This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 99%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPD%3C/text%3E%3C/svg%3E)
I'm trying to simply add Microsoft Entra ID for authentication to an Azure web app. I have a javascript chat-app using Web PubSub that worked perfectly using this example:
https://github.com/Azure/azure-webpubsub/tree/main/samples/javascript/chatapp/nativeapi
I followed the instructions here using the work-force configuration...
The instruction description says "No SDKs, specific languages, or changes to application code are required." I used the defaults and now the app will connect to chat server, but then the connection is terminated with the first message. I make up that Web PubSub needs to be authenticated to my web app, but I'm unsure how to get this done. Is that the problem? How do I resolve in the simplest method, preferably with no code changes?
Thank you,
Peter
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 92%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
@Peter Daniels , Thanks for posting your question. While I'm checking more on your scenario, based on my understanding of your issue description:
Authentication is necessary to access a Web PubSub resource when using Microsoft Entra ID. This authentication involves two steps:
While the Azure App Service authentication/authorization feature does not require any changes to your application code, adding authentication to your Web PubSub service might require some code changes. Kindly checkout these reference docs:
Kindly let us know, I'll follow-up with you further.
If the answer helped (pointed, you in the right direction) > please click Accept Answer - it will help users to find the answers quickly.
Thank you for responding. The scenario is actually the Azure web app under app services that needs the authentication not Web PubSub. The web app uses Web PubSub to manage the websocket for the chatting. The Web PubSub does not require authentication. Somehow the socket will not stay open once reported as connected by the web app. This all works fine before attempting to authenticate access to the Azure app services web app using Microsoft Entra ID.
Thank you Ajkuma for your response. It is not the Web PubSub that needs authentication it is the Azure app services web app (chat app). The web app then uses the Web PubSub to process message flow. With Microsoft Entra ID added to authenticate the web app the websocket connection, managed by Web PubSub does not 'stay' connected and closes. The Web PubSub is calling an eventhandler in the web app 'server.js' file. I was thinking that because Web PubSub is communicating with the web app that it would somehow require a token it does not have because of the Microsoft Entra ID requirement for the web app. I have tried turnning on Identity for the Web PubSub and entering its principal ID into the web app registration option, but to no avail.
Thanks for the follow-up and additional clarity. I'm checking on this and will get back to you soon.
Thank you. I am looking forward to hearing from you.
Based on sample my tests, you need to follow the steps outlined in this doc to configure the Web PubSub resource. Upon completion, an authorization header will be attached in the request from Azure Web PubSub Service (AWPS) to the WebApp. This header ought to be a JWT token, signed by Microsoft Entra, representing a managed identity, which could be either system-assigned or user-assigned. Your code executing within the WebApp should verify this token.
Kindly let us know how it goes, I'll follow-up privately to seek more info about your Azure resources.
@Peter Daniels , Just checking in to see if you had got a chance to see the previous response. If the answer helped (pointed you in the right direction) > please click Accept Answer Or please share the requested/more info to help you better.
I will be working on it today and tomorrow and will post feedback.
Peter, Great to hear! Looking forward to receiving your feedback. If you have any questions or need further clarification while working on it, feel free to reach out.
Here are the steps showing how to enable managed identity authentication in event handler settings https://learn.microsoft.com/en-us/azure/azure-web-pubsub/howto-use-managed-identity#enable-managed-identity-authentication-in-event-handler-settings
Ajkuma,
This is the exact process that I followed that got me to my originally stated problem...and I am having the same issue.
Help me understand the need for steps 7 and 8...
"7. Go to Azure SignalR Service and follow the steps to add a system-assigned identity or user-assigned identity.
They seem vestigial (or redundant) unless I need to use SignalIR for some reason I don't understand. Since I'm using Web PubSub is there a need for steps 7 and 8?
Also, you say my code should verify the token and allow access. I'm not sure what that would look like. Do you have an example I could follow? I thought the Identity and Microsoft Entra ID was handling the authentication to the app and back and forth between Web PubSub since they are both managed identities in Microsoft Entra ID.
Apologies for the delayed response from over the weekend.
Thanks for the follow-up and sharing additional details. We will get back on this shortly.
Oops there is a typo here, all SignalR service in this document should be replaced with Web PubSub service... (the doc writer copied the steps from SignalR docs as they are quite similar and forgot the update..)
Peter Daniels, Apologies for any confusion. As Liangying Wei mentioned, I have raised a PR and the doc will be updated soon.
Kindly let us know how it goes. We appreciate your feedback and collaboration thorough this.
ajkuma,
from my previous comment...
"Also, you say my code should verify the token and allow access. I'm not sure what that would look like. Do you have an example I could follow? I thought the Identity and Microsoft Entra ID was handling the authentication to the app and back and forth between Web PubSub since they are both managed identities in Microsoft Entra ID."
Can you provide an example (if code is required) how to fix this problem? I'm still not sure why it stopped working when I added login authentication for my web app.
Peter
Hi Peter, if you are using WebApp, the tokens are validated by the workforce configuration and you don't need to verify the token by yourself. Have you specified the "Use Managed Identity" and "specify the token audience to your application" in setting the event handler Authentication? Are you still facing the same problem?
Apologies for any confusion, I was trying to understand your exact setup/scenario. Thanks for your collaboration.
The doc steps as outlined by Liangying would help accomplish your scenario, just summarizing the workflow here. Please let us know, I’ll follow-up with you further.
Managed Identity: Azure Web PubSub Service can support only one managed identity, which can be either a system-assigned identity or a user-assigned identity.
· System-assigned Identity: To set up a system-assigned identity, you need to create an Azure Web PubSub Service instance and then enable the feature.
· User-assigned Identity: To create an Azure Web PubSub Service instance with a user-assigned identity, you need to create the identity and then add its resource identifier to your service.
Client Events Scenarios: Azure Web PubSub Service is a fully managed service, so you can’t use a managed identity to get tokens manually. Instead, when Azure Web PubSub Service sends events to an event handler, it will use the managed identity to obtain an access token.
Event Handler Settings: You may enable managed identity authentication in event handler settings by adding a system-assigned identity or user-assigned identity.
I believe I have tried all these things several times. I will reset all managed identities and authentication settings and start from a clean slate. I will report my results tomorrow. Is there someone who could look at my specific application just in case I'm missing some minor detail?
Thanks for the update. Kindly let us know how it goes. If you would like to connect, you may file a support ticket for a closer, immediate and focused assistance: create an Azure support request. / We will follow-up additional with you.