Member-only story
Azure app registration and enterprise app 2: IDP
In a previous post, we have discussed app registration/enterprise app works as dedicated service principal for client outside Azure. They provide client ID/secret for application code to login Azure for further resource access. It was focusing on “app registration A” in below diagram.
In this post we’ll talk about “app registration B” in below diagram that works as IDP role to provide identity for Azure resources like container app service. In another word, to protect Azure resources with identity authorization (OAuth).
Note, one single app registration can do both but separating focuses can benefit some uses cases (for example, multiple service principals can be associated to different app roles in app registration B. Thus Azure resource can treat requests differently based on their OAuth token role claims.) and help understand what’s going on underneath.
1 Protect Azure resource access by adding an IDP in it’s authentication setting
In Azure resource (container app here) we can see an IDP is added in “Settings” -> “Authentication”. The IDP points to “app…
