Blog Post

Azure Integration Services Blog
2 MIN READ

Secure Logic App HTTP endpoint with Azure AD integration

VeeraReddy's avatar
VeeraReddy
Iron Contributor
Jun 09, 2020

Overview: 

We have several ways to secure the Logic App endpoints like restricting inbound IP addresses, using SAS keys and API management instance. API management allows us to secure endpoints with various authentication modes such as client certificates, Oauth and basic credentials authentication.

 

We can  also authorize Logic App HTTP endpoints using Oauth token with the new feature in Logic App "Authorization".You can follow the steps below for implementing this.

 

Implementation:

  • We have to create an App Registration (Service Principal) in Azure Active Directory . Go to Azure AD and Click on App registrations to add new registration.

  • Open created App registration, Select certificates and secrets and add new secret. Copy the client secret value as it won't be visible later on.
  • Collect App registration details from overview page i.e. Client Id, Tenant Id. Which we will be using later to generate Oauth token to access Logic App endpoint.

  • Now, we can configure any existing or new Logic App which has HTTP trigger endpoint to authenticate with OAuth tokens.
  • Go to Logic App --> Authorization and add new Policy and claims to authenticate with Oauth tokens as in screenshot below.

Issuer: https://sts.windows.net/{{TenantId}}/

Audience: https://management.azure.com

  • Now, Logic App endpoint supports with Oauth authentication. Now ,generate the Oauth token using App registration details and trigger Logic App with the Oauth token.

REST API to generate OAuth tokens:

URL: https://login.microsoftonline.com/{{tenantId}}/oauth2/token

Verb: POST

Parameters:

Client_Secret: client secret collected in App registration

grant_type: client_credentials

client_id : Application Id of App registration

resource: https://management.azure.com

Trigger LogicApp HTTP endpoint with OAuth token:

  • Go to LogicApp and get the HTTP endpoint URL and remove SAS key from URL.

Example: https://prod-17.centralindia.logic.azure.com:443/workflows/d04bc34e3fdd403091de956ed28c48cd/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=Bq9fGp3wZ0Q7mDTdozBtvlljpXBIrGevi394_19RuHY

 

Modified : https://prod-17.centralindia.logic.azure.com:443/workflows/d04bc34e3fdd403091de956ed28c48cd/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0

  • Now we can call the endpoint above with OAuth token (Bearer key ) collected above as in screenshot below.

References:

https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app#secure-triggers

https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app#enable-azure-active-directory-oauth

 

Updated Jun 09, 2020
Version 1.0
Azure AD
Logic App
LogicApps
OAuth
SAS
service principal
  • VeeraReddy's avatar
    VeeraReddy
    Iron Contributor
    May 17, 2021

    Hi spnelli ,

     

    Could you check the generated OAuth token from SPN is matching with the Claims policies set on Logic App Authorization blade.

     

    You can decode the bearer token fetched using JSON Web Tokens - jwt.io to verify the claims.

     

    Most common mistake would be adding the / at the end of the issuer claim after tenant id as highlighted below. Could you check it as well please.

     

    Issuer: https://sts.windows.net/{{TenantId}}/

  • spnelli's avatar
    spnelli
    Copper Contributor
    May 15, 2021

    I already have a Logic App Dev integration App registered and I am using that to generate access token by passing the required details mentioned. But when I pass that token to trigger logic app It is throwing me error -

    {
        "error": {
            "code": "MisMatchingOAuthClaims",
            "message": "One or more claims either missing or does not match with the open authentication access control policy."
        }
    }
     
    I am not sure what I am doing is wrong. I have added audience and issuer. 
     
    There is a slight catch here - We created this APP for fetching the token only and the token is also used by some other custom API by passing different resource. I am not sure if this is the problem. Or should I have to create a new APP just for this. If yes, then why I can't use this by passing different resource as mentioned here. I am new to azure so probably lill aware of deep understanding that goes around here. 
  • spnelli's avatar
    spnelli
    Copper Contributor
    May 17, 2021

    Hi VeeraReddy 

     

    Yes, your reply solved my query. That was the only problem. Thank you so much.

     

    But I moved to MSI approach of authenticating. I imported the logic app as APIM and updated the policies. You can refer here  - 

    https://securecloud.blog/2021/02/09/deep-diver-hardening-authentication-and-authorization-between-logic-apps-and-api-management/

     

    I have followed steps here. But the problem is I couldn't get the logic app run after adding 

    "@startsWith(triggerOutputs()?['headers']?['Authorization'], 'Bearer' )" it is throwing below error.

     

    { "error":

    { "code": "InvalidTemplate",

    "message": "The template language expression evaluation failed: 'The template language function 'startsWith' expects its first parameter to be of type string. The provided value is of type 'Null'. Please see https://aka.ms/logicexpressions#startswith for usage details.'." } }

     

    Do you have any idea here  ? What can be the case ? What I am doing is wrong ?

    There is so many ways I suppose to authenticate Logic app. 

     

  • GianniStillavato's avatar
    GianniStillavato
    Copper Contributor
    Sep 27, 2021

    Hello VeeraReddy.

    Thanks for the tutorial. 

    I'm missing a step here. During the App Registration what do i have to insert in the Redirect URI field? Is it always mandatory to insert it?

     

    Thanks

    Gianni

  • Xuehong_Gan's avatar
    Xuehong_Gan
    Icon for Microsoft rankMicrosoft
    Nov 19, 2021

    spnelli 

    Unfortunately the Bearer token is not accessible inside logic app. That's why the error message says it is null. 

  • nilsandrey's avatar
    nilsandrey
    Copper Contributor
    Apr 13, 2023

    @spnelli by default the Bearer token is not accessible inside the logic app BUT can be if you include the `operationOptions` member in the request trigger:

    "request": {
    "inputs": {
        "schema": {}
    },
    "kind": "Http",
    "type": "Request",
    "operationOptions": "IncludeAuthorizationHeadersInOutputs"
}
  • Sangram1155's avatar
    Sangram1155
    Copper Contributor
    May 21, 2024

    VeeraReddy 

     

    When I try to generate Oauth token getting below error in response:

    "Aceess to default Directory tenant is denied"

     

    What could be the issue here?