Configure Secure Service Fabric Using Azure Active Directory

This creates an endpoint for each HTTP / HTTPS endpoint found in the manifest. Additionally, we name the ServiceInstanceListener the name of the endpoint since by default it has a blank name, and each listener must have a unique name.

Deploy Application on Secure Service Fabric

• Right click on Service and select Publish.
  
  
  
  
  
• Select the credentials of Azure subscription and then select Service fabric in the dropdown,
  
  
  
  
  
• Click on Publish button which will publish your application to Azure Service Fabric.
• To ensure that the application is successfully deployed, hit app URL in the browser –

https://<service fabric name>.<region>.cloudapp.azure.com/<app root name>/api/values

e.g: https://secure-sf.westeurope.cloudapp.azure.com/drsservice/api/values

Configure Service Fabric in Azure API Management

Prerequisites

Assuming you have already created API Management.

Generate password protected SSL certificate for API management

• You already installed SSL certificate on your Machine/VM. Go to Run>>Type “MMC”.
• It will open MMC console, open primary(server) certificate which you have installed from the downloaded key Vault.
• Go to details tab and click on copy to File button.
  
  
  

• It will open Certificate Export Wizard click on Next button.
• Select radio button Yes, export the private key and click Next.
  
  
  
  
  
• Select “Personal Information Exchange – PKCS# 12 (.PFX)” and click Next.
  
  
  
  
  
• Check password checkbox and enter some password (e.g Pa$$w0rd1234) and enter confirm password.
  
  
  
  
  
• Click Next button and path file path where user wants to create this file (e.g c:/certificate/sslcert.pfx)
• Click on Next and then Finish.
• Above steps will create SSL certificate with password at given location. This certificate will be required for uploading in API management to connect Secure Service fabric through SSL certificate.

Upload SSL certificate on API Management

• Go to Azure portal and search for api management.
• Go to Client certificate section and click Add button.
• Upload your SSL certificate and enter your certificate password.
  
  
  

• Click on Create button. SSL certificate will be uploaded successfully.
  
  
  

Add service fabric API in API Management

• Go to api-management and click on APIs
• Fill in all the details – Display name, Name, Web service URL, URI scheme. Product (if any).
• URI scheme should be HTTP. Because api management url should be called on http protocol. (e.g http://<api-management-name>.azure-api.net)
• Make sure you add HTTPS uri in web service URL, so as to connect your secure service fabric.
• Click on create button.
  
  
  

Add API Management backend for your API using powershell

If you are using self-signed certificates, you will need to disable certificate chain validation in order for API Management to communicate with the backend system, otherwise it will return a 500 error code. To configure this, you can use the New-AzureRmApiManagementBackend (for new back end) or Set-AzureRmApiManagementBackend (for existing back end) PowerShell cmdlets and set the -SkipCertificateChainValidation parameter to True. Following steps are used to set backend -

• Go to windows PowerShell and login to your Azure account using below command
  
  Login-AzureRmAccount

• It will prompt login screen. Pass user credential of your Azure account where api management is already created.
• Run the following command to create API Management backend
  
  
  • $context = New-AzureRmApiManagementContext -resourcegroup <resource group name of api management>' -servicename '<api-mgt name>'
  • New-AzureRmApiManagementBackend -Context $context -Url '<url of secure service fabric>’ -Protocol http -SkipCertificateChainValidation $true

e.g $context = New-AzureRmApiManagementContext -resourcegroup 'Horizon-RG-Dev-Env' -servicename 'dev-env-api-mgt'

New-AzureRmApiManagementBackend -Context $context -Url 'https://secure-service-fabric.westeurope.cloudapp.azure.com/drsservice' -Protocol http -SkipCertificateChainValidation $true

Link SSL certificate to service fabric API in API Management

• Go to API management and select APIs
• Click on Design Tab and click Add Operation button
• This will prompt Frontend screen to add Operation
• Fill details – Name, URL (URL of your action (e.g newservice/api/values)
  
  
  
  
  
• Click on Create button which will create your Get action for this API. Similarly you can add all the actions for this service.
• Go to all operations and click on pencil mark in the backend section:
  
  
  
  
  
• It will open Backend screen.
• Add details:
  
  
  
  
  
• Select target as HTTP(s) endpoint, Gateway credentials should be Client cert and select Client certificate which is uploaded in previous steps.
• Click on Save button
• To ensure certificate is linked to your api, click on Code view on top right corner
  
  
  
  
  
• Two entries are important which will ensure setting are configured correct.
  
  
  • Authentication tag
  • Backend tag
    
    
• For testing - Now go to postman app and hit api-management url (e.g https://<api-management name>/newservice/api)

Add following headers,

• Ocp-Apim-Subscription-Key : < subscription key of specific product linked with your api in api management>
  
  e.g: Ocp-Apim-Subscription-Key: 5dhj952a88144ec08d6942f74bf5a713

• Ocp-Apim-Trace: true

• This will return you response of API through API management URL.

Create client and server app in Azure B2C directory

Prerequisites

• Azure B2C directory should already be created and should have user created. If NOT, create it using this link.

Create Client app (Native app):

• Go to Azure portal and browse your Azure B2C directory
• Go to App registration option click on Add button
  
  
  
  
  
• Provide client app name, select Native app as ‘Yes’ –
• Click on Create
  
  

Create Server app (WEBAPI app)

• Create client and server Application ids (e.g 425504fe-0b0b-40f9-bbb6-1a857dc0470b)

Changes in client and server applications for jwtToken authentication

Client app(WPF) changes to acquire access token

Bearer Token

response1.StatusCode

Server app changes to access token

Before making these changes make sure you already created service fabric application using visual studio and has stateless Web API service.

• Go to startup.cs and make changes (marked in yellow),
  
  1. public static string AadInstance = ConfigurationManager.AppSettings["ida:AadInstance"];
  2. public static string Tenant = ConfigurationManager.AppSettings["ida:Tenant"];
  3. public static string ClientId = ConfigurationManager.AppSettings["ida:ClientId"];
  4. public static string SignUpSignInPolicy =
  5. ConfigurationManager.AppSettings["ida:SignUpSignInPolicyId"];
  6. public static string DefaultPolicy = SignUpSignInPolicy;
  7. // This code configures Web API. The Startup class is specified as a type
  8. // parameter in the WebApp.Start method.
  9. public static void ConfigureApp(IAppBuilder appBuilder)
  10. {
  11. // Configure Web API for self-host.
  12. HttpConfiguration config = new HttpConfiguration();
  15. config.Routes.MapHttpRoute(
  16. name: "DefaultApi",
  17. routeTemplate: "api/{controller}/{id}",
  18. defaults: new { id = RouteParameter.Optional }
  19. );
  21. TokenValidationParameters tvps = new TokenValidationParameters
  22. {
  23. // Accept only those tokens where the audience of the token is equal to the client ID of this app
  24. ValidAudience = ClientId,
  25. AuthenticationType = DefaultPolicy,
  27. };
  29. appBuilder.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
  30. {
  31. AuthenticationMode = AuthenticationMode.Active,
  32. // This SecurityTokenProvider fetches the Azure AD B2C metadata & signing keys from the OpenIDConnect metadata endpoint
  33. AccessTokenFormat = new JwtFormat(tvps, new OpenIdConnectCachingSecurityTokenProvider(String.Format(AadInstance, Tenant, DefaultPolicy))),
  34. });
  36. appBuilder.UseWebApi(config);
  37. config.EnableSwagger(c => c.SingleApiVersion("v1", "valueService")).EnableSwaggerUi();
  39. }

• Go to App.config and add following lines keys,
  
  1. <appSettings>
  2. <add key="ida:AadInstance" value="https://login.microsoftonline.com/{0}/v2.0/.well-known/openid-configuration?p={1}" />
  3. <add key="ida:Tenant" value="<B2C directory name>.onmicrosoft.com"></add>
  4. <add key="ida:ClientId" value="<server app id>" />
  5. <add key="ida:SignUpSignInPolicyId" value="<Sign in policy name>" />
  6. <!-- The following settings is used for requesting access tokens -->
  7. <add key="api:ReadScope" value="read" />
  8. <add key="api:WriteScope" value="write" />
  9. <add key="ida:Audience" value="<App URI in server app of B2C >" />
  10. </appSettings>

• Go to solution explorer and add this file under App_Start folder,
  
  
  

• Changes in API controller, Go to cs and add Authorize attribute on class,
  
  1. [Authorize]
  2. [ServiceRequestActionFilter]
  3. public class ValuesController : ApiController
  4. {

• It should authorize all the request coming from WPF client.

References

• https://matt.kotsenas.com/posts/https-in-service-fabric-web-api
• https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-cluster-security
• https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-service-manifest-resources
• https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates-for-clients