.Net Foundation On .NET, 19 Apr 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Using resource tokens with Azure Cosmos DB

Description

You can authorize your applications to connect to Cosmos DB using master keys or resource tokens. Depending on the level of control that is needed, your application may need to use one or even both of these approaches.

In this episode, Chris Anderson (@crandycodes) comes on to show us how to request and make use of resource tokens in Cosmos DB. Along the way, he also shows us some other interesting features in Azure App Service such as EasyAuth and Run-From-Zip deployment.

01:23 - Cosmos DB Token provider code
04:20 - Future proofing with .NET Standard
06:50 - Exploring the token provider implementation
10:44 - Cosmos DB keys versus resource tokens
12:02 - Demo Acquiring token
14:53 - Deploying using run-from-zip
21:50 - Setting up EasyAuth

Take a look at the links below that point to code samples, documentation and the official announcements for the features:

Token Provider sample on GitHub: https://github.com/christopheranderson/tokenprovider
Securing access to Azure Cosmos DB data: https://docs.microsoft.com/en-us/azure/cosmos-db/secure-access-to-data?WT.mc_id=ondotnet-channel9-cephilli
Run-From-Zip announcement on GitHub: https://github.com/Azure/app-service-announcements/issues/84
Authentication and authorization in Azure App Service: https://docs.microsoft.com/en-us/azure/app-service/app-service-authentication-overview?WT.mc_id=ondotnet-channel9-cephilli
Create a Free Account (Azure): https://aka.ms/azft-net

A

In this episode of the on.net show, we have chris anderson joining us, and he's going to talk to us about authenticating our apps with cosmos, db.

A

Welcome to another episode of the on.net show., my name is cecil phillip, and with me today I have chris anderson.. What's going on chris? hey,, how is it going?.

B

Doing pretty good, man. so you've.

A

Come some interesting demos to show us today. right?

A

yes, couple of things., so you have this demo. You wanted to talk about doing.

A

Resource tokens authentication like what is that?. What's that about? yes.. So if you want to use cosmos db, today,.

B

Most people end up using cosmos db from a well-known trusted server and using their master key to actually talk to their server., but one of the other options that's available is using resource tokens. okay.. The challenge is that, in order to actually create a resource token,, you need to use the master key to create a service which is well known and trusted to.

B

Create resource tokens which then issues that to less trusted services based of what they are should be able to access. got you. so,, normally you'd go ahead and set yourself up like a web app that would do that., but I thought cosmos is really infinitely. Scalable.

B

Why not use, then, which also scales with it and use functions?.

A

So I went ahead and took.

B

A couple of samples that we have for doing token issuing and wrote a function sample with it.

B

Got you. so let's take a look at and see what you got.

A

Yes., so it's here on github.

B

I'm going to go ahead and explore inside a visual studio, but if you want to you can go ahead and find it there on this github here..

B

I have visual studio opened right now and in it,.

B

The kind of the meat and potatoes of what's going on here, is, I've got this function, which is going through there and looking for a couple of header properties which indicate that "easy off" has done its job and authenticated this user who's trying to access this endpoint.

B

A

So we only want to allow.

B

Authenticated users to get a token,, we don't want to be handing out tokens to the entire world, technically. right., so pretty much. What was happening is.

A

That my function, users, authenticated, and I wanted to use that same user context, to talk to my cosmos, db.

B

In a certain way to try and translate that user context into a cosmos, db or azure text.

B

Cosmos isn't aware of like ig or like facebook or whatever you'd be using to authenticate to the service.. So what we have to do is to translate kind of application, authentication features into the services, knowledge of things.

B

So you might want your application user to access any information about themselves.

A

In cosmos, that would translate to a given collection in.

B

A given partition key within that collection and through.

A

Issue a resource token, for only that partition, key.

B

Got you. okay, cool.

A

So yes, here we grab the users information.

B

You can see we're passing the "token". We know that it's going to be json web tokens..

B

We can go ahead and just use the built in jwt security, token library, that is there in .net.

B

Then, if there's an error, we can go ahead and throw myself area here of unauthorized. And importantly, here we're logging, a error and info warning,.

B

And if I have app insights turned on,, this will then show up in app insights.. So when the user or third party service emails me saying,.

B

"Hey we can't access our cosmos,". They can give me my location id that I have set here, and go. Look it up in app insights to go figure out why they were not able to get into the service.

A

Yes,, you could see some telemetry about what exactly happened: the time,, the date..

A

We might not want to leak information.

B

About why that happened to public internet., so we give relatively unhelpful, you weren't able to authorize error, message.

A

We will make sure we don't want to lose.

B

The reasons when we have to debug later it's easy to look up. got it.. So that's a really nifty thing here of having azure functions and app insights baked in together. got you. here,, I'm going through there, and in this case I'm reading the permissions that people were allowed to access as just app settings..

B

So this way it's kind of a static set of permissions.

B

I could back this with a cosmos db table., so I can have a table of permissions that a given user was allowed to access instead..

B

So if you wanted to,, you could take the sample and change this logic here, where I'm basically translating.

B

Basically, it's like a connection string type of format.

B

I'll show you an example here in a second, and then that actually gets turned into a permission, object that I've got here, some adding a permission to my permissions token, and I'm fetching it with this resource token provider class,- and I just did this as a separate class.

B

This class here is actually just a .net full framework app, because I'm using functions "b1" still.. But I wanted to make sure that I could actually use the .net standard library for cosmos..

B

And so I implemented the cosmos. Specific pieces, ended up in a state library and then reference that from .net framework., so you're, using like .net's standard 2.0 to leverage.

A

So when functions, v2.0, ga's.

B

I can write a separate functions, v2.0 sample that uses all the latest things and functions v2.0,, but obviously there's some breaking changes between b1 and b2 so,. I wrote the samples so that way I could have both versions around. right., so you could still pull in your db resource.

A

Token b writer., all you need to do is just you will change your function, app. make whatever updates you need to make., but in that code, like that business code, so to speak,.

A

Is still like relevant, still valid,, you can still use a web.. The only real tricks,.

B

The advice that I could give folks, would be make sure that you,, if you're passing objects back and forth between those two libraries, go and create your own custom. Objects., don't pass "json.net" objects back and forth.

B

Because that's a really easy way to fall into the old dependency issues gap where you're using.

B

The different versions of your json.net platform: they support different types and you have odd translation errors there,.

B

So you can always get around that with redirects and stuff like that,, but I find it oftentimes easier to just create my own custom folder.

A

Right. I got you. so one thing I wanted to ask you about., so you are using some types here, permission token and also app permission.. So where did those come? From?

A

are those classes you wrote or are they part of the sdk?

A

yes.? So permission token.

B

Is both of these things are types that I created., so basically I created the app permission is something inside of the function: project.

B

as something to hand off to the .net standard, library.

B

Then the permission token is actually coming from.

B

The opposite direction, so that's coming from the .net standard, library.

B

So these are, these are types that I created., so it was just easier for me to go and work with. My data.

B

got it. these have this: has the "json.net" annotations on it? So that way it goes and gives me the object that I expect to when I return it for functions and that works just fine.

B

got it., so yes., I'm going through here,, I'm basically just creating a list of those permissions and then entering the list and azure functions will automatically go ahead and transform that list into an array of "json objects" to run for me.

A

So, instead of that, then that would have like one of like you can get your token from there.

A

yes.. So the actual token logic.

B

Itself, if we want to dive into that, the core of it, is essentially going through there.

B

And I look to see whether or not it exists in the cache..

B

I keep it in memory, cache that we don't have to go ahead and ask cosmo's each time.. If I've already looked up it, and the tokens are valid for.

B

An hour,, and so if I've already looked at this token on this function at before in memory., so I could have thousands of instances of my "function app. ". So maybe I've got thousands of it in memory still..

B

But you know this simplifies using like a redis cache and memory. Cache is actually pretty effective. Still for a lot of these cases. great.

A

If it's not in there,.

B

I actually go through there and I try to create it.

B

If it fails, then it might actually already exist because of a race condition..

B

So that point I go ahead and try to query it existing through the permission feed..

B

So this is just some of the quirks of the resource. Token apis..

B

You know you can only create a single resource token for a given resource..

B

So if you want two different users to get access to the same resource at the same level permissions they get the same resource token and see if to do some kind of hops right now. This isn't ideal.

B

we're working on some other things inside of the cosmos db team, to try to improve the experience of how you do authentication for things.. But this is the reason I wanted to create myself. My own custom class, for this is because this allows me to go ahead and kind of compartmentalize, some of the more complex business logic away from my application that doesn't need to care about how I get the token it just want. The token.

B

got it.. So I'm guessing on your side that.

A

If two users, with the same resource, are using the same token, you'd have to manually, do some mapping on your side to say,? Hey these users are allowed to see this resource.

A

Then once you get the token back, here,.

B

I'm going to let you use this tokens access, cosmos.

A

So effectively what I'm doing is inside.

B

I can show you an example of what the actual connection string looks like that. I'm using in this model.

B

As you can, see,.

B

From my local debug settings,, I'm just using these local things. so,. If you copy and paste this key, you're not going to get yourself very far,, people. got it.

A

B

I've got a connection string, that's essentially just the resource path. In my cosmos, studio.

B

so,, you can see dbstes2callstest3.

B

yes., then I print my permissions settings there for all..

B

I can also, in this sample, and this is docked in the read me,. If anyone wants to follow along later., I can also specify a property. That's going to be on my json web token,.

B

That I want to use as the partition key.

B

so,. This allows me to do user-specific filtering for resource tokens.

A

Got it. okay. so,. I can go ahead and I can set this to upn,.

B

Which is the property on the json web token that refers to their email address.?

B

You have to go and look up what properties are on the json web token, in your particular case, to know which ones you can use., but once I've done this,, I can now use that key from my json web token to filter out which things people are allowed to access.

A

Got it. so, in the case that I was just doing,.

B

Everyone can access everything on this collection..

B

A bunch of people will be sharing the same resource token. yes., but in the case that I was doing, user specific partition, key tokens,, each user would've been given their own unique resource token for their partition. Key.

A

For their partitions, got it. so, yes,, it's complex.

B

If you are really interested in how the authentication pieces for cosmos, works,, I'd definitely recommend just following through the code, because it can be really interesting to see how that stuff works., but for the most part, my goal was to build something that you didn't have to think about., you give it a connection string and it returns a token of equipment permissions to that connection, string.

B

nice. what we can do too is,.

A

We could take, you have this on github, right? so,. We can always add the links to the bottom of the show, notes and people can check it out and see what exactly you want.. As we add additional ways of authenticating.

B

The cosmos, I plan on trying to expand that sample with those other ways, and I'm even thinking about trying to add storage inside of this,. So you can use the same mechanism to get access to a storage sas token..

B

We have other samples for functions to get a sas token for a new blob. yes., but I thought it would be really interesting to introduce some of the same concepts for storage as well. so,. This sample will keep on getting work on over some couple of weeks.

A

So,, just before we move on, tell us again, like,.

A

Why is it a good idea, or why do we have this option of using resource tokens versus just using the typical master key that gets generated for us when we create a new cosmos db, collection? yes., I mean,.

B

It's often times because you're being told to., but it's really because you want to always try to.

B

Follow the principles of least privileged access.

B

If I'm writing,, if I'm just using an insurance company as an example,, let's say that I'm an insurance company, that I need to share some of this data with third parties.

B

other businesses of b2b type scenarios.

B

Maybe I just want give them access to my cosmos tv, but I want them to only be able to read certain collections..

B

I don't want them to be able to write data, obviously, and I don't want them to read everything..

B

I don't want them to read certain types of data. yes.. I can now issue a resource token.

B

That gives them very specific access, and I can go ahead and revoke that access within the expiration time of the resource, token. so,. If I want to stop doing business with them,, I don't have to rotate all of my master keys.

B

A

I only have to just prevent.

B

Them from being able to log into my application, forever. so,, I have more granular access, partitions.

A

In my different collections, when I use this particular way of authenticating users.,.

B

It's scoped and timed. so,. You don't have a token that can last for forever.

B

So,, you don't need to worry about rotating it.. It's automatically rotated. nice. cool. so,. What you end up getting when you actually run this thing,, you can see! You can run this locally by just setting all these properties..

B

They won't be validated unless you're using easy, auth. so, just be careful that you make sure that you turn on easy auth. When you end up running this thing on azure.

B

Easy auth will go through there and strip these things,.

B

If you try to send these things to, when you're running on azure. so,, you don't have to worry about people trying to spoof.

B

To spoof you with some of these type of tokens.

A

Yes., but this is what ends up getting returned.

B

I now have this token that can get access to my cosmos db for an hour.

B

I have this expires title here that I can use.. You can see that I actually have the resource,. I give them access, and so,. I can easily now consume this from the cosmos db. Stks.

B

If you want to learn more about how to actually consume this from the cosmos db, stks, we're not going to go into that sample here., but there's this great article here on the cosmos db, documentation about securing access to data and using resource tokens..

B

It describes some of these kind of patterns of using things, and so, with this code sample,. You can now do this in a several fashion without having to stand up a dedicated server to issue these tokens.

A

Nice., that's great., that's awesome.!

A

So chris,! Why don't we talk a little bit about,?

A

How can we deploy this? so,? I have this thing. That's going to issue tokens for me,. I have my function set up,. My cosmos db is provisioned. you're running this locally now, right?.

A

I want to push this in the azure.. How can I securely push this out? There?

A

B

Advocate for people who are building azure applications to make sure that they are always having their arm template as part of their solution in the case that they're doing .net projects., if you're doing something, that's not .net, you can always just have the arm template as some directory inside of your project., but I really love visual studio's arm project support.

B

So,, I'm going to show how that works. Here..

B

This is an example. Arm template that's going to go ahead and deploy myself..

B

You can see here the actual resources on the side here,, which is one of the reasons. This is such a great experience.. I've actually got a storage account,.

B

I have my app service hosting plan,, which is the dynamic hosting plan that hosts my function. Apps inside of it. yes., mostly an implementation detail for most people,.

A

And then the actual function, app itself,.

B

And then something that I always advocate for app insights. make sure that you always have app insights for your function. Apps..

B

It just makes debugging so much simpler to monitor and manage..

B

Yyou can do that as part of deployment. so,. You don't need to worry about setting it up. Afterwards. nice. got it. inside of the web app itself or the function app itself,.

B

I have all of my settings..

B

You can see here I'm setting my webjobs dashboard,, my webjobs storage,, my local files connection string for getting azure files. Working.

B

I'd be changing this to either two,.

B

If I was using the [inaudible].

A

In the case of v1,,.

B

We can go out and set that to one. for those using node, that setting won't matter.

B

well,. It doesn't matter so much for .net. so,, pretty much. What we're looking at here,.

A

These are environment, variables,, right, that I could go in and I could change,, and these would be inside of my app settings once function. Supports. the interesting one here that I wanted.

B

To talk about [inaudible] is something different that,. I've really never done it before for function,. So this is fairly new. okay.. That's the ability to run-from-zip.

A

Oh, so, hold on one second.

A

so, today,. I could right click, publish in visual studio.

A

I could use vsts, right, and you can also use github or some other source control deployment, tab, options.

A

So,, why would I want to run-from-zip?, tell me exactly,: what are the scenarios that I'd want to do this versus some of the others?

A

B

Those other mechanisms to deploy that you mentioned,.

B

Actually end up putting stuff inside of azure files.

B

Yes., the problem is that that means pulling all those things from azure files, every single time that you run, and that can be a little bit slow.

A

Okay. so, one of the things that.

B

Azure functions has come up with in order to help alleviate this is the ability to go ahead and have a compressed, zip, package.

B

so,. It's a lot easier to download your contents locally and run from them without having to download them all from azure files. Each time that we come up with a new instance.

A

So, with run-from-zip,.

B

I'm able to just have cold start reduced by a pretty dramatic amount,, especially if you're doing node.js, with lots of node modules,.

A

But it still helps for .net, where.

B

Things are a bit more sane. got you.

A

So,, regardless of whether it's node.js or c#,.

A

Or whatever other platform that azure functions, supports,.

A

All I have to do is pretty much package up. My azure functions, application, package it up in a zip file., I'm guessing I'll upload it somewhere and then it'll just pull it down and just run it for me.

A

yes.that's. One of the cool things, is that,.

B

Since it's just asking for a endpoint to download that zip from,.

A

It's really flexible about where you put that zip.

B

You could structure your application in such a way that it was just hosted on github and you used github's download, zip feature, and you just posted that as the url., you can put it inside a blob storage,, which is what I've got an example here. Of.

B

okay., one really cool thing is that you can actually put that url behind a redirect. Link.

B

so,. If you have a redirect like a proxy,.

A

You can actually go ahead and put.

B

Your zip link behind that proxy, and then update that zip link without ever updating the proxy. so,. Now you can go ahead and do deployments without actually pushing them everywhere..

B

This is really helpful for this.. I actually use this in the sample, because what we have is when you publish the sample,, I didn't want you to necessarily have to run through the steps of building that code..

B

I wanted to have it already kind of package,, so it was a lot faster to deploy.. This is a lot faster because it's already compiled for me.

B

so now, when you actually deploy the sample and deploy the arm template,.

B

It actually just runs from a zip that I have hosted on one of microsoft's blob storage, accounts.

B

so,. This was way faster than doing.

A

A source control, push because,.

A

Again,, if I think about publishing versus git.

A

so,, it's going to look at my repo., it's going to,, let's say it's: node, or.net or whatever..

A

It's going to have to restore my packages, run my build, package, it up, and then it has to go put it under the disk over.

A

yes.. With this one,, it's ready, built,, it's ready, packaged,!

A

It's really just saying, "hey, just go grab this artifact and run it." yes, and the nice thing there.

B

Is that it's really easy to then roll back.? If you were to push version three out and had an issue,.

B

You could then go ahead and rollback yourself to v2 without having to actually rebuild v2.

B

As long as you have v2 sitting out there as a blob still,, you just change the setting and point back to that v2 blob., okay, cool.. You can do some of these same things with things like vsts.

B

vsts has support for basically having your artifacts already stored inside of vsts,, and then you just web deploy those previous versions of artifacts back..

B

The main advantage of this is that this actually runs it as a zip on the local file system, and so it can still be faster than doing web, deploy to the azure files. Stuff., that's the biggest advantage., but because now we're able to use this public address zip,, we can do a lot of those cool things.

B

That vsts also enables you to do in terms of version control and stuff..

B

The nice thing is, vsts can still publish your contents to a blob,, and so you can still have some of the exact same patterns as you do in vsts.. This doesn't stop those from happening.

A

Cool., that's cool.. Let's take a look and see how this works. yes. so, in the interest.

B

Of making sure that it's actually like a live demo,, I actually only created the resource group.- there's actually nothing there to kind of prove, there's nothing up, my sleeves, so to speak,.

B

Here's my resource group and it's empty right. Now. got it. so, the nice thing, this is,. It's really easy for me to go ahead and just hit deploy,.

B

Click on my resource group that I'd already set up and created. I've already got my parameters set up here that actually have secrets and stuff in it.

B

so, having those separated from your actual template is generally a good idea. okay.. The only reason I didn't have that storage string as.

B

Actually, a parameter is, I didn't want to have to show all of my secrets.

A

Yes. so, normally I'd have that as a variable.

B

So we will go ahead and run, and we see here that this is going to show up in this "output" here at the bottom.. So that's going to go ahead and keep on deploying. yes.. If we go back and we look at our resource, group,.

B

We should start to see "services" show up in here., so this has already created the app insights.. It's already created the app service plan, and now it's creating the storage account and then it will create the function. App.

A

It's going to create the function app. so pretty much again, like all of these things, where you had to define inside of your arm template and now by just publishing the arm, template, azure is going to look at the template,.

A

Look at your parameters,, your variables,, all that type of stuff. so,. It just start creating all of these resources. Inside of this "research group".

B

Yes. so,, it's really repeatable and I'm sure that everyone listening has already had it drummed into them.. They should use arm templates to do their deployments. yes. but really,. It saves you so much time. Even when I'm just trying to do a demo.

B

so,. You can see here that everything has been created. Now. yes., your function, app is there,.

A

The resource group, everything is right, there.

B

If everything went well,, when I click on this "function app",, I should actually be able to see that my function now contains my "cosmos token provider".

A

B

Anyway,, I never actually right clicked and published the function app..

B

You notice that I didn't go through that step of actually going through here and publishing this. yes.. This is running off of the url. That.

B

Already had there and it already had a copy of this demo published here., you can see token providers. 0.0.2 was already there.

B

So this is running that version.. You can verify that by going to that function,.

B

And actually one just tip from me,.

A

Is if you go in your host.json, you can actually.

B

Store variables that belong only to your application., so they don't have to always be variables that function app knows about. okay.. So what I would like to do is I would like to store my app version of my host.json, so I can always tell which version of my application- I'm running.

B

Okay., so just a little tip from me is, one of the places you can store information like that. sure.. I mean, and is this.

A

Accessible from my function's app, or is this just purely like a deployment artifact?.

B

So this is your host.json.. You can always access host.json,, it's just there at the base of your project. Structure.

B

You can also make like a static variable in the case of .net,.

B

So if you wanted to have it as something that you could programmatically access,, I might actually just make it like a static, readonly property that everything can access. sure.. But if I want to just add a glance to be able to see things,, so json is a very easy way of putting it.

B

great. cool. so, yes,. Now everything set up here,.

B

Of course I've got all of my stuff like app insights turned on,, but the one interesting thing is that if I try to make a request to my function,, which you can't see,, I don't have the content, because it's a pre-complied one,, it wont work because I haven't turned on "easy auth"., so you mention easy auth. A few times,.

A

And I've been meaning to ask you like, what exactly is that?? What do we do with this easy auth?, so easy auth is a unofficial name for.

B

The authentication and authorization service.

B

I found that to be a mouthful,, so I call it by the internal name, which I probably shouldn't,, easy auth. easy auth. chris going to come, find me.. So I can go ahead. I call it easy auth and that was the code name. I guessed for it.

B

because it's just so easier to turn on authentication..

B

I can go ahead and put "ad" in front of this function, app by just clicking on, "turning on easy auth".. You see, I have a lot of providers that I can set up..

B

I want to go ahead and just use the express mode where this will create a kind of default ad application for me.

B

Hit "okay",: this will go off and create that and I can go ahead and hit "save", and then once this kind of spinning line, finishes,.

B

I'll actually have ad in front of my applications..

B

You can see that took all of like five seconds, and I can do this in an arm template too. in this case, since the sample. I want you to be able to choose which authentication provider you're using. sure.. I have you, do it this as second step,, so that you can go ahead and have your app key and authorization token as part of your arm template as well.

B

got, it. got it. so, now,. If I go ahead and try to access this function by grabbing the url,.

B

And it's going to restart when I change the authentication., so there's just going to be a little bit of spinning the stuff again. grab this url right here and it will go.

B

Ahead and just do a redirect bounce for me because I'm already logged in., so I actually go ahead and open up an incognito window..

B

You can see it gives me that "cannot authenticate user". it didn't set that up.

B

So we're just waiting for easy auth to actually work and keeps me know it's a live demo because easy auth-.

B

So the one step you have to do it easy, auth,, honest mistake..

B

You can turn on easy auth without actually forcing people to always use easy. Auth.

A

This is really helpful if you want to.

B

Have an index page that is an authenticated.

B

yeah. that then you click on "login" button and then now everything is authenticated from there.

B

to make things simple,. You can also force everyone to log in before they ever access. Your content. got it.. So when I go ahead and if I change this from anonymous.

B

To log in with active directory is the forced action when they're not authenticated., so this by default, it's going.

A

To say, anytime, you hit this url,, you need to authenticate with active directory. yes,, and you can see that this was.

B

Secure if I didn't set up easy auth,, it started yelling at me because I wasn't authenticated. yes., but now that I set up easy auth and I now force users when they try to access my url to authenticate,.

B

Now this should go ahead and bounce me out to ad to log in. all right., as you can see,. This is going to take to log in and ask me log in.. I am just going to go ahead and instead open that app where I've already logged in..

B

You don't want me to type out my password., so just entered there. so because you're authenticated in this context,.

A

It's not asking you for username and password, emails, just whatever.

B

Exactly. single sign on just continues to work. yes. then,. Now I can go ahead., it's a new application that I've never visited before.. So it's going to, of course, ask me to accept like any ad application.

B

sure. now,, the next time,. This will asks me that..

B

It only asked me the first time I log into the application. you see here now I have this empty array of permissions,. It will turn xml because we're obeying the content type..

B

So if I change the content type to application json as part of my request, I get json back.

A

Chrome by default ask for application xml.

B

So we get xml back and it's empty because I didn't set up any permissions for my cosmos on azure..

B

So if I set up permissions, that fancy connection, string, you'd see an array of connections, here.

A

Got it, got it., so we've seen a couple of things, right?, so you've shown us how to use resource tokens with cosmos, db.

A

and then now you're, showing us how we could have those resource tokens generated using azure function., that's in itself kind of being protected by easy, auth.

A

Yes. cool. now,. You know it's really simple for you to go.

B

Ahead and start using these tokens within your application., so if you wanted to give users just a little bit of access to your data,, you can now do it with easy, auth and the token provider model.

A

Cool. thanks you for coming on man.. So if people want to learn a little bit more about what you talked about here,, is there a repo that we can go to and to check this stuff, out? yes,, so the token provider.

B

Is the place to grab and learn about the resource, token model and the same example of the one from zip, working.

B

okay. then,? One of the other thing that I recommend people go ahead and do is look under azure app service announcements for the run from the zip announcement.

A

And this is information about.

B

Any of the early stages of this preview. so like they're, working on getting more portal ui.

B

They're working on getting this into the cli., but for now, you can use this by just setting the app setting- and I said it's really, really handy,. If you are looking to reduce cold start from file loading.

B

it's available today in.

A

Function's view on apps and also v2 apps? in v2., it does not work on linux, yet.

B

Does not work on linux.

A

Yes. got it.: okay, cool. also works for app service. Web apps, too.

B

Well, we built this for function specifically, and this is something that works for all of the things inside of app service that are the non-linux version.

B

cool.. That's awesome.,.

A

Thanks chris., thank you for coming by.. Thanks for having me. there, we go. there's another episode of the on.net show.