Secure Logic App HTTP endpoint with Azure AD integration

[VeeraReddy]

Overview: 

We have several ways to secure the Logic App endpoints like restricting inbound IP addresses, using SAS keys and API management instance. API management allows us to secure endpoints with various authentication modes such as client certificates, Oauth and basic credentials authentication.

We can  also authorize Logic App HTTP endpoints using Oauth token with the new feature in Logic App "Authorization".You can follow the steps below for implementing this.

Implementation:

• We have to create an App Registration (Service Principal) in Azure Active Directory . Go to Azure AD and Click on App registrations to add new registration.

• Open created App registration, Select certificates and secrets and add new secret. Copy the client secret value as it won't be visible later on.
• Collect App registration details from overview page i.e. Client Id, Tenant Id. Which we will be using later to generate Oauth token to access Logic App endpoint.

• Now, we can configure any existing or new Logic App which has HTTP trigger endpoint to authenticate with OAuth tokens.
• Go to Logic App --> Authorization and add new Policy and claims to authenticate with Oauth tokens as in screenshot below.

Issuer: https://sts.windows.net/{{TenantId}}/

Audience: https://management.azure.com

• Now, Logic App endpoint supports with Oauth authentication. Now ,generate the Oauth token using App registration details and trigger Logic App with the Oauth token.

REST API to generate OAuth tokens:

URL: https://login.microsoftonline.com/{{tenantId}}/oauth2/token

Verb: POST

Parameters:

Client_Secret: client secret collected in App registration

grant_type: client_credentials

client_id : Application Id of App registration

resource: https://management.azure.com

Trigger LogicApp HTTP endpoint with OAuth token:

• Go to LogicApp and get the HTTP endpoint URL and remove SAS key from URL.

Example: https://prod-17.centralindia.logic.azure.com:443/workflows/d04bc34e3fdd403091de956ed28c48cd/triggers...&sig=Bq9fGp3wZ0Q7mDTdozBtvlljpXBIrGevi394_19RuHY

Modified : https://prod-17.centralindia.logic.azure.com:443/workflows/d04bc34e3fdd403091de956ed28c48cd/triggers...

• Now we can call the endpoint above with OAuth token (Bearer key ) collected above as in screenshot below.

References:

https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app#secure-triggers

https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app#enable-azure-activ...

[spnelli]

I already have a Logic App Dev integration App registered and I am using that to generate access token by passing the required details mentioned. But when I pass that token to trigger logic app It is throwing me error -

{

    "error": {

        "code": "MisMatchingOAuthClaims",

        "message": "One or more claims either missing or does not match with the open authentication access control policy."

    }

}

I am not sure what I am doing is wrong. I have added audience and issuer. 

There is a slight catch here - We created this APP for fetching the token only and the token is also used by some other custom API by passing different resource. I am not sure if this is the problem. Or should I have to create a new APP just for this. If yes, then why I can't use this by passing different resource as mentioned here. I am new to azure so probably lill aware of deep understanding that goes around here. 

[VeeraReddy]

Hi @spnelli ,

Could you check the generated OAuth token from SPN is matching with the Claims policies set on Logic App Authorization blade.

You can decode the bearer token fetched using JSON Web Tokens - jwt.io to verify the claims.

Most common mistake would be adding the / at the end of the issuer claim after tenant id as highlighted below. Could you check it as well please.

Issuer: https://sts.windows.net/{{TenantId}}/

[spnelli]

Hi @VeeraReddy 

Yes, your reply solved my query. That was the only problem. Thank you so much.

But I moved to MSI approach of authenticating. I imported the logic app as APIM and updated the policies. You can refer here  - 

https://securecloud.blog/2021/02/09/deep-diver-hardening-authentication-and-authorization-between-lo...

I have followed steps here. But the problem is I couldn't get the logic app run after adding 

"@startsWith(triggerOutputs()?['headers']?['Authorization'], 'Bearer' )" it is throwing below error.

{ "error":

{ "code": "InvalidTemplate",

"message": "The template language expression evaluation failed: 'The template language function 'startsWith' expects its first parameter to be of type string. The provided value is of type 'Null'. Please see https://aka.ms/logicexpressions#startswith for usage details.'." } }

Do you have any idea here  ? What can be the case ? What I am doing is wrong ?

There is so many ways I suppose to authenticate Logic app. 

[GianniStillavato]

Hello VeeraReddy.

Thanks for the tutorial. 

I'm missing a step here. During the App Registration what do i have to insert in the Redirect URI field? Is it always mandatory to insert it?

Thanks

Gianni

[VeeraReddy]

Hi @GianniStillavato ,

you can leave it default while creating the app registration in AD.

[xgan]

@spnelli 

Unfortunately the Bearer token is not accessible inside logic app. That's why the error message says it is null. 

[nilsandrey]

@spnelli by default the Bearer token is not accessible inside the logic app BUT can be if you include the `operationOptions` member in the request trigger:

"request": {
    "inputs": {
        "schema": {}
    },
    "kind": "Http",
    "type": "Request",
    "operationOptions": "IncludeAuthorizationHeadersInOutputs"
}