Web Apps - Update Auth Settings

Reference

Service:: App Service

API Version:: 2024-04-01

Description for Updates the Authentication / Authorization settings associated with web app.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/config/authsettings?api-version=2024-04-01

URI Parameters

Name	In	Required	Type	Description
name	path	True	string	Name of web app.
resourceGroupName	path	True	string	Name of the resource group to which the resource belongs. Regex pattern: `^[-\w\._]+[^\.]$`
subscriptionId	path	True	string	Your Azure subscription ID. This is a GUID-formatted string (e.g. 00000000-0000-0000-0000-000000000000).
api-version	query	True	string	API Version

Request Body

Name	Type	Description
kind	string	Kind of resource.
properties.aadClaimsAuthorization	string	Gets a JSON string containing the Azure AD Acl settings.
properties.additionalLoginParams	string[]	Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value".
properties.allowedAudiences	string[]	Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting.
properties.allowedExternalRedirectUrls	string[]	External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed.
properties.authFilePath	string	The path of the config file containing auth settings. If the path is relative, base will the site's root directory.
properties.clientId	string	The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
properties.clientSecret	string	The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
properties.clientSecretCertificateThumbprint	string	An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional.
properties.clientSecretSettingName	string	The app setting name that contains the client secret of the relying party application.
properties.configVersion	string	The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization.
properties.defaultProvider	BuiltInAuthenticationProvider	The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
properties.enabled	boolean	`true` if the Authentication / Authorization feature is enabled for the current app; otherwise, `false`.
properties.facebookAppId	string	The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
properties.facebookAppSecret	string	The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
properties.facebookAppSecretSettingName	string	The app setting name that contains the app secret used for Facebook Login.
properties.facebookOAuthScopes	string[]	The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
properties.gitHubClientId	string	The Client Id of the GitHub app used for login. This setting is required for enabling Github login
properties.gitHubClientSecret	string	The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login.
properties.gitHubClientSecretSettingName	string	The app setting name that contains the client secret of the Github app used for GitHub Login.
properties.gitHubOAuthScopes	string[]	The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication. This setting is optional
properties.googleClientId	string	The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
properties.googleClientSecret	string	The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
properties.googleClientSecretSettingName	string	The app setting name that contains the client secret associated with the Google web application.
properties.googleOAuthScopes	string[]	The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, "openid", "profile", and "email" are used as default scopes. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
properties.isAuthFromFile	string	"true" if the auth config settings should be read from a file, "false" otherwise
properties.issuer	string	The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html
properties.microsoftAccountClientId	string	The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
properties.microsoftAccountClientSecret	string	The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
properties.microsoftAccountClientSecretSettingName	string	The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
properties.microsoftAccountOAuthScopes	string[]	The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, "wl.basic" is used as the default scope. Microsoft Account Scopes and permissions documentation: https://msdn.microsoft.com/en-us/library/dn631845.aspx
properties.runtimeVersion	string	The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module.
properties.tokenRefreshExtensionHours	number	The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours.
properties.tokenStoreEnabled	boolean	`true` to durably store platform-specific security tokens that are obtained during login flows; otherwise, `false`. The default is `false`.
properties.twitterConsumerKey	string	The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
properties.twitterConsumerSecret	string	The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
properties.twitterConsumerSecretSettingName	string	The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
properties.unauthenticatedClientAction	UnauthenticatedClientAction	The action to take when an unauthenticated client attempts to access the app.
properties.validateIssuer	boolean	Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such.

Responses

Name	Type	Description
200 OK	SiteAuthSettings	OK
Other Status Codes	DefaultErrorResponse	App Service error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Update Auth Settings

Sample request

PUT https://management.azure.com/subscriptions/34adfa4f-cedf-4dc0-ba29-b6d1a69ab345/resourceGroups/testrg123/providers/Microsoft.Web/sites/sitef6141/config/authsettings?api-version=2024-04-01

{
  "properties": {
    "enabled": true,
    "runtimeVersion": "~1",
    "unauthenticatedClientAction": "RedirectToLoginPage",
    "tokenStoreEnabled": true,
    "allowedExternalRedirectUrls": [
      "sitef6141.customdomain.net",
      "sitef6141.customdomain.info"
    ],
    "defaultProvider": "Google",
    "tokenRefreshExtensionHours": 120,
    "clientId": "42d795a9-8abb-4d06-8534-39528af40f8e.apps.googleusercontent.com"
  }
}

package armappservice_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/appservice/armappservice/v4"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/b5d78da207e9c5d8f82e95224039867271f47cdf/specification/web/resource-manager/Microsoft.Web/stable/2024-04-01/examples/UpdateAuthSettings.json
func ExampleWebAppsClient_UpdateAuthSettings() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armappservice.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewWebAppsClient().UpdateAuthSettings(ctx, "testrg123", "sitef6141", armappservice.SiteAuthSettings{
		Properties: &armappservice.SiteAuthSettingsProperties{
			AllowedExternalRedirectUrls: []*string{
				to.Ptr("sitef6141.customdomain.net"),
				to.Ptr("sitef6141.customdomain.info")},
			ClientID:                    to.Ptr("42d795a9-8abb-4d06-8534-39528af40f8e.apps.googleusercontent.com"),
			DefaultProvider:             to.Ptr(armappservice.BuiltInAuthenticationProviderGoogle),
			Enabled:                     to.Ptr(true),
			RuntimeVersion:              to.Ptr("~1"),
			TokenRefreshExtensionHours:  to.Ptr[float64](120),
			TokenStoreEnabled:           to.Ptr(true),
			UnauthenticatedClientAction: to.Ptr(armappservice.UnauthenticatedClientActionRedirectToLoginPage),
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.SiteAuthSettings = armappservice.SiteAuthSettings{
	// 	Name: to.Ptr("authsettings"),
	// 	Type: to.Ptr("Microsoft.Web/sites/authsettings"),
	// 	ID: to.Ptr("/subscriptions/34adfa4f-cedf-4dc0-ba29-b6d1a69ab345/resourceGroups/testrg123/providers/Microsoft.Web/sites/sitef6141/config/authsettings"),
	// 	Kind: to.Ptr("app"),
	// 	Properties: &armappservice.SiteAuthSettingsProperties{
	// 		AllowedExternalRedirectUrls: []*string{
	// 			to.Ptr("sitef6141.customdomain.net"),
	// 			to.Ptr("sitef6141.customdomain.info")},
	// 			ClientID: to.Ptr("42d795a9-8abb-4d06-8534-39528af40f8e.apps.googleusercontent.com"),
	// 			DefaultProvider: to.Ptr(armappservice.BuiltInAuthenticationProviderGoogle),
	// 			Enabled: to.Ptr(true),
	// 			RuntimeVersion: to.Ptr("~1"),
	// 			TokenRefreshExtensionHours: to.Ptr[float64](120),
	// 			TokenStoreEnabled: to.Ptr(true),
	// 			UnauthenticatedClientAction: to.Ptr(armappservice.UnauthenticatedClientActionRedirectToLoginPage),
	// 		},
	// 	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.AppService.Models;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.AppService;

// Generated from example definition: specification/web/resource-manager/Microsoft.Web/stable/2024-04-01/examples/UpdateAuthSettings.json
// this example is just showing the usage of "WebApps_UpdateAuthSettings" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this WebSiteResource created on azure
// for more information of creating WebSiteResource, please refer to the document of WebSiteResource
string subscriptionId = "34adfa4f-cedf-4dc0-ba29-b6d1a69ab345";
string resourceGroupName = "testrg123";
string name = "sitef6141";
ResourceIdentifier webSiteResourceId = WebSiteResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, name);
WebSiteResource webSite = client.GetWebSiteResource(webSiteResourceId);

// invoke the operation
SiteAuthSettings siteAuthSettings = new SiteAuthSettings()
{
    IsEnabled = true,
    RuntimeVersion = "~1",
    UnauthenticatedClientAction = UnauthenticatedClientAction.RedirectToLoginPage,
    IsTokenStoreEnabled = true,
    AllowedExternalRedirectUrls =
    {
    "sitef6141.customdomain.net","sitef6141.customdomain.info"
    },
    DefaultProvider = BuiltInAuthenticationProvider.Google,
    TokenRefreshExtensionHours = 120,
    ClientId = "42d795a9-8abb-4d06-8534-39528af40f8e.apps.googleusercontent.com",
};
SiteAuthSettings result = await webSite.UpdateAuthSettingsAsync(siteAuthSettings);

Console.WriteLine($"Succeeded: {result}");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "id": "/subscriptions/34adfa4f-cedf-4dc0-ba29-b6d1a69ab345/resourceGroups/testrg123/providers/Microsoft.Web/sites/sitef6141/config/authsettings",
  "name": "authsettings",
  "type": "Microsoft.Web/sites/authsettings",
  "kind": "app",
  "properties": {
    "enabled": true,
    "runtimeVersion": "~1",
    "unauthenticatedClientAction": "RedirectToLoginPage",
    "tokenStoreEnabled": true,
    "allowedExternalRedirectUrls": [
      "sitef6141.customdomain.net",
      "sitef6141.customdomain.info"
    ],
    "defaultProvider": "Google",
    "tokenRefreshExtensionHours": 120,
    "clientId": "42d795a9-8abb-4d06-8534-39528af40f8e.apps.googleusercontent.com"
  }
}

Definitions

Name	Description
BuiltInAuthenticationProvider	The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
DefaultErrorResponse	App Service error response.
Details
Error	Error model.
SiteAuthSettings	Configuration settings for the Azure App Service Authentication / Authorization feature.
UnauthenticatedClientAction	The action to take when an unauthenticated client attempts to access the app.

BuiltInAuthenticationProvider

The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".

Name	Type	Description
AzureActiveDirectory	string
Facebook	string
Github	string
Google	string
MicrosoftAccount	string
Twitter	string

DefaultErrorResponse

App Service error response.

Name	Type	Description
error	Error	Error model.

Details

Name	Type	Description
code	string	Standardized string to programmatically identify the error.
message	string	Detailed error description and debugging information.
target	string	Detailed error description and debugging information.

Error

Error model.

Name	Type	Description
code	string	Standardized string to programmatically identify the error.
details	Details[]	Detailed errors.
innererror	string	More information to debug error.
message	string	Detailed error description and debugging information.
target	string	Detailed error description and debugging information.

SiteAuthSettings

Configuration settings for the Azure App Service Authentication / Authorization feature.

Name	Type	Description
id	string	Resource Id.
kind	string	Kind of resource.
name	string	Resource Name.
properties.aadClaimsAuthorization	string	Gets a JSON string containing the Azure AD Acl settings.
properties.additionalLoginParams	string[]	Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value".
properties.allowedAudiences	string[]	Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting.
properties.allowedExternalRedirectUrls	string[]	External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed.
properties.authFilePath	string	The path of the config file containing auth settings. If the path is relative, base will the site's root directory.
properties.clientId	string	The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
properties.clientSecret	string	The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
properties.clientSecretCertificateThumbprint	string	An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional.
properties.clientSecretSettingName	string	The app setting name that contains the client secret of the relying party application.
properties.configVersion	string	The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization.
properties.defaultProvider	BuiltInAuthenticationProvider	The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
properties.enabled	boolean	`true` if the Authentication / Authorization feature is enabled for the current app; otherwise, `false`.
properties.facebookAppId	string	The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
properties.facebookAppSecret	string	The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
properties.facebookAppSecretSettingName	string	The app setting name that contains the app secret used for Facebook Login.
properties.facebookOAuthScopes	string[]	The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
properties.gitHubClientId	string	The Client Id of the GitHub app used for login. This setting is required for enabling Github login
properties.gitHubClientSecret	string	The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login.
properties.gitHubClientSecretSettingName	string	The app setting name that contains the client secret of the Github app used for GitHub Login.
properties.gitHubOAuthScopes	string[]	The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication. This setting is optional
properties.googleClientId	string	The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
properties.googleClientSecret	string	The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
properties.googleClientSecretSettingName	string	The app setting name that contains the client secret associated with the Google web application.
properties.googleOAuthScopes	string[]	The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, "openid", "profile", and "email" are used as default scopes. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
properties.isAuthFromFile	string	"true" if the auth config settings should be read from a file, "false" otherwise
properties.issuer	string	The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html
properties.microsoftAccountClientId	string	The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
properties.microsoftAccountClientSecret	string	The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
properties.microsoftAccountClientSecretSettingName	string	The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
properties.microsoftAccountOAuthScopes	string[]	The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, "wl.basic" is used as the default scope. Microsoft Account Scopes and permissions documentation: https://msdn.microsoft.com/en-us/library/dn631845.aspx
properties.runtimeVersion	string	The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module.
properties.tokenRefreshExtensionHours	number	The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours.
properties.tokenStoreEnabled	boolean	`true` to durably store platform-specific security tokens that are obtained during login flows; otherwise, `false`. The default is `false`.
properties.twitterConsumerKey	string	The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
properties.twitterConsumerSecret	string	The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
properties.twitterConsumerSecretSettingName	string	The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
properties.unauthenticatedClientAction	UnauthenticatedClientAction	The action to take when an unauthenticated client attempts to access the app.
properties.validateIssuer	boolean	Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such.
type	string	Resource type.

UnauthenticatedClientAction

The action to take when an unauthenticated client attempts to access the app.

Name	Type	Description
AllowAnonymous	string
RedirectToLoginPage	string

Dela via