Jwt Bearer Authentication in a function app

Hi @Parag Kale,

Create an Azure AD app and add the Microsoft Azure PowerShell (1950a258-227b-4e31-a9cf-717495945fc2) in Authorized client applications as shown below.

Run the below commands in Powershell to retrieve the Access Token.

$tenantId = 'tenantId'  
Connect-AzAccount -Tenant $tenantId -UseDeviceAuthentication 
(Get-AzAccessToken -ResourceUrl "api://<60efd83bxxx>").Token

Below is the sample Durable function code to authenticate using the Jwt Bearer token.

using System.IdentityModel.Tokens.Jwt;
using Microsoft.Azure.Functions.Worker;
using Microsoft.Azure.Functions.Worker.Http;
using Microsoft.DurableTask;
using Microsoft.DurableTask.Client;
using Microsoft.Extensions.Logging;
using Microsoft.IdentityModel.Protocols;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.IdentityModel.Tokens;
namespace FunctionApp62
{
    public static class Function1
    {
        private const string Issuer = "https://login.microsoftonline.com/<tenantID>/v2.0";
        private const string Audience = "<ClientID>";
        private static readonly string MetadataAddress = $"{Issuer}/.well-known/openid-configuration";
        private static readonly ConfigurationManager<OpenIdConnectConfiguration> ConfigManager =
            new ConfigurationManager<OpenIdConnectConfiguration>(
                MetadataAddress,
                new OpenIdConnectConfigurationRetriever());
        [Function(nameof(Function1))]
        public static async Task<List<string>> RunOrchestrator(
            [OrchestrationTrigger] TaskOrchestrationContext context)
        {
            var logger = context.CreateReplaySafeLogger(nameof(Function1));
            logger.LogInformation("Running orchestrator...");
            var outputs = new List<string>
            {
                await context.CallActivityAsync<string>(nameof(SayHello), "Tokyo"),
                await context.CallActivityAsync<string>(nameof(SayHello), "Seattle"),
                await context.CallActivityAsync<string>(nameof(SayHello), "London")
            };
            return outputs;
        }
        [Function(nameof(SayHello))]
        public static string SayHello([ActivityTrigger] string name, FunctionContext executionContext)
        {
            var logger = executionContext.GetLogger("SayHello");
            logger.LogInformation("Saying hello to {name}.", name);
            return $"Hello {name}!";
        }
        [Function("DurableFunctionsMonitor")]
        public static async Task<HttpResponseData> HttpStart(
            [HttpTrigger(AuthorizationLevel.Anonymous, "get", "post")] Microsoft.Azure.Functions.Worker.Http.HttpRequestData req,
            [DurableClient] DurableTaskClient client,
            FunctionContext executionContext)
        {
            var logger = executionContext.GetLogger("DurableFunctionsMonitor");
            if (!req.Headers.TryGetValues("Authorization", out var authHeaders))
            {
                var unauthorizedResponse = req.CreateResponse(System.Net.HttpStatusCode.Unauthorized);
                await unauthorizedResponse.WriteStringAsync("Missing Authorization header.");
                return unauthorizedResponse;
            }
            var authHeader = authHeaders.FirstOrDefault();
            if (string.IsNullOrEmpty(authHeader) || !authHeader.StartsWith("Bearer "))
            {
                var unauthorizedResponse = req.CreateResponse(System.Net.HttpStatusCode.Unauthorized);
                await unauthorizedResponse.WriteStringAsync("Missing or invalid Authorization header.");
                return unauthorizedResponse;
            }
            var token = authHeader.Substring("Bearer ".Length).Trim();
            if (!await ValidateJwtTokenAsync(token, logger))
            {
                var unauthorizedResponse = req.CreateResponse(System.Net.HttpStatusCode.Unauthorized);
                await unauthorizedResponse.WriteStringAsync("Invalid token.");
                return unauthorizedResponse;
            }
            string instanceId = await client.ScheduleNewOrchestrationInstanceAsync(nameof(Function1));
            logger.LogInformation("Started orchestration with ID = '{instanceId}'.", instanceId);
            return await client.CreateCheckStatusResponseAsync(req, instanceId);
        }
        private static async Task<bool> ValidateJwtTokenAsync(string token, ILogger logger)
        {
            var tokenHandler = new JwtSecurityTokenHandler();
            try
            {
                var config = await ConfigManager.GetConfigurationAsync(CancellationToken.None);
                var validationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidIssuer = Issuer,
                    ValidateAudience = true,
                    ValidAudience = Audience,
                    ValidateLifetime = true,
                    RequireExpirationTime = true,
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKeys = config.SigningKeys
                };
                tokenHandler.ValidateToken(token, validationParameters, out _);
                logger.LogInformation("Token validated successfully.");
                return true;
            }
            catch (Exception ex)
            {
                logger.LogError($"Token validation failed: {ex.Message}");
                return false;
            }
        }
    }
}

Test the below curl command to get the output,

curl http://localhost:7220/api/DurableFunctionsMonitor -H "Authorization: Bearer <AccessToken>"

Local Output :

Azure Function App Output :

Hi @Parag Kale,

Just following up to see if you had a chance to review my previous message.

Don't think this will open http://localhost:7220/api/DurableFunctionsMonitor in the browser

Hi @Parag Kale,

Yes, we can't open http://localhost:7220/api/DurableFunctionsMonitor directly in the browser because it requires an Access Token. So, I first tested it using the curl command in the command prompt.

Then, I accessed [http://localhost:7220/runtime/webhooks/durabletask/instances/f4b174d2xxxx?code=0CAtdJuMyk8zxxxxx] in the browser.

Terminal Output :

Thanks for the script.

I want to know where is the token being generated? When we use the durable function monitor in injected mode, we don’t have access to its front end react module.

so precisely my requirement is when the durable functions mnitor endpoint is visited in browser, it should have access token either generated with in the function or in some other http function and redirected to this function with token passed in header.

Hi @Parag Kale,

I shared you the Powershell commands in my previous comment, run them in Powershell to get the Access Token.

Okay, got it.

so if I directly open the endpoint of durable function monitor in browser, how can I pass the token generated by powershell in first step

Hi @Parag Kale,

Pass your Access Token in the below command at <AccessToken> and test it in the command prompt.

curl http://localhost:7220/api/DurableFunctionsMonitor -H "Authorization: Bearer <AccessToken>"