dockerazure-functionsazure-functions-runtime

Http Trigger Azure Function in Docker with non anonymous authLevel


I am playing around with an Http Triggered Azure Functions in a Docker container. Up to now all tutorials and guides I found on setting this up configure the Azure Function with the authLevel" set to anonymous.

After reading this blog carefully it seems possible (although tricky) to also configure other authentication levels. Unfortunately the promised follow up blogpost has not (yet) been written.

Can anyone help me clarify on how I would go about and set this up?


Solution

  • To control the master key the Function host uses on startup - instead of generating random keys - prepare our own host_secrets.json file like

    {
        "masterKey": {
            "name": "master",
            "value": "asGmO6TCW/t42krL9CljNod3uG9aji4mJsQ7==",
            "encrypted": false
        },
        "functionKeys": [{
            "name": "default",
            "value": "asGmO6TCW/t42krL9CljNod3uG9aji4mJsQ7==",
            "encrypted": false
        }]
    }
    

    and then feed this file into the designated secrets folder of the Function host (Dockerfile):

    for V1 Functions (assuming your runtime root is C:\WebHost):

    ...
    ADD host_secrets.json C:\\WebHost\\SiteExtensions\\Functions\\App_Data\\Secrets\\host.json
    ...
    

    for V2 Functions (assuming your runtime root is C:\runtime):

    ...
    ADD host_secret.json C:\\runtime\\Secrets\\host.json
    
    USER ContainerAdministrator
    RUN icacls "c:\runtime\secrets" /t /grant Users:M
    USER ContainerUser
    
    ENV AzureWebJobsSecretStorageType=files
    ...
    

    The function keys can be used to call protected functions like .../api/myfunction?code=asGmO6TCW/t42krL9CljNod3uG9aji4mJsQ7==.

    The master key can be used to call Functions Admin API and Key management API.

    In my blog I describe the whole journey of bringing V1 and later V2 Functions runtime into Docker containers and host those in Service Fabric.

    for V3 Functions on Windows:

    ENV FUNCTIONS_SECRETS_PATH=C:\Secrets
    ENV AzureWebJobsSecretStorageType=Files
    ADD host_secrets.json C:\\Secrets\\host.json
    

    for V3 Functions on Linux:

    RUN mkdir /etc/secrets/
    ENV FUNCTIONS_SECRETS_PATH=/etc/secrets
    ENV AzureWebJobsSecretStorageType=Files
    ADD host_secrets.json /etc/secrets/host.json