Using Azure AD Service Principals to Secure Applications
With the new ARM model, you can use Azure AD service principals to secure applications. Read this article to find out how.
Join the DZone community and get the full member experience.
Join For FreeCustom applications typically need access to other resources in Azure, such as databases, REST APIs, and other PaaS services. Azure AD allows you to create applications that function as service principals which enable your application to authenticate with Azure AD and can be granted roles within your subscription to provide access to resources in a secure way.
In the past, using the classic Azure Service Management API, Azure required you to create a self-signed management certificate and upload it to the portal to be used to authenticate an administrator. This model has been replaced with the new ARM model. Now you must authenticate as your service principal to Azure AD. Your service principal must then be granted the necessary RBAC role in your subscription to gain access to resources.
Service principals can be authenticated by Azure AD either by:
1. A Client ID and Secret. The "Configure" tab in the Azure AD "Application" entry will display the applications Client ID as well as the option to create keys that function as the application secret.
2. A certificate. Using PowerShell, you can upload and bind a certificate to an Azure AD principal that can be used for authentication. 
Once you have created your service principal, you can then use the ADAL library from just about any language or platform to authenticate using your credentials or your certificate to get back a JWT token which you can then use to authorize your application to just about any Azure resource
Published at DZone with permission of Eric Grover. See the original article here.
Opinions expressed by DZone contributors are their own.
Comments