[App Service] Fix auth v2 migration, SP detection, and new auth parameters#33075
Open
[App Service] Fix auth v2 migration, SP detection, and new auth parameters#33075
Conversation
…uth`: v2 auth migration improvements - `az webapp auth show` now auto-detects v2 auth and returns v2 settings when configured, falling back to v1 (Azure#26603) - `az webapp auth update` routes to v2 API (authsettingsV2) when the app has v2 auth configured, with proper mapping of all params to v2 model structure (Azure#25662, Azure#26603) - v2-only parameters like `--require-https` automatically force the v2 code path for new auth setups (Azure#25662) - Added `--require-https` parameter for v2 HTTP settings (Azure#30322) - `--token-store`, `--aad-allowed-token-audiences`, and identity provider params now correctly map to v2 nested model structure (Azure#30322) - Updated help text to reflect v2 support - Added 15 unit tests covering v2 detection, show/update routing, AAD, Facebook, action mapping, and v1 fallback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
seligj95
requested review from
NoriZC,
teresaritorto and
yanzhudd
as code owners
❌AzureCLI-FullTest
|
|
Hi @seligj95, |
|
| rule | cmd_name | rule_message | suggest_message |
|---|---|---|---|
| webapp auth update | cmd webapp auth update added parameter require_https |
Collaborator
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
microsoft-github-policy-service
bot
requested review from
jiasli,
jsntcy,
wangzelin007,
yonzhan and
zhoxing-ms
microsoft-github-policy-service
bot
added
Web Apps
…nfig When az webapp deployment source config --github-action is called with Service Principal authentication, the Azure API returns 404 trying to look up a publishing user. This change adds client-side detection to provide a clear error message directing users to az webapp deployment github-actions add, which supports SP auth. Fixes Azure#30021 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
seligj95
changed the title
az webapp auth: v2 auth migration improvements
Contributor
There was a problem hiding this comment.
Pull request overview
Improves az webapp auth to better support auth v2 during migration by auto-detecting v2 configurations, routing updates to the correct API, and adding a new v2 parameter for HTTPS enforcement.
Changes:
- Added v2 detection and v2 update path, with v2-only params (e.g.,
--require-https) forcing v2 behavior for new setups. - Extended parameter surface and help text to reflect v1/v2 behavior and new v2 options.
- Added unit tests covering v2 detection, show/update routing, and
--require-httpsbehavior.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| src/azure-cli/azure/cli/command_modules/appservice/custom.py | Adds v2 auth detection + v2 update mapping; adds SP-auth guard for GitHub Actions source control config. |
| src/azure-cli/azure/cli/command_modules/appservice/_params.py | Adds --require-https parameter for auth v2. |
| src/azure-cli/azure/cli/command_modules/appservice/_help.py | Updates command help to describe v1/v2 autodetection and adds --require-https example. |
| src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands_thru_mock.py | Adds mocked unit tests for v2 auth routing/mapping and SP-auth + GitHub Actions validation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
...zure-cli/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands_thru_mock.py
Outdated
Show resolved
Hide resolved
…t handling - Fix 1: Broaden _is_auth_v2_app to detect Facebook, Google, Twitter, Microsoft identity providers and v2-specific sections (http_settings, login, global_validation) - Fix 2: In get_auth_settings, catch only HttpResponseError instead of bare except, re-raise non-404 errors - Fix 3: Same narrow exception handling in update_auth_settings v2 probe - Fix 4: Wrap _is_service_principal_auth in try/except to handle profile lookup failures gracefully (return False) - Fix 5: Store secret values in app settings and reference by name in client_secret_setting_name fields (AAD, Facebook, Google, Twitter, Microsoft Account) - Fix 6: Add proper assertions on sent_settings in test_update_auth_settings_uses_v2_when_configured - Fix flake8 continuation line indentation (E127/E128) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
seligj95
changed the title
When auth show/update returns a v2 (SiteAuthSettingsV2) response, flatten key v2 fields into top-level v1 aliases so that existing scripts and live tests that reference flat field names (enabled, defaultProvider, tokenStoreEnabled, clientId, etc.) continue to work without modification. - Add _add_v1_compat_fields() helper that converts a v2 model to a dict containing both the nested v2 structure and flat v1 keys. - Apply the compat shim in get_auth_settings (auth show) and update_auth_settings (auth update) when the v2 path is taken. - Pass through original secret values (clientSecret, facebookAppSecret) as v1 compat overrides so they are not replaced by the v2 setting-name references. - Update mock tests to verify both v2 nested keys and v1 compat fields; add dedicated unit tests for _add_v1_compat_fields(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Extract _update_auth_settings_v2 (61 branches) into 9 focused helper functions (_configure_auth_v2_platform, _configure_auth_v2_global_validation, _configure_auth_v2_login, _configure_auth_v2_http_settings, _configure_auth_v2_aad, _configure_auth_v2_facebook, _configure_auth_v2_google, _configure_auth_v2_twitter, _configure_auth_v2_microsoft_account), reducing the main function to 3 branches. Consolidate _is_auth_v2_app returns from 11 to 4 using any() patterns. No behavior change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Changes
Issue #26603 —
az webapp auth updateuses stale API version:az webapp auth shownow auto-detects v2 auth configuration and returns v2 settings viaget_auth_settings_v2, falling back to v1 when not configuredaz webapp auth updatedetects v2 auth and routes updates throughupdate_auth_settings_v2with proper nested model mappingIssue #25662 — New webapps default to auth v1 instead of v2:
--require-https) automatically force the v2 code path for new auth setupsIssue #30322 — Missing v2 parameters:
--require-httpsparameter (controlshttp_settings.require_httpsin v2)--token-storenow maps tologin.token_store.enabledin v2--aad-allowed-token-audiencesmaps toidentity_providers.azure_active_directory.validation.allowed_audiencesTesting
test_webapp_commands_thru_mock.pycovering:_is_auth_v2_app)--require-httpsforcing v2 pathazdev style appservicepassesFiles changed
custom.py— Added_get_auth_settings_v2,_is_auth_v2_app,_update_auth_settings_v2; modifiedget_auth_settings,update_auth_settings_params.py— Added--require-httpsparameter_help.py— Updated help text for v2 supporttest_webapp_commands_thru_mock.py— AddedTestWebappAuthV2Mockedtest classFixes #26603
Fixes #25662
Fixes #30322