Azure Function 自定义 API 身份验证

Question

我有一个 HTTP 触发的 azure 函数，我的一个 Web 应用程序正在使用该函数。该网站的用户是注册该网站的任何人。现在，我想以只有注册用户才能通过我的网站访问 azure 函数的方式实现对 azure 函数的身份验证。我可以看到许多内置身份验证，例如 azure 函数、使用 Azure AD 的 OAuth 和其他身份提供商等。我正在寻找一种方法来对通过我的网站而不是身份提供商注册的用户进行身份验证。

我能想到的一个解决方案是在注册时将该用户注册到 Azure AD。然后，在调用 API 时，将用户凭据传递给 API 并根据 AD 进行验证。有人可以建议这是一个好的解决方案吗？如果没有，请建议适合我的用例的最佳解决方案。

我不想使用任何外部身份验证提供商

Answer 1

仅引用文档:

• Azure functions HTTP Trigger - Authorization keys

  While keys may help obfuscate your HTTP endpoints during development, they are not intended as a way to secure an HTTP trigger in production. To learn more, see Secure an HTTP endpoint in production.

• 第二个链接Secure an HTTP endpoint in production提供有关如何保护 HTTP 触发函数的更多见解:

  To fully secure your function endpoints in production, you should consider implementing one of the following function app-level security options:

  • Turn on App Service Authentication / Authorization for your function app. The App Service platform lets use Azure Active Directory (AAD) and several third-party identity providers to authenticate clients. You can use this to implement custom authorization rules for your functions, and you can work with user information from your function code. To learn more, see Authentication and authorization in Azure App Service and Working with client identities.
  • Use Azure API Management (APIM) to authenticate requests. APIM provides a variety of API security options for incoming requests. To learn more, see API Management authentication policies. With APIM in place, you can configure your function app to accept requests only from the IP address of your APIM instance. To learn more, see IP address restrictions.
  • Deploy your function app to an Azure App Service Environment (ASE). ASE provides a dedicated hosting environment in which to run your functions. ASE lets you configure a single front-end gateway that you can use to authenticate all incoming requests. For more information, see Configuring a Web Application Firewall (WAF) for App Service Environment.