gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 12:42:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

usage of EntraId ClientId harmonised

Browse Source
This commit is contained in:
Oliver Kieselbach
2026-02-16 18:18:42 +01:00
parent 5b835fd7f0
commit 1f1b2cf2b4
7 changed files with 82 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/azure-static-web-apps-brave-grass-0070b5703.yml
+62 -63
View File
@@ -1,63 +1,62 @@
name: Azure Static Web Apps CI/CD
on:
push:
branches:
- main
paths:
- 'src/Web/autopilot-monitor-web/**'
- '.github/workflows/azure-static-web-apps-brave-grass-0070b5703.yml'
workflow_dispatch:
pull_request:
types: [opened, synchronize, reopened, closed]
branches:
- main
paths:
- 'src/Web/autopilot-monitor-web/**'
- '.github/workflows/azure-static-web-apps-brave-grass-0070b5703.yml'
jobs:
build_and_deploy_job:
if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
runs-on: ubuntu-latest
name: Build and Deploy Job
steps:
- uses: actions/checkout@v3
with:
submodules: true
lfs: false
- name: Build And Deploy
id: builddeploy
uses: Azure/static-web-apps-deploy@v1
env:
NEXT_PUBLIC_AZURE_AD_CLIENT_ID: ${{ vars.NEXT_PUBLIC_AZURE_AD_CLIENT_ID }}
NEXT_PUBLIC_BACKEND_CLIENT_ID: ${{ vars.NEXT_PUBLIC_BACKEND_CLIENT_ID }}
NEXT_PUBLIC_AZURE_AD_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_AZURE_AD_REDIRECT_URI }}
NEXT_PUBLIC_AZURE_AD_POST_LOGOUT_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_AZURE_AD_POST_LOGOUT_REDIRECT_URI }}
NEXT_PUBLIC_API_BASE_URL: ${{ vars.NEXT_PUBLIC_API_BASE_URL }}
with:
azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_BRAVE_GRASS_0070B5703 }}
repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
action: "upload"
###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
# For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
app_location: "src/Web/autopilot-monitor-web" # App source code path
api_location: "" # Api source code path - optional
output_location: "" # Built app content directory - optional
###### End of Repository/Build Configurations ######
close_pull_request_job:
if: github.event_name == 'pull_request' && github.event.action == 'closed'
runs-on: ubuntu-latest
name: Close Pull Request Job
steps:
- name: Close Pull Request
id: closepullrequest
uses: Azure/static-web-apps-deploy@v1
with:
azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_BRAVE_GRASS_0070B5703 }}
action: "close"
name: Azure Static Web Apps CI/CD
on:
push:
branches:
- main
paths:
- 'src/Web/autopilot-monitor-web/**'
- '.github/workflows/azure-static-web-apps-brave-grass-0070b5703.yml'
workflow_dispatch:
pull_request:
types: [opened, synchronize, reopened, closed]
branches:
- main
paths:
- 'src/Web/autopilot-monitor-web/**'
- '.github/workflows/azure-static-web-apps-brave-grass-0070b5703.yml'
jobs:
build_and_deploy_job:
if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
runs-on: ubuntu-latest
name: Build and Deploy Job
steps:
- uses: actions/checkout@v3
with:
submodules: true
lfs: false
- name: Build And Deploy
id: builddeploy
uses: Azure/static-web-apps-deploy@v1
env:
NEXT_PUBLIC_ENTRA_CLIENT_ID: ${{ vars.NEXT_PUBLIC_ENTRA_CLIENT_ID }}
NEXT_PUBLIC_ENTRA_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_REDIRECT_URI }}
NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI }}
NEXT_PUBLIC_API_BASE_URL: ${{ vars.NEXT_PUBLIC_API_BASE_URL }}
with:
azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_BRAVE_GRASS_0070B5703 }}
repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
action: "upload"
###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
# For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
app_location: "src/Web/autopilot-monitor-web" # App source code path
api_location: "" # Api source code path - optional
output_location: "" # Built app content directory - optional
###### End of Repository/Build Configurations ######
close_pull_request_job:
if: github.event_name == 'pull_request' && github.event.action == 'closed'
runs-on: ubuntu-latest
name: Close Pull Request Job
steps:
- name: Close Pull Request
id: closepullrequest
uses: Azure/static-web-apps-deploy@v1
with:
azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_BRAVE_GRASS_0070B5703 }}
action: "close"
src/Backend/AutopilotMonitor.Functions/Functions/SerialValidationConsentFunction.cs
+1 -1
View File
@@ -42,7 +42,7 @@ public class SerialValidationConsentFunction
return authError;
}
var validatorClientId = _configuration["Graph:ClientId"] ?? _configuration["AzureAd:ClientId"];
var validatorClientId = _configuration["EntraId:ClientId"];
if (string.IsNullOrWhiteSpace(validatorClientId))
{
var badConfig = req.CreateResponse(HttpStatusCode.InternalServerError);
src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs
+2 -2
View File
@@ -171,8 +171,8 @@ public class AuthenticationMiddleware : IFunctionsWorkerMiddleware
ValidateAudience = true,
ValidAudiences = new[]
{
_configuration["AzureAd:ClientId"],
$"api://{_configuration["AzureAd:ClientId"]}"
_configuration["EntraId:ClientId"],
$"api://{_configuration["EntraId:ClientId"]}"
},
ValidateLifetime = true,
src/Backend/AutopilotMonitor.Functions/Program.cs
+2 -2
View File
@@ -59,7 +59,7 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
// Multi-Tenant Configuration
options.Instance = "https://login.microsoftonline.com/";
options.TenantId = "organizations"; // Accept tokens from any Azure AD tenant
options.ClientId = builder.Configuration["AzureAd:ClientId"];
options.ClientId = builder.Configuration["EntraId:ClientId"];
// Token validation parameters
options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
@@ -77,7 +77,7 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
// TODO: Later expose custom API and use api://{clientId} scopes
ValidAudiences = new[]
{
builder.Configuration["AzureAd:ClientId"] // Our app's client ID
builder.Configuration["EntraId:ClientId"] // Our app's client ID
//"https://graph.microsoft.com", // Microsoft Graph
//"00000003-0000-0000-c000-000000000000" // Microsoft Graph App ID
}
src/Backend/AutopilotMonitor.Functions/Security/SerialNumberValidator.cs
+3 -3
View File
@@ -187,13 +187,13 @@ namespace AutopilotMonitor.Functions.Security
private async Task<string?> GetGraphAccessTokenAsync(string tenantId)
{
var clientId = _configuration["Graph:ClientId"] ?? _configuration["AzureAd:ClientId"];
var clientSecret = _configuration["Graph:ClientSecret"] ?? _configuration["AzureAd:ClientSecret"];
var clientId = _configuration["EntraId:ClientId"];
var clientSecret = _configuration["EntraId:ClientSecret"];
if (string.IsNullOrWhiteSpace(clientId) || string.IsNullOrWhiteSpace(clientSecret))
{
_logger.LogError(
"Serial validation is enabled but Graph app credentials are not configured. Set Graph:ClientId and Graph:ClientSecret.");
"Serial validation is enabled but Entra ID app credentials are not configured. Set EntraId:ClientId and EntraId:ClientSecret.");
return null;
}
src/Backend/AutopilotMonitor.Functions/Services/HealthCheckService.cs
+5 -5
View File
@@ -108,8 +108,8 @@ public class HealthCheckService
var requiredSettings = new[]
{
"AzureWebJobsStorage",
"AzureAd:ClientId",
"AzureAd:TenantId",
"EntraId:ClientId",
"EntraId:TenantId",
"AzureSignalR:ConnectionString"
};
@@ -161,13 +161,13 @@ public class HealthCheckService
var check = new HealthCheck
{
Name = "Authentication",
Description = "Azure AD / MSAL configuration"
Description = "Entra ID / MSAL configuration"
};
try
{
var clientId = _configuration["AzureAd:ClientId"];
var tenantId = _configuration["AzureAd:TenantId"];
var clientId = _configuration["EntraId:ClientId"];
var tenantId = _configuration["EntraId:TenantId"];
if (string.IsNullOrEmpty(clientId) || string.IsNullOrEmpty(tenantId))
{
src/Web/autopilot-monitor-web/lib/msalConfig.ts
+7 -7
View File
@@ -4,18 +4,18 @@ import { Configuration, LogLevel, RedirectRequest } from "@azure/msal-browser";
* MSAL Configuration for Multi-Tenant Azure AD Authentication
*
* Environment Variables:
* - NEXT_PUBLIC_AZURE_AD_CLIENT_ID: Application (client) ID from App Registration
* - NEXT_PUBLIC_AZURE_AD_REDIRECT_URI: Redirect URI configured in App Registration
* - NEXT_PUBLIC_AZURE_AD_POST_LOGOUT_REDIRECT_URI: Post logout redirect URI
* - NEXT_PUBLIC_ENTRA_CLIENT_ID: Application (client) ID from App Registration
* - NEXT_PUBLIC_ENTRA_REDIRECT_URI: Redirect URI configured in App Registration
* - NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI: Post logout redirect URI
*/
// MSAL Configuration
export const msalConfig: Configuration = {
auth: {
clientId: process.env.NEXT_PUBLIC_AZURE_AD_CLIENT_ID || "YOUR_CLIENT_ID_HERE",
clientId: process.env.NEXT_PUBLIC_ENTRA_CLIENT_ID || "YOUR_CLIENT_ID_HERE",
authority: "https://login.microsoftonline.com/organizations", // Multi-tenant
redirectUri: process.env.NEXT_PUBLIC_AZURE_AD_REDIRECT_URI || "http://localhost:3000",
postLogoutRedirectUri: process.env.NEXT_PUBLIC_AZURE_AD_POST_LOGOUT_REDIRECT_URI || "http://localhost:3000/landing",
redirectUri: process.env.NEXT_PUBLIC_ENTRA_REDIRECT_URI || "http://localhost:3000",
postLogoutRedirectUri: process.env.NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI || "http://localhost:3000/landing",
navigateToLoginRequestUrl: true,
},
cache: {
@@ -74,7 +74,7 @@ export const loginRequest: RedirectRequest = {
export const apiRequest = {
scopes: [
// Option 1 (recommended): Use backend API scope after exposing API in Azure AD
`api://${process.env.NEXT_PUBLIC_BACKEND_CLIENT_ID}/access_as_user`
`api://${process.env.NEXT_PUBLIC_ENTRA_CLIENT_ID}/access_as_user`
],
};