Add support for manage identity emulation

[Fresa]

Lowkey Vault (Azure KeyVault emulator) supports integrating with a managed identity emulator, would be nice to have similar support in the app configuration emulator, in order to keep the configured integration untouched when using managed identity.

Have a look here: https://github.com/nagyesta/lowkey-vault-example-dotnet?tab=readme-ov-file#usage

[tnc1997]

Hi @Fresa, thank you for your feature request!

Emulator for Azure App Configuration supports Microsoft Entra ID authentication.

In theory it should be possible to configure the Microsoft Entra ID authentication settings to align with Assumed Identity.

[Fresa]

I did have a go at that, unfortunately there are a couple of things that doesn't align.

• Access token validation; Assumed Identity sends "dummy" as access_token, which is not a valid JWT token format and hence fails validation in Azure App Configuration (maybe it should be addressed in assumed identity)
• It uses http (not https) for the metadata url (requires JwtBearerOptions.RequireHttpsMetadata = false)

[tnc1997]

• Access token validation; Assumed Identity sends "dummy" as access_token, which is not a valid JWT token format and hence fails validation in Azure App Configuration (maybe it should be addressed in assumed identity)

I agree that this should be addressed in Assumed Identity such that it issues valid bearer tokens.

• It uses http (not https) for the metadata url (requires JwtBearerOptions.RequireHttpsMetadata = false)

I believe that it should be possible to allow HTTP metadata URLs using the following configuration:

{
  "Authentication": {
    "Schemes": {
      "MicrosoftEntraId": {
        "RequireHttpsMetadata": "false"
      }
    }
  }
}

[nagyesta]

Hi @tnc1997,
@Fresa opened an issue (nagyesta/assumed-identity#145) for my project regarding this problem. I have never imagined that anyone would want to use Assumed Identity with anything else than my own emulator, but it would be real nice if I could make it work with yours too! I think it could be great for the projects which are using multiple Azure services and want to emulate everything locally.

With that said, the original Managed Identity token endpoint can only provide a JSON Web Token so I am not sure how to approach this, because I cannot provide a valid Entra Id token and I cannot provide a HMAC auth header either. Would it be possible to figure out some kind of a compromised solution?

For example I could set up a configuration property for Assumed Identity to let the users specify a secret and then I could use that to generate valid JWTs signed with HMAC (at least I think I could). Would it be possible for Azure App Configuration Emulator to accept these JWTs somehow?

If yes, what kind of information would you need in the token's payload to make it work?

Do you have any alternative ideas?

Looking forward to your suggestions! Thank you in advance!

P.S.: Do you think the SDK would work with this? I am not that familiar with the Azure App Configuration SDK and I know that it was a bit of a struggle to make it work with Azure Key Vault as well.

[tnc1997]

Hi @nagyesta, great to hear from you, thank you very much for your work on Assumed Identity!

When generating an access token within Assumed Identity, would it be possible for developers to configure the signing key etc. that is used? This could then be provided as static configuration via the authentication settings in Emulator for Azure App Configuration.

Alternatively, would it be possible to expose an OpenID Connect configuration endpoint within Assumed Identity that could be used to get the configuration via the metadata address authentication setting in Emulator for Azure App Configuration?

[nagyesta]

Hi @tnc1997 ,
we can configure whatever is needed, but using the static configuration sounds easier, a full OpenID Connect implementation could be unnecessary just for the sake of having a dummy token. I think it would make sense to either get the configuration properties from the user, or generate a random config and use that (for example Lowkey Vault is only checking the existence of the Authorization header so the token itself does not matter. In this case the random config could be convenient).

Just for my benefit, could you please specify the full set of configuration parameters I should use and the rough idea how the flow should work in order to be compatible with the Azure App Configuration Emulator?

[tnc1997]

could you please specify the full set of configuration parameters

Of course, no problem at all, I will aim to put something together over the next few days.

[nagyesta]

Thank you, much appreciated!

[tnc1997]

Here is a sample (using a forked version of Assumed Identity) that uses Managed Identity to get an access token.

[nagyesta]

Hi @tnc1997 ,

thank you! This is awesome! How would you like us to handle this? Would you like to open a PR and let us go through the normal flow to make sure we preserve your copyright or should I just use your code as a blueprint and reimplement it myself?

I am fine either way, just let me know what your preference is!

Also, I will play around with it a bit so that we can use the same mechanism for Azurite as well...

Thank you!

[tnc1997]

Would you like to open a PR and let us go through the normal flow to make sure we preserve your copyright

nagyesta/assumed-identity#146

[tnc1997]

Also I will play around with it a bit so that we can use the same mechanism for Azurite as well

https://github.com/tnc1997/azure-app-configuration-emulator-managed-identity-sample/commit/ae2ba198fffa94f705fd040180a38766d4604a1f

[nagyesta]

You are the best! Thank you!