azure-active-directory - ARM 模板 Web 应用程序身份验证设置不起作用

Question

我正在设置我的站点身份验证设置以使用 AAD 提供程序。大多数模板都受到尊重。然而，unauthenticatedClientAction和 allowedAudiences没有被正确分配。我观察到“允许匿名”并且没有分配“允许的观众”。

Please note that I was working with the ARM Template API 2018-02-01. This problem may still exist due to the documentation, if you provide an answer, please note the ARM Template version it addresses.

Additionally, create an issue for the ARM documentation team to correct any issues.

这是我的这些设置的模板段。它嵌套在我的网站模板中的资源下。
根 > Microsoft.Web/站点 > 资源

{
    "type": "config",
    "name": "web",
    "apiVersion": "2016-08-01",
    "location": "[parameters('app-location')]",
    "dependsOn": [
        "[resourceId('Microsoft.Web/sites', variables('web-site-name'))]"
    ],
    "properties": {
        "siteAuthEnabled": true,
        "siteAuthSettings": {
            "enabled": true,
            "unauthenticatedClientAction": "RedirectToLoginPage",
            "tokenStoreEnabled": true,
            "defaultProvider": "AzureActiveDirectory",
            "clientId": "[parameters('web-aad-client-id')]",
            "issuer": "[concat('https://sts.windows.net/', parameters('web-aad-tenant'))]",
            "allowedAudiences": [
                "[concat('https://', variables('web-site-name'), '.azurewebsites.net')]"
            ]
        }
    }
}

模板验证

部署不输出任何错误

问题:

unauthenticatedClientAction被分配允许匿名不 RedirectToLoginPage

allowedAudiences未分配任何站点

什么可能导致这些问题？我可能错过了什么？

Answer 1

在与 Azure 支持的优秀人员合作后，我得到了答案。

Please note that this solution targets API 2018-02-01 which was the current version at the time of this post.

此子资源不再是有效的解决方案，而端点可能仍会识别其某些字段，但已弃用。

新的解决方案是添加 siteAuthSettings反对主要的“Microsoft.Web/site”属性和 siteAuthEnabled不再需要，因为 siteAuthSettings.enable重复此功能。

更新的 ARM 模板(为简洁起见删除了其他设置)

{
    "name": "[variables('app-service-name')]",
    "type": "Microsoft.Web/sites",
    "location": "[parameters('app-location')]",
    "apiVersion": "2016-08-01",
    "dependsOn": [
        "[variables('app-plan-name')]"
    ],
    "properties": {
        //... other app service settings
        "siteAuthSettings": {
            "enabled": true,
            "unauthenticatedClientAction": "RedirectToLoginPage",
            "tokenStoreEnabled": true,
            "defaultProvider": "AzureActiveDirectory",
            "clientId": "[parameters('web-aad-client-id')]",
            "issuer": "[concat('https://sts.windows.net/', parameters('web-aad-tenant'))]",
            "allowedAudiences": [
                "[concat('https://', variables('web-site-name'), '.azurewebsites.net')]"
            ]
        }
    }
}