Fix 1755 #1777

ItalyPaleAle · 2021-09-10T01:12:39Z

Thank you for helping make the Dapr documentation better!

Please follow this checklist before submitting:

Read the contribution guide
Commands include options for Linux, MacOS, and Windows within codetabs
New file and folder names are globally unique
Page references use shortcodes instead of markdown or URL links
N/A Images use HTML style and have alternative text
Places where multiple code/command options are given have codetabs

Description

This PR addresses #1755.

As of writing, this is still a WIP:

Create a page that explains how to authenticate with Azure AD
Update the Azure Key Vault page
Deprecate the old Azure Key Vault w/ MSI page
Update the page for Azure Storage as state store

Issue reference

#1755

ItalyPaleAle · 2021-09-10T01:16:59Z

@orizohar @berndverst Here's the first work on the docs as discussed in #1755

It's my first contribution to the Dapr docs and it's a fairly large one, so even before I write the docs for the last component, your help as reviewers would be highly appreciated, to ensure that I've followed the right style.

Some of these things aren't super easy to explain, including all of the Azure AD parts... I've tried to clean up the AKV docs which were mixing concepts related to AKV and some related to AAD.

The result is less like a straightforward "do 1, 2, 3 and you're done", but it offers better security (using az ad sp create-for-rbac as was recommended before creates a SP that has access to manage EVERY resource in the Azure subscription - and that's even useless for Dapr since we need data plane access) and more flexibility because the same SP can be used for multiple Azure components.

Also, cc @cmatskas to keep me accountable and make sure I've documented AAD topics correctly

cmatskas

Small feedback but overall it looks great

cmatskas · 2021-09-10T01:22:14Z

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md

+type: docs
+title: "Authenticating to Azure"
+linkTitle: "Authenticating to Azure"
+description: "How to authenticate Azure components using Azure AD and Managed Identities"


Azure Active Directory

No in this case it should be "Azure" because it's for components authenticating with Azure. Also, for symmetry with the AWS one: https://docs.dapr.io/developing-applications/integrations/cloud-providers/

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md

cmatskas · 2021-09-10T01:27:52Z

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md

+
+Many of the services listed above also support authentication using other systems, such as "master keys" or "shared keys". Although those are always valid methods to authenticate your application (and Dapr continues to support them, as explained in each component's reference page), using Azure AD when possible offers various benefits, including:
+
+- The ability to leverage Managed Service Identities, which allow your application to authenticate with Azure AD, and obtain an access token to make requests to Azure services, without the need to use any credential. When your application is running on a supported Azure service (including, but not limited to, Azure VMs, Azure Kubernetes Service, Azure Web Apps, etc), an identity for your application can be assigned at the infrastructure level. This way, your code does not have to deal with credentials of any kind, removing the challenge of safely managing credentials, allowing greater separation of concerns between development and operations teams and reducing the number of people with access to credentials, and lastly simplifying operational aspects–especially when multiple environments are used.


Azure Arc - joined devices also provide support for Managed Identities so the solution doesn't have to run on Azure to benefit from this security feature.

I don't know if Dapr supports Arc at this time. @berndverst and I were talking about that but there may be other issues with Arc...

cmatskas · 2021-09-10T01:32:37Z

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md

+> az account set -s [your subscription id]
+> ```
+
+First, create the Azure AD application with:


You can oversimplify this by using the az ad sp create-for-rbac --role Contributor --scopes <optional>

Does Dapr still need an App Registration to authenticate to AAD? if that's the case, ignore above comment.

Yes Dapr does need the App Registration to authenticate with AAD. I also would prefer not using the short-hand comment because the SP doesn't need any access at the entire subscription level.

cmatskas · 2021-09-10T01:36:12Z

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md

+
+Keep in mind that the Service Principal we just created does not have access to any Azure resource by default. Access will need to be granted to each resource as needed, as documented in the docs for the components.
+
+> Note: this step is different from the [official documentation](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli) as the short-hand commands create a Service Principal that has broad read-write access to all Azure resources in your subscription. Not only this grants our application more access than you are likely going to desire, but this also applies only to the Azure management plane (Azure Resource Manager, or ARM), which is irrelevant for Dapr anyways (all Azure components are designed to interact with the data plane of various services, and not ARM).


you can pass the scope you want during the creation of the SP using the --scopes parameter

See my comment above. The SP shouldn't have any access at the subscription level, it only needs data plane access and that should be granted at the resource level (for the principle of the least privileges)

orizohar · 2021-09-10T15:55:37Z

@orizohar @berndverst Here's the first work on the docs as discussed in #1755

It's my first contribution to the Dapr docs and it's a fairly large one, so even before I write the docs for the last component, your help as reviewers would be highly appreciated, to ensure that I've followed the right style.

Some of these things aren't super easy to explain, including all of the Azure AD parts... I've tried to clean up the AKV docs which were mixing concepts related to AKV and some related to AAD.

The result is less like a straightforward "do 1, 2, 3 and you're done", but it offers better security (using az ad sp create-for-rbac as was recommended before creates a SP that has access to manage EVERY resource in the Azure subscription - and that's even useless for Dapr since we need data plane access) and more flexibility because the same SP can be used for multiple Azure components.

Also, cc @cmatskas to keep me accountable and make sure I've documented AAD topics correctly

Thanks for working on this. If you haven't yet you can see the docs contribution guidelines here. Also, where it makes sense it is okay to not go too deep with explaining Azure and just linking to Azure docs

ItalyPaleAle · 2021-09-10T19:23:23Z

I've updated the Azure Blob Storage doc too. PR is complete and ready for your review.

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md

…-providers/authenticating-azure.md Co-authored-by: greenie-msft <56556602+greenie-msft@users.noreply.github.com>

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md

…-providers/authenticating-azure.md Co-authored-by: greenie-msft <56556602+greenie-msft@users.noreply.github.com>

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md

.../content/en/reference/components-reference/supported-state-stores/setup-azure-blobstorage.md

…tate-stores/setup-azure-blobstorage.md Co-authored-by: Ori Zohar <orzohar@microsoft.com>

ItalyPaleAle added 2 commits September 9, 2021 17:29

Added doc for common Azure auth layer

e5016a6

Updated the AKV document and fixed the Azure auth document

891d08c

ItalyPaleAle changed the base branch from v1.3 to v1.4 September 10, 2021 01:13

cmatskas reviewed Sep 10, 2021

View reviewed changes

ItalyPaleAle added 2 commits September 9, 2021 19:37

Updated per Christos' comments

38ea35a

Merge branch 'v1.4' into fix-1755

02998e5

ItalyPaleAle added 3 commits September 10, 2021 11:53

Improvements and fixes

e14f93b

Merge branch 'v1.4' into fix-1755

8010448

Updated the Azure Blob Storage state store doc

57af58d

ItalyPaleAle marked this pull request as ready for review September 10, 2021 19:23

ItalyPaleAle requested a review from a team as a code owner September 10, 2021 19:23

orizohar added this to the 1.4 milestone Sep 10, 2021

orizohar requested review from yaron2 and msfussell September 10, 2021 22:55

Merge branch 'v1.4' into fix-1755

5545ed1

greenie-msft reviewed Sep 14, 2021

View reviewed changes

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md Outdated Show resolved Hide resolved

Update daprdocs/content/en/developing-applications/integrations/cloud…

663cc42

…-providers/authenticating-azure.md Co-authored-by: greenie-msft <56556602+greenie-msft@users.noreply.github.com>

greenie-msft reviewed Sep 14, 2021

View reviewed changes

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md Outdated Show resolved Hide resolved

Update daprdocs/content/en/developing-applications/integrations/cloud…

663c3aa

…-providers/authenticating-azure.md Co-authored-by: greenie-msft <56556602+greenie-msft@users.noreply.github.com>

greenie-msft reviewed Sep 14, 2021

View reviewed changes

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md Outdated Show resolved Hide resolved

greenie-msft reviewed Sep 14, 2021

View reviewed changes

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md Outdated Show resolved Hide resolved

greenie-msft reviewed Sep 14, 2021

View reviewed changes

...docs/content/en/developing-applications/integrations/cloud-providers/authenticating-azure.md Outdated Show resolved Hide resolved

greenie-msft and others added 5 commits September 14, 2021 12:01

Apply suggestions from code review

bd2ad66

Fix style/tone

c3cc74c

Fix style/tone

974ff70

fix style/tone

845a4d7

Remove "we" language

0912131

Ori Zohar added 2 commits September 14, 2021 14:36

Merge branch 'v1.4' into fix-1755

c0dc994

Merge branch 'v1.4' into fix-1755

5759ee1

orizohar reviewed Sep 14, 2021

View reviewed changes

.../content/en/reference/components-reference/supported-state-stores/setup-azure-blobstorage.md Outdated Show resolved Hide resolved

Update daprdocs/content/en/reference/components-reference/supported-s…

e2f7b3c

…tate-stores/setup-azure-blobstorage.md Co-authored-by: Ori Zohar <orzohar@microsoft.com>

greenie-msft requested a review from a team as a code owner September 14, 2021 22:10

orizohar self-requested a review September 14, 2021 22:12

orizohar approved these changes Sep 14, 2021

View reviewed changes

orizohar merged commit 3f3ac99 into dapr:v1.4 Sep 14, 2021

ItalyPaleAle mentioned this pull request Mar 4, 2022

REQUEST: New membership for ItalyPaleAle dapr/community#152

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix 1755 #1777

Fix 1755 #1777

ItalyPaleAle commented Sep 10, 2021 •

edited

Loading

ItalyPaleAle commented Sep 10, 2021

cmatskas left a comment

cmatskas Sep 10, 2021

ItalyPaleAle Sep 10, 2021

cmatskas Sep 10, 2021

ItalyPaleAle Sep 10, 2021

cmatskas Sep 10, 2021

cmatskas Sep 10, 2021

ItalyPaleAle Sep 10, 2021

cmatskas Sep 10, 2021

ItalyPaleAle Sep 10, 2021

orizohar commented Sep 10, 2021

ItalyPaleAle commented Sep 10, 2021


		Many of the services listed above also support authentication using other systems, such as "master keys" or "shared keys". Although those are always valid methods to authenticate your application (and Dapr continues to support them, as explained in each component's reference page), using Azure AD when possible offers various benefits, including:

		- The ability to leverage Managed Service Identities, which allow your application to authenticate with Azure AD, and obtain an access token to make requests to Azure services, without the need to use any credential. When your application is running on a supported Azure service (including, but not limited to, Azure VMs, Azure Kubernetes Service, Azure Web Apps, etc), an identity for your application can be assigned at the infrastructure level. This way, your code does not have to deal with credentials of any kind, removing the challenge of safely managing credentials, allowing greater separation of concerns between development and operations teams and reducing the number of people with access to credentials, and lastly simplifying operational aspects–especially when multiple environments are used.


		Keep in mind that the Service Principal we just created does not have access to any Azure resource by default. Access will need to be granted to each resource as needed, as documented in the docs for the components.

		> Note: this step is different from the [official documentation](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli) as the short-hand commands create a Service Principal that has broad read-write access to all Azure resources in your subscription. Not only this grants our application more access than you are likely going to desire, but this also applies only to the Azure management plane (Azure Resource Manager, or ARM), which is irrelevant for Dapr anyways (all Azure components are designed to interact with the data plane of various services, and not ARM).

Fix 1755 #1777

Fix 1755 #1777

Conversation

ItalyPaleAle commented Sep 10, 2021 • edited Loading

Description

Issue reference

ItalyPaleAle commented Sep 10, 2021

cmatskas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

orizohar commented Sep 10, 2021

ItalyPaleAle commented Sep 10, 2021

ItalyPaleAle commented Sep 10, 2021 •

edited

Loading