the case here, i need to call azure function from outside the azure from web app through azure AAD-Oauth2.
The easy authentication has been configured for azure function.
There are 2 app Registration created:
- the first one is api-app reg for Azure function which is created during configuring the Easy Authentication for azure function
- the second one is client-app reg and adapt the necessary application permission
The problem is, if i try to call azure function through postman,
i create firstly get a token through client credentials (with client secret und client id of second app reg):
“https://login.microsoftonline.com/xxxxx-tenant-id-xxxxx/oauth2/v2.0/token”
then afterthat i try to call the azure function with bearer token, then i have got this error
Forbidden 403 – “You do not have permission to view this directory or page.”
Azure Function url: https://webapp01.azurewebsites.net/api/HttpTrigger1?name=azure01
i think the issue, if i call the function, then request is not going to the function and the azure blocked the request for any reason. maybe, the token is not right!
That is the content of token:
{
"aud": "api://50a-xx-xxx-xxx",
"iss": "https://sts.windows.net/xxx-xxx-xx-xxxx/",
"iat": 1725464551,
"nbf": 1725464551,
"exp": 1725468451,
"aio": "E2dgYCjjk5Sw22y9K0dUIxxxxxxx",
"appid": "xx-xx-xxx-xxx",
"appidacr": "1",
"idp": "https://sts.windows.net/xx-xxxx-xxx-xxxx/",
"oid": "fbxx-xxx-xxx-xx",
"rh": "0.Aa8AYuDbAiI46UqAc7EpL6NmODqlrFAahSRLgOxxxxxxxxx",
"roles": [
"FunctionReader"
],
"sub": "fbxx-xxx-xx-xx",
"tid": "02xx-xx-x-xxx",
"uti": "0kwCap10NES-sH0PXmr2AA",
"ver": "1.0"
}
I tried the token with ver 1.0 and 2.0 but it the same problem
Is there any idea to get a solution for this problem or workaround?
Thank you
I tried here token with v1 and v2 but not working
i used “ID Token”
i tried “iss”: “https://sts.windows.net/xxx-xxx-xx-xxxx/v2.0 with v2.0 and without v2.0
I have added the client id of second app in Authentication of function app.
Also add the function app permission and redirect URIs in the second client app.
Then, you can generate the token using given url.
https://login.microsoftonline.com/{tenant_Id}/oauth2/v2.0/authorize
?client_id={client_Id of second app}
&response_type=token
&redirect_uri=https://jwt.ms
&scope=api://{client_id of function app}/.default
&response_mode=fragment
&state=12345
Use the generated token while invoking function.
By doing so, I am able to access the function url.