{"id":6127,"date":"2021-11-29T16:20:27","date_gmt":"2021-11-29T16:20:27","guid":{"rendered":"https:\/\/rakhesh.com\/?p=6127"},"modified":"2021-11-29T17:28:18","modified_gmt":"2021-11-29T17:28:18","slug":"authenticated-access-to-logic-apps-using-azure-ad-contd","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/azure\/authenticated-access-to-logic-apps-using-azure-ad-contd\/","title":{"rendered":"Authenticated access to Logic Apps using Azure AD (contd)"},"content":{"rendered":"<p>I couldn&#8217;t get to doing this day-before when I <a href=\"https:\/\/rakhesh.com\/azure\/authenticated-access-to-logic-apps-using-azure-ad\/\">first posted on authenticating to Logic Apps via Azure AD<\/a>. So this post is a continuation of that.<\/p>\n<p>Today I setup the Logic App to use an App Registration. This is very straighforward, and while not required I wanted a way to limit the Logic App to a group of users.<\/p>\n<p>I created a new App Registration with the following settings:<\/p>\n<ul>\n<li>Authentication &gt; Allow Public Flows<\/li>\n<li>API permissions &gt; Delegated permissions for Graph <code>User.Read<\/code> and <code>profile<\/code><\/li>\n<\/ul>\n<p>This is based on the App Registration that got created when <a href=\"https:\/\/rakhesh.com\/azure\/authenticating-against-azure-functions-using-azure-ad\/\">I did the same for Azure Functions<\/a>, the difference being this one is manually created. I went with the <code>profile<\/code> scope <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/develop\/access-tokens#payload-claims\">so I get additional details in the ID Token like Object ID, Username (UPN), and Name<\/a> but this is not needed if you don&#8217;t care for those.<\/p>\n<p>Next I <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/logic-apps\/logic-apps-securing-a-logic-app?tabs=azure-portal#enable-azure-ad-oauth-for-your-logic-app\">enabled Azure AD policies<\/a> on the Logic App. I went with requiring the <code>Issuer<\/code> (this is mandatory) being <code>https:\/\/login.microsoftonline.com\/&lt;tenantId&gt;\/v2.0<\/code> and <code>Audience<\/code> value being the app Id of the App Registration. This way only tokens intended for the App Registration will be accepted by the Logic App. In my previous post I mentioned <code>https:\/\/sts.windows.net<\/code> too but I decided to skip that the way I was going to get tokens now would be the v2 ones from login.microsoftonline.com.<\/p>\n<p>After that it&#8217;s straight forward to invoke the Logic App via it&#8217;s web Uri. All I have to do is get a token and then pass it to the Url while calling it. I am using the <a href=\"https:\/\/rakhesh.com\/aside\/easiest-ways-to-get-access-tokens\/\">Get-MSDeviceToken function I mentioned<\/a> in the previous post so I invoke it thusly:<\/p>\n<pre class=\"lang:default decode:true \">$tenantId = \"===changeme===\"\r\n$appId = \"===changeme===\"\r\n# I need 'profile' scope for oid\r\n# I need 'openid' scope to get the id_token else that is not returned\r\n$scope = \"User.Read openid profile\" \r\n\r\n$apiUrl = \"https:\/\/===changeme===\/triggers\/manual\/paths\/invoke?api-version=2016-10-01\"\r\n\r\nWrite-Output \"Authenticating with Azure AD to access $apiUrl.\"\r\n$aadtoken = Get-MSDeviceToken -TenantId $tenantId -AppId $appId -Scope $scope\r\n\r\n$header = @{\r\n    \"Authorization\" = \"Bearer \" + $aadtoken.id_token\r\n}\r\n\r\nInvoke-RestMethod -Method POST -Uri $apiUrl -Headers $header -ContentType 'application\/json'<\/pre>\n<p>Next up I wanted to get the user details. For that I resorted to getting the token from the headers:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-6131\" src=\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-16.58.55.png?resize=660%2C271&#038;ssl=1\" alt=\"\" width=\"660\" height=\"271\" srcset=\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-16.58.55.png?w=1320&amp;ssl=1 1320w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-16.58.55.png?resize=300%2C123&amp;ssl=1 300w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-16.58.55.png?resize=1024%2C420&amp;ssl=1 1024w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-16.58.55.png?resize=768%2C315&amp;ssl=1 768w\" sizes=\"(max-width: 660px) 100vw, 660px\" data-recalc-dims=\"1\" \/><\/p>\n<p>Here&#8217;s the underlying code view. I had to switch to that to add an extra bit <code>?['Authorization']<\/code> so I extract that from the headers.<\/p>\n<pre class=\"lang:default mark:7 decode:true \">\"Initialize_variable_(Token)\": {\r\n    \"inputs\": {\r\n        \"variables\": [\r\n            {\r\n                \"name\": \"Token\",\r\n                \"type\": \"string\",\r\n                \"value\": \"@{triggerOutputs()['headers']?['Authorization']}\"\r\n            }\r\n        ]\r\n    },\r\n    \"runAfter\": {},\r\n    \"type\": \"InitializeVariable\"\r\n}<\/pre>\n<p>Next I split that along the dot &#8211; which gives an array of objects &#8211; and I extract the second item in the array (which is the body; first part is header, last part is signature). Here&#8217;s the code view for that:<\/p>\n<pre class=\"lang:default decode:true \">\"Initialize_variable_(TokenBody)\": {\r\n    \"inputs\": {\r\n        \"variables\": [\r\n            {\r\n                \"name\": \"TokenBody\",\r\n                \"type\": \"string\",\r\n                \"value\": \"@{split(variables('Token'),'.')[1]}\"\r\n            }\r\n        ]\r\n    },\r\n    \"runAfter\": {\r\n        \"Initialize_variable_(Token)\": [\r\n            \"Succeeded\"\r\n        ]\r\n    },\r\n    \"type\": \"InitializeVariable\"\r\n}<\/pre>\n<p>What we get here is a base64 string and the next step would be to decode it to a string. When I tried that, however, the Logic App would fail and I saw that it was failing at this decode stage. I <a href=\"https:\/\/rakhesh.com\/azure\/using-key-vaults-to-encrypt-decrypt-data-between-automation-stuff\/\">had experienced something similar with PowerShell and base64 decoding earlier<\/a> so I knew just the fix for that. If were PowerShell I&#8217;d have done something like this:<\/p>\n<pre class=\"lang:default decode:true\">switch ($base64String.Length % 4) {\r\n    0 { break }\r\n    1 { $base64String += '===' }\r\n    2 { $base64String += '==' }\r\n    3 { $base64String += '=' }\r\n}\r\n\r\n[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($base64String))<\/pre>\n<p>The problem is that in base64 <a href=\"https:\/\/en.wikipedia.org\/wiki\/Base64#Decoding_Base64_with_padding\">every 4 characters are typically converted to 3 bytes<\/a>. So an entire base64 string must have a length that is a multiple of 4 (though <a href=\"https:\/\/stackoverflow.com\/questions\/21196434\/frombase64-string-length-must-be-multiple-or-4-or-not\">there are some bugs<\/a> due to which this may not always be the case). What the snippet above thus does is divide the length by 4 to get the remainder. If the remainder is 1 (e.g. the length is 29) that means we need to add 3 characters to get the length divisible by 4 (i.e. make it 32 in this example). And so on for remainders of 2 and 3.<\/p>\n<p>I have to thus do the same in the Logic App to correctly decode the header token. I put the whole thing in a Scope control to keep it neat and tidy:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-6132\" src=\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-17.25.15.png?resize=660%2C560&#038;ssl=1\" alt=\"\" width=\"660\" height=\"560\" srcset=\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-17.25.15.png?w=1582&amp;ssl=1 1582w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-17.25.15.png?resize=300%2C254&amp;ssl=1 300w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-17.25.15.png?resize=1024%2C869&amp;ssl=1 1024w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-17.25.15.png?resize=768%2C651&amp;ssl=1 768w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-17.25.15.png?resize=1536%2C1303&amp;ssl=1 1536w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2021\/11\/Screenshot-2021-11-29-at-17.25.15.png?w=1320&amp;ssl=1 1320w\" sizes=\"(max-width: 660px) 100vw, 660px\" data-recalc-dims=\"1\" \/><\/p>\n<p>The orange bit above is the Scope control. Here is its code:<\/p>\n<pre class=\"lang:default decode:true\">\"Decode_Token_Info_just_in_case\": {\r\n    \"actions\": {\r\n        \"Add_padding_to_TokenBody_if_needed\": {\r\n            \"cases\": {\r\n                \"Case_1\": {\r\n                    \"actions\": {\r\n                        \"Set_variable_(FixedTokenBody)_add_3\": {\r\n                            \"inputs\": {\r\n                                \"name\": \"FixedTokenBody\",\r\n                                \"value\": \"@{variables('TokenBody')}===\"\r\n                            },\r\n                            \"runAfter\": {},\r\n                            \"type\": \"SetVariable\"\r\n                        }\r\n                    },\r\n                    \"case\": 1\r\n                },\r\n                \"Case_2\": {\r\n                    \"actions\": {\r\n                        \"Set_variable_(FixedTokenBody)_add_2\": {\r\n                            \"inputs\": {\r\n                                \"name\": \"FixedTokenBody\",\r\n                                \"value\": \"@{variables('TokenBody')}==\"\r\n                            },\r\n                            \"runAfter\": {},\r\n                            \"type\": \"SetVariable\"\r\n                        }\r\n                    },\r\n                    \"case\": 2\r\n                },\r\n                \"Case_3\": {\r\n                    \"actions\": {\r\n                        \"Set_variable_(FixedTokenBody)_add_1\": {\r\n                            \"inputs\": {\r\n                                \"name\": \"FixedTokenBody\",\r\n                                \"value\": \"@{variables('TokenBody')}=\"\r\n                            },\r\n                            \"runAfter\": {},\r\n                            \"type\": \"SetVariable\"\r\n                        }\r\n                    },\r\n                    \"case\": 3\r\n                }\r\n            },\r\n            \"default\": {\r\n                \"actions\": {\r\n                    \"Set_variable_(FixedTokenBody)_add_nothing\": {\r\n                        \"inputs\": {\r\n                            \"name\": \"FixedTokenBody\",\r\n                            \"value\": \"@variables('TokenBody')\"\r\n                        },\r\n                        \"runAfter\": {},\r\n                        \"type\": \"SetVariable\"\r\n                    }\r\n                }\r\n            },\r\n            \"expression\": \"@mod(length(variables('TokenBody')),4)\",\r\n            \"runAfter\": {},\r\n            \"type\": \"Switch\"\r\n        },\r\n        \"Parse_JSON\": {\r\n            \"inputs\": {\r\n                \"content\": \"@decodeBase64(variables('FixedTokenBody'))\",\r\n                \"schema\": {\r\n                    \"properties\": {\r\n                        \"aio\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"aud\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"exp\": {\r\n                            \"type\": \"integer\"\r\n                        },\r\n                        \"iat\": {\r\n                            \"type\": \"integer\"\r\n                        },\r\n                        \"iss\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"name\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"nbf\": {\r\n                            \"type\": \"integer\"\r\n                        },\r\n                        \"oid\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"preferred_username\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"rh\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"sub\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"tid\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"uti\": {\r\n                            \"type\": \"string\"\r\n                        },\r\n                        \"ver\": {\r\n                            \"type\": \"string\"\r\n                        }\r\n                    },\r\n                    \"type\": \"object\"\r\n                }\r\n            },\r\n            \"runAfter\": {\r\n                \"Add_padding_to_TokenBody_if_needed\": [\r\n                    \"Succeeded\"\r\n                ]\r\n            },\r\n            \"type\": \"ParseJson\"\r\n        },\r\n        \"Set_variable_(RequestorEmail)\": {\r\n            \"inputs\": {\r\n                \"name\": \"RequestorEmail\",\r\n                \"value\": \"@body('Parse_JSON')?['preferred_username']\"\r\n            },\r\n            \"runAfter\": {\r\n                \"Parse_JSON\": [\r\n                    \"Succeeded\"\r\n                ]\r\n            },\r\n            \"type\": \"SetVariable\"\r\n        },\r\n        \"Set_variable_(RequestorName)\": {\r\n            \"inputs\": {\r\n                \"name\": \"RequestorName\",\r\n                \"value\": \"@body('Parse_JSON')?['name']\"\r\n            },\r\n            \"runAfter\": {\r\n                \"Parse_JSON\": [\r\n                    \"Succeeded\"\r\n                ]\r\n            },\r\n            \"type\": \"SetVariable\"\r\n        },\r\n        \"Set_variable_(RequestorOID)\": {\r\n            \"inputs\": {\r\n                \"name\": \"RequestorOID\",\r\n                \"value\": \"@body('Parse_JSON')?['oid']\"\r\n            },\r\n            \"runAfter\": {\r\n                \"Parse_JSON\": [\r\n                    \"Succeeded\"\r\n                ]\r\n            },\r\n            \"type\": \"SetVariable\"\r\n        }\r\n    },\r\n    \"runAfter\": {\r\n        \"Initialize_variable_(RequestorEmail)\": [\r\n            \"Succeeded\"\r\n        ]\r\n    },\r\n    \"type\": \"Scope\"\r\n},<\/pre>\n<p>This is probably of no use to anyone else but I spent some time creating this so I figure why not put it on the Interwebs. :) You can&#8217;t assign a variable to itself, that&#8217;s why I have two set of variables <code>TokenBody<\/code> and <code>FixedTokenBody<\/code> with the latter being the one I add padding to if needed. After fixing I decode the base64 and then parse the JSON. The Parse JSON action has this as the input: <code>@decodeBase64(variables('FixedTokenBody'))<\/code>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I couldn&#8217;t get to doing this day-before when I first posted on authenticating to Logic Apps via Azure AD. So this post is a continuation of that. Today I setup the Logic App to use an App Registration. This is very straighforward, and while not required I wanted a way to limit the Logic App &hellip; <a href=\"https:\/\/rakhesh.com\/azure\/authenticated-access-to-logic-apps-using-azure-ad-contd\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Authenticated access to Logic Apps using Azure AD (contd)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[887],"tags":[982,1046],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6127"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=6127"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6127\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=6127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=6127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=6127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}