The following page explains how to use a managed ID with ACS, but is there any other way to register with the Creating an Azure Active Directory Registered Application, such as the Azure Portal or PowerShell?
https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/identity/service-principal-from-cli#creating-an-azure-active-directory-registered-application
Yes, you can do it all in the Azure Portal. First, you create the service principal:
Then, you assign permissions to it. Either on the subscription level:
Or on the Communication Service resource level:
Related
What is the best way to configure an application startup.cs to use both Azure AD and Azure B2C in .netcore? I see a lot of referencing indictating to use only Azure B2C, but due to the circumstances I need to use both Identity providers separately giving the users the option to choose which service.
But I am not sure how to go about it, and after configuring the startup, how would I use distinct "Authorize" on the actions within the same controller?
You can use the Azure AD B2C custom policy and Azure ad can be set as an identity provider.The end result is as shown below, where users can choose to log in with an ad account.
Found that adding multiple Azure Active Directory authentication providers in the same app using the current release of the Microsoft Identity Web library is not available (https://github.com/AzureAD/microsoft-identity-web/issues/549 ) but will hopefully be added soon.
When testing ASR, the ASR VM's don't get a managed service identity.
Is there a best practise to deal with this scenario - including assigning permissions to the MSI, in such an event?
I believe that it is not possible to replicate, managed identities for Azure resources is a feature of Azure Active Directory. Each of the Azure services that support managed identities for Azure resources are subject to their own timeline. It means a DR is not a VM, it only exist a hard disk during replication.
What you can try to do, not sure it is going to work (never done before), you can try to create a postscript after a failover (documentation) and then configure your managed identities using PowerShell (documentation)
Site Recovery supports managed identities for its Azure resources. Instead of creating service principals to access other resources, use managed identities with Site Recovery. Site Recovery can natively authenticate to the Azure services and resources that support Azure AD authentication. It authenticates through a predefined access grant rule without using credentials that are hardcoded in source code or configuration files.Azure-managed
I want to check if AWS Security Hub integration is enabled for particular aws account ID and particular region using AWS Security Hub SDK?
For checking this, follow the below steps:
Your AWS account needs to have connector permissions (AWS-SD-Connector-Role) to target aws account
Assume role using the target account ARN (Amazon Resource Name) and get the temporary session credentials of a target account.
Now using the temporary session credentials get the security-hub object of a target account and check which all product subscriptions are enabled in it.
When we store the Service principal certificate/appKey in the VM (to access the keyvault), we could limit access to that file to just the user account running the program. Other users or accounts wouldn't have access to the secrets in keyvault.
When we use Azure Managed Service Identity to access keyvault from an IaaS VM, my understanding is that any user logged into the VM or any program running on the machine can access the keyvault secrets - is this true?
And if it is, doesn't that decrease the security in case one of the user accounts is compromised?
According to the article access Azure Key Vault, it seems this is true. If MSI is enabled, just need to invoke web request in the VM without e.g. appKey.
And if it is, doesn't that decrease the security in case one of the user accounts is compromised?
It should be, but the prerequisites of the access to the secret in the keyvault is the VM service principal was added as a role in Access control (IAM) and Access policies.
If you want to increase the security, you may need to remove the VM service principal in the Access policies, then it will not be able to access the secret, if you want to the service principal does not have the access to the keyvault at all, remove its role in Access control (IAM).
For more details, you could refer to: Secure your key vault.
Update:
From the doc #Arturo mentioned, it is the fact.
Any code running on that VM, is able to call the managed identities for Azure resources endpoint and request tokens.
I have an application that runs in a Service Fabric(SF) cluster and I wan't to access Key Vault from it.
The cluster hosts a number of applications and I want to give access to a Key Vault for my application without giving access to the other applications. By default an application runs under the same user as the SF cluster, but each applicatiuon has it's own unique name, mine has the name fabric:/application1.
My question is, is it possible to create an Active Directory application account for fabric:/application1 and grant access to the key vault?
I know it is possible to use the RunAs options in the SF manifest, but that requires me storing an encrypted password in the manifest/source code and I want to try and avoid this if possible.
AFAIK,
The only way to have this flexibility is using ClientID & Secret or Service Principal certificates and each application manage their own credentials.
Service Principal Certificate is already integrated to AD, but does not require the application, the user or the Host to be part of the domain, the only requirement is setup an user on AD to grant the permissions on Keyvault.
There are other solutions using AD integration, like Managed identities for Azure resources(Former: Managed Service Identity) but I am not sure if you are able to restrict access per application like you described, because the MI add this as a service in the node, so technically other applicaitons would have access as well, worth a try to validate if you can restrict this.
If you want to try this approach, you can use with Microsoft.Azure.Services.AppAuthentication for implicit authentication of the services running in your cluster, where the nodes are setup with Managed Identities extension like described here.
Something link this:
When you use the Microsoft.Azure.Services.AppAuthentication, the Step 2 will be handled by the library and you won't have to add much changes to your key vault auth logic.
When you run your code on an Azure App Service or an Azure VM with a
managed identity enabled, the library automatically uses the managed
identity. No code changes are required.
The following docs describe other options you can use for KeyVault Authentication.
PS: I've done other KeyVault integrations using Client Secrets and Certificates and they are secure enough, With Certificates you can store it on the managed store or with the application, I would recommend MI only if is a requirement for your solution.