Add Entra ID authentication (#39)

* Add Entra ID authentication

* Extract token acquisition to service

* Establish SignalR connection after user login

* Reuse getAccessToken function

* Cleanup

* Change key vault deployment

* Add env variables required for creating static assets

Author: uveta

.github/workflows/app.yml

@@ -11,6 +11,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    environment: Development
 
     steps:
       - name: Checkout code
@@ -38,7 +39,9 @@ jobs:
           yarn build
         working-directory: src/app
         env:
-          VITE_API_ROOT: https://app-projectestimate-api-dev.azurewebsites.net/api
+          VITE_API_ROOT: ${{ secrets.VITE_API_ROOT }}
+          VITE_AZURE_CLIENT_ID: ${{ secrets.VITE_AZURE_CLIENT_ID }}
+          VITE_AZURE_AUTHORITY: ${{ secrets.VITE_AZURE_AUTHORITY }}
 
       - name: Package artifact
         uses: actions/upload-artifact@v4

infra/resourceGroup.bicep

@@ -40,9 +40,15 @@ param apiWebAppName string = 'app-projectestimate-api-${env}'
 @description('Optional. The name of the Storage Account to create.')
 param storageAccountName string = 'stoprojectestimate${env}'
 
+@description('Optional. The name of the Key Vault to create.')
+param keyVaultName string = 'kv-projectestimate-${env}'
+
 @description('Optional. Indicates number fo days to retain deleted items (containers, blobs, snapshosts, versions). Default value is 7')
 param daysSoftDelete int = 7
 
+@description('Optional. Enable Key Vault purge protection. Default is false.')
+param enableKeyVaultPurgeProtection bool = false
+
 resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
   name: logAnalyticsName
   location: location
@@ -78,6 +84,28 @@ resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
   }
 }
 
+resource keyVault 'Microsoft.KeyVault/vaults@2024-11-01' = {
+  name: keyVaultName
+  location: location
+  tags: tags
+  properties: {
+    sku: {
+      family: 'A'
+      name: 'standard'
+    }
+    tenantId: subscription().tenantId
+    enableRbacAuthorization: true
+    enableSoftDelete: true
+    enablePurgeProtection: enableKeyVaultPurgeProtection ? true : null
+    softDeleteRetentionInDays: 10
+    publicNetworkAccess: 'Enabled'
+    networkAcls: {
+      defaultAction: 'Allow'
+      bypass: 'AzureServices'
+    }
+  }
+}
+
 module storageAccount 'storageAccount.bicep' = {
   name: storageAccountName
   params: {
@@ -116,6 +144,54 @@ resource documentIntelligence 'Microsoft.CognitiveServices/accounts@2024-10-01'
   }
 }
 
+resource applicationInsightsConnectionStringSecret 'Microsoft.KeyVault/vaults/secrets@2024-11-01' = {
+  parent: keyVault
+  name: 'ApplicationInsights--ConnectionString'
+  properties: {
+    value: appInsights.properties.ConnectionString
+  }
+}
+
+resource storageConnectionStringSecret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
+  parent: keyVault
+  name: 'StorageAccount--ConnectionString'
+  properties: {
+    value: storageAccount.outputs.connectionString
+  }
+}
+
+resource openAiEndpointSecret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
+  parent: keyVault
+  name: 'Azure--OpenAI--Endpoint'
+  properties: {
+    value: openAIService.outputs.endpoint
+  }
+}
+
+resource openAiApiKeySecret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
+  parent: keyVault
+  name: 'Azure--OpenAI--ApiKey'
+  properties: {
+    value: openAIService.outputs.apiKey
+  }
+}
+
+resource documentIntelligenceEndpointSecret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
+  parent: keyVault
+  name: 'Azure--DocumentIntelligence--Endpoint'
+  properties: {
+    value: documentIntelligence.properties.endpoint
+  }
+}
+
+resource documentIntelligenceApiKeySecret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
+  parent: keyVault
+  name: 'Azure--DocumentIntelligence--ApiKey'
+  properties: {
+    value: documentIntelligence.listKeys().key1
+  }
+}
+
 resource appServicePlan 'Microsoft.Web/serverfarms@2024-04-01' = {
   name: appServicePlanName
   location: location
@@ -154,25 +230,72 @@ module apiWebApp 'webApp.bicep' = {
     clientAffinityEnabled: false
     httpsOnly: true
     kind: 'app,linux'
+    useManagedIdentity: true
+  }
+}
+
+resource keyVaultRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  scope: keyVault
+  name: guid(keyVault.id, apiWebAppName, 'Key Vault Secrets User')
+  properties: {
+    roleDefinitionId: subscriptionResourceId(
+      'Microsoft.Authorization/roleDefinitions',
+      '4633458b-17de-408a-b874-0445c86b69e6'
+    ) // Key Vault Secrets User
+    principalId: apiWebApp.outputs.principalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+resource uiWebAppConfig 'Microsoft.Web/sites/config@2024-04-01' = {
+  name: '${uiWebApp.name}/web'
+  properties: {
+    linuxFxVersion: 'NODE|22-lts'
   }
 }
 
 resource apiWebAppConfig 'Microsoft.Web/sites/config@2024-04-01' = {
   name: '${apiWebAppName}/web'
-  dependsOn: [apiWebApp]
+  dependsOn: [apiWebApp, keyVaultRoleAssignment]
   properties: {
     linuxFxVersion: 'DOTNETCORE|9.0'
     cors: {
       allowedOrigins: [uiWebApp.outputs.endpoint]
       supportCredentials: true
     }
     appSettings: [
-      { name: 'APPLICATIONINSIGHTS_CONNECTION_STRING', value: appInsights.properties.ConnectionString }
-      { name: 'Azure__StorageAccount__ConnectionString', value: storageAccount.outputs.connectionString }
-      { name: 'Azure__OpenAI__Endpoint', value: openAIService.outputs.endpoint }
-      { name: 'Azure__OpenAI__ApiKey', value: openAIService.outputs.apiKey }
-      { name: 'Azure__DocumentIntelligence__Endpoint', value: documentIntelligence.properties.endpoint }
-      { name: 'Azure__DocumentIntelligence__ApiKey', value: documentIntelligence.listKeys().key1 }
+      {
+        name: 'APPLICATIONINSIGHTS_CONNECTION_STRING'
+        value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=ApplicationInsights--ConnectionString)'
+      }
+      {
+        name: 'Azure__StorageAccount__ConnectionString'
+        value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=StorageAccount--ConnectionString)'
+      }
+      {
+        name: 'Azure__OpenAI__Endpoint'
+        value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=Azure--OpenAI--Endpoint)'
+      }
+      {
+        name: 'Azure__OpenAI__ApiKey'
+        value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=Azure--OpenAI--ApiKey)'
+      }
+      {
+        name: 'Azure__DocumentIntelligence__Endpoint'
+        value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=Azure--DocumentIntelligence--Endpoint)'
+      }
+      {
+        name: 'Azure__DocumentIntelligence__ApiKey'
+        value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=Azure--DocumentIntelligence--ApiKey)'
+      }
+      {
+        name: 'Security__Authentication__Authority'
+        value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=Security--Authentication--Authority)'
+      }
+      {
+        name: 'Security__Authentication__Audience'
+        value: '@Microsoft.KeyVault(VaultName=${keyVaultName};SecretName=Security--Authentication--Audience)'
+      }
     ]
   }
 }

infra/webApp.bicep

@@ -26,10 +26,16 @@ param alwaysOn bool = true
 @description(' Optional. Web app kind.')
 param kind string = 'app,linux'
 
+@description('Optional. Enable system-assigned managed identity.')
+param useManagedIdentity bool = false
+
 resource webApp 'Microsoft.Web/sites@2024-04-01' = {
   name: name
   location: location
   tags: tags
+  identity: useManagedIdentity ? {
+    type: 'SystemAssigned'
+  } : null
   properties: {
     serverFarmId: appServicePlanId
     clientAffinityEnabled: clientAffinityEnabled
@@ -44,3 +50,4 @@ resource webApp 'Microsoft.Web/sites@2024-04-01' = {
 output endpoint string = 'https://${webApp.properties.defaultHostName}'
 output name string = webApp.name
 output id string = webApp.id
+output principalId string = useManagedIdentity ? webApp.identity.principalId : ''

src/api/Controllers/FileController.cs

@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 using ProjectEstimate.Application.Converters;
 using ProjectEstimate.Application.Models;
 using ProjectEstimate.Domain;
@@ -8,6 +9,7 @@ namespace ProjectEstimate.Controllers;
 
 [Route("api/[controller]")]
 [ApiController]
+[Authorize]
 public class FileController : ControllerBase
 {
     private readonly ConsultantAgent _agent;

src/api/Extensions/Cors/Configuration/CorsSettings.cs

@@ -0,0 +1,13 @@
+namespace ProjectEstimate.Extensions.Cors.Configuration;
+
+public class CorsSettings
+{
+    public const string SectionName = "Cors";
+    public required string PolicyName { get; init; }
+    public string[]? AllowedOrigins { get; init; }
+
+    public bool UseCors
+    {
+        get => AllowedOrigins is not null && AllowedOrigins.Length > 0;
+    }
+}

src/api/Extensions/Cors/ConfigureCorsOptions.cs

@@ -0,0 +1,29 @@
+using ProjectEstimate.Extensions.Cors.Configuration;
+using Microsoft.AspNetCore.Cors.Infrastructure;
+using Microsoft.Extensions.Options;
+
+namespace ProjectEstimate.Extensions.Cors;
+
+public class ConfigureCorsOptions : IPostConfigureOptions<CorsOptions>
+{
+    private readonly IOptionsMonitor<CorsSettings> _options;
+
+    public ConfigureCorsOptions(IOptionsMonitor<CorsSettings> options)
+    {
+        _options = options;
+    }
+
+    public void PostConfigure(string? name, CorsOptions options)
+    {
+        var configuration = _options.CurrentValue;
+        if (!configuration.UseCors) return;
+        if (configuration.AllowedOrigins is null) return;
+        options.AddPolicy(
+            configuration.PolicyName,
+            policy => policy
+                .WithOrigins(configuration.AllowedOrigins)
+                .AllowAnyMethod()
+                .AllowAnyHeader()
+                .AllowCredentials());
+    }
+}

src/api/Extensions/Cors/CorsExtensions.cs

@@ -0,0 +1,28 @@
+using ProjectEstimate.Extensions.Cors.Configuration;
+using Microsoft.AspNetCore.Cors.Infrastructure;
+using Microsoft.Extensions.Options;
+
+namespace ProjectEstimate.Extensions.Cors;
+
+public static class CorsExtensions
+{
+    public static IServiceCollection ConfigureCors(this IServiceCollection services)
+    {
+        services.AddOptions<CorsSettings>().BindConfiguration(CorsSettings.SectionName)
+            .ValidateDataAnnotations()
+            .ValidateOnStart();
+        services.AddTransient<IPostConfigureOptions<CorsOptions>, ConfigureCorsOptions>();
+        services.AddCors();
+        return services;
+    }
+
+    public static IApplicationBuilder UseCorsMiddleware(this IApplicationBuilder app)
+    {
+        var settings = app.ApplicationServices.GetRequiredService<IOptions<CorsSettings>>().Value;
+        if (settings.UseCors)
+        {
+            app.UseCors(settings.PolicyName);
+        }
+        return app;
+    }
+}

src/api/Extensions/Security/Configuration/AuthenticationConfiguration.cs

@@ -0,0 +1,12 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace ProjectEstimate.Extensions.Security.Configuration;
+
+internal class AuthenticationConfiguration
+{
+    [Required]
+    public required string Authority { get; set; }
+
+    [Required]
+    public required string Audience { get; set; }
+}

src/api/Extensions/Security/Configuration/SecurityConfiguration.cs

@@ -0,0 +1,11 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace ProjectEstimate.Extensions.Security.Configuration;
+
+internal class SecurityConfiguration
+{
+    public const string SectionName = "Security";
+
+    [Required]
+    public required AuthenticationConfiguration Authentication { get; set; }
+}

src/api/Extensions/Security/ConfigureAuthenticationOptions.cs

@@ -0,0 +1,14 @@
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.Extensions.Options;
+
+namespace ProjectEstimate.Extensions.Security;
+
+public class ConfigureAuthenticationOptions : IConfigureOptions<AuthenticationOptions>
+{
+    public void Configure(AuthenticationOptions options)
+    {
+        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
+        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
+    }
+}