.Net Foundation On .NET, 21 Jan 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Authentication and authorization options for Azure Event Hubs

Description

Azure Event Hubs Documentation
https://docs.microsoft.com/en-us/azure/event-hubs?WT.mc_id=ondotnet-c9-cxa

In this episode, Serkant Karaca and Shubha Vijayasarathy from the Azure Event Hubs team sit with Cecil to discuss the various methods for authenticating and authorizing clients tow rod with Azure Event Hubs.

[00:56] - What types of authorization options of Event Hubs support?
[01:30] - Using SAS (shared access signatures)
[04:52] - Using RBAC (role based access control)
[09:30] - Reviewing authentication flows

GitHub repo with samples
https://github.com/Azure/azure-event-hubs/tree/master/samples/DotNet/Microsoft.Azure.EventHubs?WT.mc_id=ondotnet-c9-cxa

Choose between Azure messaging services
https://docs.microsoft.com/en-us/azure/event-grid/compare-messaging-services?WT.mc_id=ondotnet-c9-cxa

Send events to or receive events from Azure Event Hubs using .NET Core
https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-dotnet-standard-getstarted-send?WT.mc_id=ondotnet-c9-cxa

Microsoft.Azure.EventHubs NuGet package
https://www.nuget.org/packages/Microsoft.Azure.EventHubs/

#dotnet #eventhubs #azureeventhubs

A

In this episode of the on that, let's show we're gonna learn about how we could authorize and authenticate using Azure event hubs with some folks from the azure event obscene, so hope you check it out.

A

Hey everyone welcome to another episode of the on Lynette show. Now we're gonna continue our conversation about as your event hubs with some folks on the azure Yvette hub steam. Now I know every time we talk about messaging or anything in Azure in general, things like authorization and authentication are very important. That's right! If people want to make sure that the right people or the right processes have the ability to not only send messages but receive messages, and we also want to make sure people don't have too much power because you.

B

A

To be able to restrict exactly what happens, yes, sir, so can we talk a little bit about how we could implement like some authentication authorization rules, so.

B

With even hubs, we offer two kind of two different content: ocation and authorization. One is using SAS pollicis the shared access key signature policies, the other is with integrating with Azure Active Directory, which gives you the role-based access policies and manager, identities which you can use, and you know basically it's all about scoping down to like I said who has the permission to do what right.

A

Who could do what.

B

And then I could set up, you know, roles and.

A

B

Think that I should.

A

Feel specific, yes,.

B

Perfectly yes! So why don't.

A

We take a look first and look at the SAS policies.

B

A

How do we create them? What could we do with them and those types of things sure.

C

When you create your rental namespace by default, you're gonna have route manage shared access, key policy, so this will provide you all available claims which are managed. Center, listen! Okay! If.

B

C

You want to create new policies or more granular policies in terms of, let's say, send on the oldest listen-only. You can click on, add and then name your policy, let's say and then I will send and then create.

A

And then, when you create this, this is particularly scoped to the namespace. You.

B

Can go down to the entity level and also create SAS policies on on that, okay,.

A

B

What it basically gives you is three different types of claims like we saw man eats and and listen yeah.

A

B

The managed claim says that you can create resources or entities for that particular namespace or.

A

B

That namespace, the send is pretty straightforward, saying you know if I were a producer and I want my producer to be just sending not listening, not consuming so I would just put them on the send claim saying you can only send to this yeah.

A

B

Have no power to receive it so.

C

B

Same thing with listen, no entity which is having a listen claim, can only listen or receive from that particular event up and not send to that. Send you.

C

Drink that thing, sorry, we ever created a policy. So it's the same as the same experiences: the default route, many shared access key. So basically you have the keys and the connection string. If you wanna go with that, so once you create the event up client, if the same policy, only your client will be able to send, but not just you and.

A

I'm, looking at the the browser there like, so you have the primary and the secondary key: do we we are guessing. We have the ability to rotate. Oh that's.

B

Right, that's right: you can rotate those keys, you can have them in secured and key world and yeah.

A

B

Pretty much I think it's common across many actual services which use the shared access policies as well gotcha.

C

Yes, you also mentioned you can go to each event top and then on event up tab. You have the same sort of experience, so you can go shared access policies here. You don't have the default policy, because the namespace level you have the default policy, which applies to the event ups underlying the namespace, and at this point you can create a demand. Center, listen claim policies. This will be a per un top right.

A

So this is how we're getting more granular down right.

B

That's yes, so that.

A

First, one we saw was for the namespace like.

B

A

This particular one: it's.

B

Very molecular entity inside of the namespace, so it's like if I have a namespace and then I define all the three claims on to it and I scope down into that particular entity and say you only have the send permission and not listen on it. So if the particular namespace has say three event hubs, you can pretty much send and listen on to event hubs which has all the claims from the namespace, but that particular event hub, which has only the send, cannot let you listen, that kind of granular scope that it defines. Okay,.

A

Cool, so what other different types of mechanisms do we have right? So we saw that there's a skis. Yes,.

B

A

Do we have the ability to use like Azure, Active Directory, that's.

C

Various access controls right. Yes, recently we have g8 our are back authentication or authorization for every month of service. So if you go to access control tab, you can use our built-in rules to make it some secure identities. So.

B

We have three built-in rules: data owner data center and a data receiver, yeah.

C

As you can see here list at all three roles, this data owner gives you the same sort of like access permissions like managers and understand yeah.

B

C

This field will only give you yeah.

A

Gotcha so then I could take anybody. That's inside of my organization, for instance- and you know using my Active Directory credentials, I could assign them permissions to be able to yes.

B

A

Or just or just write, yes,.

C

That's cool like so.

B

It's the azure active directory, which is the governing principle here. Yeah.

A

B

Whatever is in Azure, Active Directory is how it we also assign roles to so anybody in our organization or any organization having integrated with aad can now be defined rules or given permissions or access to got.

A

It so what about managed identity I know a sure has that for some various services, like sequel server, for yes, do we have the ability to use that in here, as.

C

Well, that's correct! It's the support on the SDK side once you have role assignment for this secure identity or let's say once you create an as a service VM or as your functions yeah.

A

C

You enable manage identity, then the identity will be able to be used by our SDK and.

B

You can define roles and access permissions on that particular identity as well. Our.

C

Manage identity, our manager, identity, API, is pretty much straightforward. Basically, you create you hold. It only went up client, we call created, managed identity, providing the host name and the event app name. You want to send and receive so.

B

The host name is nothing but the even tops namespace name yeah.

A

B

Yeah and the entity name on which you want to define that got.

A

It okay and then can you show us an example to how we could use this sass, the sass token, let's ask you sample of that one to.

C

Know I have closed those.

A

Yeah cuz I think it's it's great that we have so many different, flexible.

B

A

B

A

Alright, because I know you may have scenarios where.

B

A

We want to authenticate a machine or a that's.

B

Right so that's you.

A

Know a non-living being correct.

B

A

And then we have situations where we might want to have a developer or you.

B

Know a different type.

A

Of process all right, so now we have these different options that we could use. Yes,.

B

And those different scenarios- yes, that's right, yeah! That's why integrating with Azure Active Directory gives us that flexibility, where you are registering into ad or.

A

B

Active Directory the application yeah.

A

B

The particular role, or that particular person, or that particular user gotcha.

C

Gotcha, okay, so here is a sample how you can wire up the shared xxxx signature and create your client. On top of that, basically, on the portal you go to shared access policies, tab. This one is.

C

And then you can copy the connection string with primary key from Portal and then you can use it as a connection string gadget well.

A

I like about this approach, is that we can just go in the portal. We can copy the entire with this ASCII attached to.

C

B

C

Condition 3, as you can see, you have the endpoint information, hmm sheer access, key name, which is some policy which we yeah.

B

C

And the secret, which is shared access key basically.

A

C

Once you create the amount of client now, depending on what permissions are lob, then you can do send, receive or manage the operations. Okay,.

A

Awesome well those great.

B

A

There anything else that we need to know about security in terms of like how we secure as your event, hubs.

C

Maybe we can touch base some of the different like authentication flow yeah.

B

C

Talked about the major identity, so I can show you our API briefly. So there are different old flows available from the ADA side, so say, for example, interactive user login is one thing mm-hmm, so any user can go and then like log into their account and start using our service or even tops, depending on what type of permissions are assigned to them. Right. Oh, let's say: if you have an app and then you can authenticate your app either a client secret or some sort. Yet so that's another scenario: you're supporting on the SDK side.

A

And I, so you have like client connection flows right.

B

A

Is that there were similar to just me putting a username and password okay.

C

Clang credential is basically secret approach, so they're.

B

Using the mesh marks.

C

Off identity, client here.

A

C

What you do is this: you need to create a token provider which has created reactive director, token provider and then provide a scene callback which will provide talking back to the client self yeah.

A

C

In the in this icing callback, you need to basically just manage the authentication flow through a ID and then we'll prove your true identity to a day and then a table issue and token so by the client that token will be flowing to the service and service bill authorized and then find out what type of permissions you have got it along.

B

With the predefined rules even helps also supports custom roles, so you can provide role based access based on custom rules as well.

B

C

You can roles, as we talked about that we have owner sender.

B

And receiver so.

C

Those have those rules have some granular permissions inside them, so you can use the same sort of permissions and then just graph your own custom role. For example, you can come up with a custom role where you allow the security identity to access to some store check on some subscription and also along with that some amount of service.

B

Only method name, so you can.

C

Do mix and match those kind of things, so it will be, it will become your custom role and.

A

So how would I specify that is that something I specified in the portal or the way that do it in code like how do I know.

C

You can you can create a custom role on on the portal.

A

Yeah got it: ok, nice, nice, nice also. Ok, thank you all so much man. This has been really great and I think this is a really important.

B

Thing to know about soon, as.

A

We're creating our even help namespaces.

B

Instances yeah, as a last note, I, want to add that, although even have supports both SAS and AD, it's Microsoft recommendation for better security and provided granularity and everything that most customers use. Integrated Azure ad provided role based access policies about is.

A

That because it's a more hardened yes.

B

Exactly thrown select exactly.

A

Yes, yes, yeah.

B

Yeah Azure ad itself provides you one level of authentication and authorization on which we define much more deeper.

A

Check security for occasions: that's right, yeah! Ok, so you heard it if you're going to use as your event hubs recommend. The approach is to use a ad.

B

To like secure about your stoner so.

A

Again, thank you all for watching. This has been another episode of the on that night show. We learned how we could authorize on authenticate our agile event hub services again using dotnet and Azure portal.

A