azure ARm 模板 - 无法将 AD 应用程序注册与功能应用程序关联

Question

背景

我正在尝试为我的函数应用程序创建 AD 应用程序注册以用于身份验证。我希望它仅供我们的租户使用，使用 Azure AD。该应用程序是由几个端点组成的功能应用程序

当我部署下面的 ARM 模板时，我没有收到任何错误，但在仔细研究并将其与我为应用程序手动创建身份验证时发生的情况进行比较时，我发现以下问题:

• 应用程序注册已创建，但未指定应用程序 ID URI。当我通过门户手动创建它时，我相信它会自动填充值“api://[applicationClientId]”
• 没有定义范围。同样，当我通过门户手动为我的应用程序创建身份验证策略时，它确实为我创建了 user_impersonation 范围。
• 当我在门户中打开功能应用程序时，在“身份验证”下，此新应用程序注册尚未与其关联/或添加。

代码

ARM 模板如下所示:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "functionAppName": {
      "type": "string",
      "defaultValue": "[concat('widgets-', uniqueString(resourceGroup().id),'-app')]",
      "minLength": 2,
      "metadata": {
        "description": "my function app"
      }
    },
    "storageAccountName": {
      "type": "string",
      "defaultValue": "[concat('widgets', uniqueString(resourceGroup().id))]",
      "minLength": 2,
      "metadata": {
        "description": "StorageAccount"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    },
    "serviceBusNamespaceName": {
      "type": "string",
      "defaultValue": "[concat('widgets-', uniqueString(resourceGroup().id),'-bus')]",
      "metadata": {
        "description": "Name of the Service Bus namespace"
      }
    },
    "serviceBusQueueName": {
      "type": "string",
      "defaultValue": "workspaces",
      "metadata": {
        "description": "Name of the Queue"
      }
    },
    "queueAuthorizationRuleName": {
      "type": "string",
      "defaultValue": "myRule",
      "metadata": {
        "description": "Name of the Queue AuthorizationRule"
      }
    },
    "aadAppClientId": {
      "type": "string"
    },
    "tenant": {
      "type": "string"
    }
  },
  "variables": {
    "appServicePlanPortalName": "[concat(parameters('functionAppName'),'servicePlan')]",
    "appInsightsName": "[concat(parameters('functionAppName'),'-insights')]",
    "identityName": "[concat(parameters('functionAppName'),'-userId')]",
    "clientSecret": ""
  },
  "resources": [
    {
      "name": "[variables('identityName')]",
      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
      "apiVersion": "2018-11-30",
      "location": "[parameters('location')]"
    },
    {
      "type": "Microsoft.Storage/storageAccounts",
      "name": "[parameters('storageAccountName')]",
      "apiVersion": "2019-06-01",
      "location": "[parameters('location')]",
      "kind": "StorageV2",
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/queueServices",
      "apiVersion": "2020-08-01-preview",
      "name": "[concat(parameters('storageAccountName'), '/default')]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ],
      "properties": {
        "cors": {
          "corsRules": []
        }
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
      "apiVersion": "2020-08-01-preview",
      "name": "[concat(parameters('storageAccountName'), '/default/workspaces')]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), 'default')]",
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ],
      "properties": {
        "metadata": {}
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
      "apiVersion": "2021-06-01",
      "name": "[concat(parameters('storageAccountName'), '/default/provisionedWorkspaces')]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ],
      "properties": {
        "partitionName": "workspaces"
      }
    },
    {
      "type": "Microsoft.ServiceBus/namespaces",
      "apiVersion": "2017-04-01",
      "name": "[parameters('serviceBusNamespaceName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard"
      },
      "properties": {}
    },
    {
      "type": "Microsoft.ServiceBus/namespaces/queues",
      "apiVersion": "2017-04-01",
      "name": "[format('{0}/{1}', parameters('serviceBusNamespaceName'), parameters('serviceBusQueueName'))]",
      "properties": {
        "lockDuration": "PT5M",
        "maxSizeInMegabytes": 1024,
        "requiresDuplicateDetection": false,
        "requiresSession": false,
        "defaultMessageTimeToLive": "P10675199DT2H48M5.4775807S",
        "deadLetteringOnMessageExpiration": false,
        "duplicateDetectionHistoryTimeWindow": "PT10M",
        "maxDeliveryCount": 10,
        "autoDeleteOnIdle": "P10675199DT2H48M5.4775807S",
        "enablePartitioning": false,
        "enableExpress": false
      },
      "resources": [
        {
          "apiVersion": "2017-04-01",
          "name": "[parameters('queueAuthorizationRuleName')]",
          "type": "AuthorizationRules",
          "dependsOn": ["[parameters('serviceBusQueueName')]"],
          "properties": {
            "rights": ["Listen", "Send", "Manage"]
          }
        }
      ],
      "dependsOn": [
        "[resourceId('Microsoft.ServiceBus/namespaces', parameters('serviceBusNamespaceName'))]"
      ]
    },
    {
      "apiVersion": "2015-05-01",
      "name": "[variables('appInsightsName')]",
      "type": "Microsoft.Insights/components",
      "kind": "web",
      "location": "[parameters('location')]",
      "tags": {
        "[concat('hidden-link:', resourceGroup().id, '/providers/Microsoft.Web/sites/', parameters('functionAppName'))]": "Resource"
      },
      "properties": {
        "Application_Type": "web",
        "ApplicationId": "[variables('appInsightsName')]"
      }
    },
    {
      "type": "Microsoft.Web/serverfarms",
      "apiVersion": "2020-06-01",
      "name": "[variables('appServicePlanPortalName')]",
      "location": "[parameters('location')]",
      "sku": {
        "tier": "Standard",
        "name": "S1"
      },
      "kind": "functionapp,linux",
      "properties": {
        "name": "[variables('appServicePlanPortalName')]",
        "reserved": true
      }
    },
    {
      "type": "Microsoft.Web/sites",
      "apiVersion": "2020-06-01",
      "name": "[parameters('functionAppName')]",
      "location": "[parameters('location')]",
      "kind": "functionapp,linux",
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
          "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('identityName'))]": {}
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('identityName'))]"
      ],
      "properties": {
        "reserved": true,
        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]",
        "siteConfig": {
          "linuxFxVersion": "DOTNETCORE|6.0",
          "appSettings": [
            {
              "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
              "value": "[reference(resourceId('Microsoft.Insights/components', variables('appInsightsName')), '2015-05-01').InstrumentationKey]"
            },
            {
              "name": "AzureWebJobsStorage",
              "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', parameters('storageAccountName'), ';EndpointSuffix=', environment().suffixes.storage, ';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').keys[0].value)]"
            },
            {
              "name": "FUNCTIONS_EXTENSION_VERSION",
              "value": "~4"
            },
            {
              "name": "FUNCTIONS_WORKER_RUNTIME",
              "value": "dotnet"
            }
          ],
          "resources": [
            {
              "type": "config",
              "apiVersion": "2020-12-01",
              "name": "authsettingsV2",
              "location": "[resourceGroup().location]",
              "dependsOn": [
                "[concat('Microsoft.Web/sites/', parameters('functionAppName'))]"
              ],
              "properties": {
                "platform": {
                  "enabled": true,
                  "runtimeVersion": "~1"
                },
                "identityProviders": {
                  "azureActiveDirectory": {
                    "isAutoProvisioned": false,
                    "registration": {
                      "clientId": "[parameters('aadAppClientId')]",
                      "clientSecret": "[variables('clientSecret')]",
                      "openIdIssuer": "[concat('https://sts.windows.net/', parameters('tenant'), '/v2.0')]"
                    },
                    "validation": {
                      "allowedAudiences": [
                        "https://management.core.windows.net/"
                      ]
                    }
                  }
                }
              },
              "login": {
                "routes": {},
                "tokenStore": {
                  "enabled": true,
                  "tokenRefreshExtensionHours": 72,
                  "fileSystem": {},
                  "azureBlobStorage": {}
                },
                "preserveUrlFragmentsForLogins": false,
                "allowedExternalRedirectUrls": [],
                "cookieExpiration": {
                  "convention": "FixedTime",
                  "timeToExpiration": "08:00:00"
                },
                "nonce": {
                  "validateNonce": true,
                  "nonceExpirationInterval": "00:05:00"
                }
              },
              "globalValidation": {
                "redirectToProvider": "azureactivedirectory",
                "unauthenticatedClientAction": "RedirectToLoginPage"
              },
              "httpSettings": {
                "requireHttps": true,
                "routes": {
                  "apiPrefix": "/.auth"
                },
                "forwardProxy": {
                  "convention": "NoProxy"
                }
              }
            }
          ]
        }
      }
    }
  ]
}

两条评论，以防它们有帮助/相关:

客户端 secret - 如您所见，我定义了一个变量，但它是空白的。我没有提供客户端 secret 值，因为我假设它会自动为我创建。但也许我根本不应该包含该参数？

此外，我正在为 Web 应用程序使用 Linux 容器。

任何有关如何解决这些问题的提示将不胜感激。

编辑 1

我手动创建并添加了身份验证策略，然后我一直在使用 resources.azure.com 查看为我创建的内容。我在配置下有两个相关部分。一种称为 authsettings，如下所示:

另一个位于 authsettingsV2 下，如下所示:

我现在正在尝试使用 authsettingsV2...但不清楚应该将其粘贴到 ARM 模板中的何处。

有什么建议吗？

编辑2

在站点资源下添加了所有 authsettingsv2 内容。没有错误。但结果还是一样。

Answer 1

发现我可以使用 Az Powershell commandlet:

New-AzADApplication 
New-AzADAppCredential