides advanced features such as Conditional Access that allows you to set policies that require multifactor authentication or allow access from specific locations, for example.

An advantage that improves your security stance when using Microsoft Entra ID is that you don't need to store credentials, such as authentication keys, in the code or repositories. Instead, you rely on the acquisition of OAuth 2.0 access tokens from the Microsoft Identity platform that your application presents when authenticating to a protected resource. You can register your event publishing application with Microsoft Entra ID and obtain a service principal associated with your app that you manage and use. Instead, you can use Managed Identities, either system assigned or user assigned, for an even simpler identity management model as some aspects of the identity lifecycle are managed for you.

Role-based access control (RBAC) allows you to configure authorization in a way that certain security principals (identities for users, groups, or apps) have specific permissions to execute operations over Azure resources. This way, the security principal used by a client application that sends events to Event Grid must have the RBAC role EventGrid Data Sender associated with it.

Security principals

There are two broad categories of security principals that are applicable when discussing authentication of an Event Grid publishing client:

  • Managed identities. A managed identity can be system assigned, which you enable on an Azure resource and is associated to only that resource, or user assigned, which you explicitly create and name. User assigned managed identities can be associated to more than one resource.
  • Application security principal. It's a type of security principal that represents an application, which accesses resources protected by Microsoft Entra ID.

Regardless of the security principal used, a managed identity or an application security principal, your client uses that identity to authenticate before Microsoft Entra ID and obtain an OAuth 2.0 access token that's sent with requests when sending events to Event Grid. That token is cryptographically signed and once Event Grid receives it, the token is validated. For example, the audience (the intended recipient of the token) is confirmed to be Event Grid (https://eventgrid.azure.net), among other things. The token contains information about the client identity. Event Grid takes that identity and validates that the client has the role EventGrid Data Sender assigned to it. More precisely, Event Grid validates that the identity has the Microsoft.EventGrid/events/send/action permission in an RBAC role associated to the identity before allowing the event publishing request to complete.

If you're using the Event Grid SDK, you don't need to worry about the details on how to implement the acquisition of access tokens and how to include it with every request to Event Grid because the Event Grid data plane SDKs do that for you.

Client configuration steps to use Microsoft Entra authentication

Perform the following steps to configure your client to use Microsoft Entra authentication when sending events to a topic, domain, or partner namespace.

  1. Create or use a security principal you want to use to authenticate. You can use a managed identity or an application security principal.
  2. Grant permission to a security principal to publish events by assigning the EventGrid Data Sender role to the security principal.
  3. Use the Event Grid SDK to publish events to an Event Grid.

Authenticate using a managed identity

Managed identities are identities associated with Azure resources. Managed identities provide an identity that applications use when using Azure resources that support Microsoft Entra authentication. Applications may use the managed identity of the hosting resource like a virtual machine or Azure App service to obtain Microsoft Entra tokens that are presented with the request when publishing events to Event Grid. When the application connects, Event Grid binds the managed entity's context to the client. Once it's associated with a managed identity, your Event Grid publishing client can do all authorized operations. Authorization is granted by associating a managed entity to an Event Grid RBAC role.

Managed identity provides Azure services with an automatically managed identity in Microsoft Entra ID. Contrasting to other authentication methods, you don't need to store and protect access keys or Shared Access Signatures (SAS) in your application code or configuration, either for the identity itself or for the resources you need to access.

To authenticate your event publishing client using managed identities, first decide on the hosting Azure service for your client application and then enable system assigned or user assigned managed identities on that Azure service instance. For example, you can enable managed identities on a VM, an Azure App Service or Azure Functions.

Once you have a managed identity configured in a hosting service, assign the permission to publish events to that identity.

Authenticate using a security principal of a client application

Besides managed identities, another identity option is to create a security principal for your client application. To that end, you need to register your application with Microsoft Entra ID. Registering your application is a gesture through which you delegate identity and access management control to Microsoft Entra ID. Follow the steps in section Register an application and in section Add a client secret. Make sure to review the prerequisites before starting.

Once you have an application security principal and followed above steps, assign the permission to publish events to that identity.

Note

When you register an application in the portal, an application object and a service principal are created automatically in your home tenant. Alternatively, you can use Microsot Graph to register your application. However, if you register or create an application using the Microsoft Graph APIs, creating the service principal object is a separate step.

Assign permission to a security principal to publish events

The identity used to publish events to Event Grid must have the permission Microsoft.EventGrid/events/send/action that allows it to send events to Event Grid. That permission is included in the built-in RBAC role Event Grid Data Sender. This role can be assigned to a security principal, for a given scope, which can be a management group, an Azure subscription, a resource group, or a specific Event Grid topic, domain, or partner namespace. Follow the steps in Assign Azure roles to assign a security principal the EventGrid Data Sender role and in that way grant an application using that security principal access to send events. Alternatively, you can define a custom role that includes the Microsoft.EventGrid/events/send/action permission and assign that custom role to your security principal.

With RBAC privileges taken care of, you can now build your client application to send events to Event Grid.

Note

Event Grid supports more RBAC roles for purposes beyond sending events. For more information, seeEvent Grid built-in roles.

Publish events using Event Grid's client SDKs

Use Event Grid's data plane SDK to publish events to Event Grid. Event Grid's SDK support all authentication methods, including Microsoft Entra authentication.

Here's the sample code that publishes events to Event Grid using the .NET SDK. You can get the topic endpoint on the Overview page for your Event Grid topic in the Azure portal. It's in the format: https://<TOPIC-NAME>.<REGION>-1.eventgrid.azure.net/api/events.

ManagedIdentityCredential managedIdentityCredential = new ManagedIdentityCredential();
EventGridPublisherClient client = new EventGridPublisherClient( new Uri("<TOPIC ENDPOINT>"), managedIdentityCredential);


EventGridEvent egEvent = new EventGridEvent(
        "ExampleEventSubject",
        "Example.EventType",
        "1.0",
        "This is the event data");

// Send the event
await client.SendEventAsync(egEvent);

SDKs

Following are the prerequisites to authenticate to Event Grid.

Publish events using Microsoft Entra Authentication

To send events to a topic, domain, or partner namespace, you can build the client in the following way. The API version that first provided support for Microsoft Entra authentication is 2018-01-01. Use that API version or a more recent version in your application.

Sample:

This C# snippet creates an Event Grid publisher client using an Application (Service Principal) with a client secret, to enable the DefaultAzureCredential method you need to add the Azure.Identity library. If you're using the official SDK, the SDK handles the version for you.

Environment.SetEnvironmentVariable("AZURE_CLIENT_ID", "");
Environment.SetEnvironmentVariable("AZURE_TENANT_ID", "");
Environment.SetEnvironmentVariable("AZURE_CLIENT_SECRET", "");

EventGridPublisherClient client = new EventGridPublisherClient(new Uri("your-event-grid-topic-domain-or-partner-namespace-endpoint"), new DefaultAzureCredential());

For more information, see the following articles:

Resources