Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Support for role-based access control with Microsoft Entra ID to data plane operations #479

Closed
PlagueHO opened this issue May 5, 2024 · 0 comments · Fixed by #483
Closed
Assignees
Labels
enhancement The issue is an enhancement request. high priority The issue or PR should be resolved first. It is of less priority than the label 'Blocking Release'. in progress The issue is being actively worked on by someone.

Comments

@PlagueHO
Copy link
Owner

PlagueHO commented May 5, 2024

Issue

It is possible to now use Entra ID OAuth2 tokens for data plane operations on Cosmos DB. This increases the security of solutions by removing the need to use either resource tokens or tokens using the master key. See https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac#authenticate-requests-on-the-rest-api

Simple way of implementing this:
Implementing this would require some changes to the module. This simplest way:
Add support for setting an OAuth2 token (rather than a Resource token) when adding tokens to the context via New-CosmosDbContextToken - maybe a new parameter set required for the function to allow "Resource" or "EntraID".
Update Get-CosmosDbAuthorizationHeadersFromContext to return the EntraID token in appropriate headers as per Configure role-based access control with Microsoft Entra ID - Azure Cosmos Db | Microsoft Learn - if an EntraID token is available in the Context.

Automated testing will require the most work.

@PlagueHO PlagueHO added enhancement The issue is an enhancement request. help wanted The issue is up for grabs for anyone in the community. high priority The issue or PR should be resolved first. It is of less priority than the label 'Blocking Release'. labels May 5, 2024
@PlagueHO PlagueHO self-assigned this May 16, 2024
@PlagueHO PlagueHO added in progress The issue is being actively worked on by someone. and removed help wanted The issue is up for grabs for anyone in the community. labels May 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement The issue is an enhancement request. high priority The issue or PR should be resolved first. It is of less priority than the label 'Blocking Release'. in progress The issue is being actively worked on by someone.
Projects
None yet
1 participant