How can is use the managed Identity of an Azure function with PNP.Framework

[russgove]

Are there any examples of this. Is it even possible?

[russgove]

tried using
using Microsoft.Azure.Services.AppAuthentication;
public static async Task AddContentTypeToSite(string siteUrl, ILogger log)
{

        var config = GetConfig();

        using (var clientContext = new PnP.Framework.AuthenticationManager().GetContext(siteUrl))
        {
            clientContext.ExecutingWebRequest += async (sender, e) =>
                {
                    var azureServiceTokenProvider = new AzureServiceTokenProvider();
                    string accessToken = await azureServiceTokenProvider.GetAccessTokenAsync(e.WebRequestExecutor.WebRequest.Address.ToString());
                    e.WebRequestExecutor.RequestHeaders["Authorization"] = "Bearer " + accessToken;
                };

            var sc = clientContext.Site;
            log.LogInformation($"getting site");
            clientContext.ExecuteQuery();
            return sc.Id.ToString();
        }

    }

I just get a null object reference when calling clientContext.ExecuteQuery();

[anthonywhite]

I just built a function that uses the app and certificate from Register-PnPAzureADApp, based on the SDK sample. Maybe of interest? I appreciate you've solved this now...

[patrikhellgren]

Try the following:

var credential = new ChainedTokenCredential(
    new ManagedIdentityCredential(),
    new EnvironmentCredential()
);

var scope = $@"https://{siteUri.Host}/.default";
var accessToken = await credential.GetTokenAsync(new TokenRequestContext(new[] { scope }));
var authManager = new PnP.Framework.AuthenticationManager();
var clientContext = authManager.GetAccessTokenContext(siteUri.ToString(), accessToken.Token);

This will use the managed identity of the Azure Function if running in Azure and the credentials stored in environment variables if running locally from e.g. Visual Studio.

For info on how to use EnvironmentCredential see EnvironmentCredential Class

For more info and other credential classes to use see Azure Identity client library for .NET

[russgove]

Thanks! That worked (in that i am getting an access token.
Now I am getting Error The remote server returned an error: (401) Unauthorized instead :-)

I read somewhere that I might need a graph token ratjer than an sp token for some things. Could that be the case here (I am just trying to create a content type)
code:
public static async Task AddContentTypeToSite(Uri siteUri, ILogger log)
{
try
{

            var config = GetConfig();

            var credential = new Azure.Identity.ChainedTokenCredential(
                 new ManagedIdentityCredential(),
                 new EnvironmentCredential()
                 );

            var scope = $@"https://{siteUri.Host}/.default";
            var accessToken = await credential.GetTokenAsync(new Azure.Core.TokenRequestContext(new[] { scope }));
            var authManager = new PnP.Framework.AuthenticationManager();
            log.LogInformation($"getting an accesstoken");
            var clientContext = authManager.GetAccessTokenContext(siteUri.ToString(), accessToken.Token);
            var baseCT = clientContext.Site.RootWeb.ContentTypes.GetById("0x01");
            log.LogInformation($"getting base ct");
            clientContext.ExecuteQuery();
            log.LogInformation($"got base ct");
            Microsoft.SharePoint.Client.ContentTypeCreationInformation ctci = new Microsoft.SharePoint.Client.ContentTypeCreationInformation()
            {
                Id = "0x0100002CF808DCF34FDFBAF1378B8bCAA777",
                Name = "Audit Items",
                Description = "Details of audit items caputured throught the Audit Log Capture tool",
                Group = "_Audit",
                ParentContentType = baseCT
            };
            log.LogInformation($"created cti");

            clientContext.Site.RootWeb.ContentTypes.Add(ctci);
            log.LogInformation($"added cti");
            clientContext.ExecuteQuery();
            log.LogInformation($"done");




            return "OK";
        }
        catch (Exception e)
        {
            log.LogInformation($"Error {e.Message} count=");
            if (e.InnerException != null)
            {
                log.LogInformation($"Error {e.InnerException.Message}");
                if (e.InnerException.InnerException != null)
                {
                    log.LogInformation($"Error {e.InnerException.InnerException.Message}");
                    if (e.InnerException.InnerException.InnerException != null)
                    {
                        log.LogInformation($"Error {e.InnerException.InnerException.InnerException.Message}");
                    }
                }
            }
            return "ERROR";

        }
    }

[russgove]

I just triple-checked that function has permissions. Permissions are here:

[patrikhellgren]

When using a Managed Identity and assigning permissions to it you cannot use the Azure Portal UI since all you see there is App Registrations and the Managed Identity is a Service Principal. At least not if something haven't changed in the portal UI very recently.
You need to assign permissions to it by using PowerShell. Here is an article with examples on how to do it Stop using ClientID and Secret to access your Office 365 services

[russgove]

Ah thanks. I had set up that app registration for the app to use to make some other calls and forgot that it was not the 'real' managed identity of the app.

I then used this script to assign permissions to the 'real' managed identity:
$TenantID="ee780cdf-8eab-4e6f-a740-c31a2aede2c0" ##russellwgove

Get the Application ID from the Entrprise apps blade in O365 ('Office 365 Management APIs'=c5393580-f805-4401-95e8-94b7a6ef2fc2, ' GraphAggregatorService=00000003-0000-0000-c000-000000000000 Office 365 SharePoint=00000003-0000-0ff1-ce00-000000000000

$TargetAppId = "00000003-0000-0ff1-ce00-000000000000"

id of the msi n(from the Identity blade of the azure function)

$ObjectIDMSI="31c5a75f-748e-4fee-a635-35214cc76805"

Check the Microsoft Graph documentation for the permission you need for the operation or use Get-AzureADServicePrincipal -SearchString “Office 365 SharePoint” | %{$_.AppRoles} | fl

$PermissionName = "Sites.FullControl.All"
$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$TargetAppId'"
$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$.Value -eq $PermissionName -and $.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $ObjectIDMSI -PrincipalId $ObjectIDMSI -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id

I am still getting 401's.
I dumped the token that i got and it contains:
{"aud":"https://russellwgove.sharepoint.com","iss":"https://sts.windows.net/ee780cdf-8eab-4e6f-a740-c31a2aede2c0/","iat":1620149330,"nbf":1620149330,"exp":1620236030,"aio":"E2ZgYDjW6h4uu9d5bk38DOW6+bH3AA==","app_displayname":"AuditLogCaptureManagementApi20210406083457","appid":"50d35180-fa88-4532-a5c8-7f73c11bf897","appidacr":"2","idp":"https://sts.windows.net/ee780cdf-8eab-4e6f-a740-c31a2aede2c0/","idtyp":"app","oid":"31c5a75f-748e-4fee-a635-35214cc76805","rh":"0.AUUA3wx47quOb06nQMMaKu3iwIBR01CI-jJFpch_c8Eb-JdFAAA.","sid":"60fa93da-1790-4de0-9b38-f61f3a68ba56","sub":"31c5a75f-748e-4fee-a635-35214cc76805","tid":"ee780cdf-8eab-4e6f-a740-c31a2aede2c0","uti":"qalKfe4wykWmhpYCLmWTAA","ver":"1.0"}

there us no scope/scp in there like the tokens I sent from my browser so i'm thinking i need to explicitly set the scopes when I request the token.

Does that make any sense?

[russgove]

I take that back. I just redeployed the app and now it works. The token now looks like this:
{"aud":"https://russellwgove.sharepoint.com","iss":"https://sts.windows.net/ee780cdf-8eab-4e6f-a740-c31a2aede2c0/","iat":1620156856,"nbf":1620156856,"exp":1620243556,"aio":"E2ZgYEgwY5P1Wr7MfmLBLIkZF6QzAQ==","app_displayname":"AuditLogCaptureManagementApi20210406083457","appid":"50d35180-fa88-4532-a5c8-7f73c11bf897","appidacr":"2","idp":"https://sts.windows.net/ee780cdf-8eab-4e6f-a740-c31a2aede2c0/","idtyp":"app","oid":"31c5a75f-748e-4fee-a635-35214cc76805","rh":"0.AUUA3wx47quOb06nQMMaKu3iwIBR01CI-jJFpch_c8Eb-JdFAAA.","roles":["Sites.ReadWrite.All","Sites.FullControl.All"],"sid":"750ec649-8f77-4011-8ada-a9ef05a2b6b5","sub":"31c5a75f-748e-4fee-a635-35214cc76805","tid":"ee780cdf-8eab-4e6f-a740-c31a2aede2c0","uti":"MOxU0F0UbU6eCug3NV0XAA","ver":"1.0"}

I don't understand why tokens sent from the browser have that scp setting and ones from functions have rh and roles, but hey , it works.

Thanks you for your assistance Patrick!