Microsoft.App (stable:2024-03-01)

2025/02/27 • 3 updated methods

ContainerAppsAuthConfigs_ListByContainerApp (updated)
Description :  Get the Container App AuthConfigs in a given resource group.
Reference :  Link ¶

⚶ Changes

{
  "#id": "ContainerAppsAuthConfigs_ListByContainerApp",
  "$responses": {
    "200": {
      "$properties": {
        "value": {
          "$properties": {
            "properties": [
              {
                "identityProviders": [
                  {
                    "azureActiveDirectory": [
                      {
                        "registration": [
                          {
                            "#name": "openIdIssuer",
                            "Description": {
                              "new": "The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.\nWhen using Azure Active Directory, this value is the URI of the directory tenant, e.g. `https://login.microsoftonline.com/v2.0/{tenant-guid}/`.\nThis URI is a case-sensitive identifier for the token issuer.\nMore information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html",
                              "old": "The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.\nWhen using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/.\nThis URI is a case-sensitive identifier for the token issuer.\nMore information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html"
                            }
                          }
                        ]
                      }
                    ]
                  }
                ]
              }
            ]
          }
        }
      }
    }
  }
}

⚼ Request

GET:  /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.App/containerApps/{containerAppName}/authConfigs
{
subscriptionId:
{
Description: The ID of the target subscription. ,
Required: True ,
}
string ,
resourceGroupName:
{
Description: The name of the resource group. The name is case insensitive. ,
Required: True ,
}
string ,
containerAppName:
{
Description: Name of the Container App. ,
Required: True ,
}
string ,
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
value:
{
Description: Collection of resources. ,
Required: True ,
}
[
{
properties:
{
Description: AuthConfig resource specific properties ,
Required: False ,
}
{
platform:
{
Description: The configuration settings of the platform of ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
enabled:
{
Description: true if the Authentication / Authorization feature is enabled for the current app; otherwise, false. ,
Required: False ,
}
boolean ,
runtimeVersion:
{
Description: The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module. ,
Required: False ,
}
string ,
}
,
globalValidation:
{
Description: The configuration settings that determines the validation flow of users using Service Authentication/Authorization. ,
Required: False ,
}
{
unauthenticatedClientAction:
{
Description: The action to take when an unauthenticated client attempts to access the app. ,
Enum:
{
RedirectToLoginPage: No description available. ,
AllowAnonymous: No description available. ,
Return401: No description available. ,
Return403: No description available. ,
}
,
Required: False ,
}
enum ,
redirectToProvider:
{
Description: The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage". ,
Required: False ,
}
string ,
excludedPaths:
{
Description: The paths for which unauthenticated flow would not be redirected to the login page. ,
Required: False ,
}
[
string ,
]
,
}
,
identityProviders:
{
Description: The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
azureActiveDirectory:
{
Description: The configuration settings of the Azure Active directory provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Azure Active Directory provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Azure Active Directory app registration. ,
Required: False ,
}
{
openIdIssuer:
{
Description: The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. `https://login.microsoftonline.com/v2.0/{tenant-guid}/`. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html ,
Required: False ,
}
string ,
clientId:
{
Description: The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret of the relying party application. ,
Required: False ,
}
string ,
clientSecretCertificateThumbprint:
{
Description: An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional. ,
Required: False ,
}
string ,
clientSecretCertificateSubjectAlternativeName:
{
Description: An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint. It is also optional. ,
Required: False ,
}
string ,
clientSecretCertificateIssuer:
{
Description: An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint. It is also optional. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the Azure Active Directory login flow. ,
Required: False ,
}
{
loginParameters:
{
Description: Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value". ,
Required: False ,
}
[
string ,
]
,
disableWWWAuthenticate:
{
Description: true if the www-authenticate provider should be omitted from the request; otherwise, false. ,
Required: False ,
}
boolean ,
}
,
validation:
{
Description: The configuration settings of the Azure Active Directory token validation flow. ,
Required: False ,
}
{
jwtClaimChecks:
{
Description: The configuration settings of the checks that should be made while validating the JWT Claims. ,
Required: False ,
}
{
allowedGroups:
{
Description: The list of the allowed groups. ,
Required: False ,
}
[
string ,
]
,
allowedClientApplications:
{
Description: The list of the allowed client applications. ,
Required: False ,
}
[
string ,
]
,
}
,
allowedAudiences:
{
Description: The list of audiences that can make successful authentication/authorization requests. ,
Required: False ,
}
[
string ,
]
,
defaultAuthorizationPolicy:
{
Description: The configuration settings of the default authorization policy. ,
Required: False ,
}
{
allowedPrincipals:
{
Description: The configuration settings of the Azure Active Directory allowed principals. ,
Required: False ,
}
{
groups:
{
Description: The list of the allowed groups. ,
Required: False ,
}
[
string ,
]
,
identities:
{
Description: The list of the allowed identities. ,
Required: False ,
}
[
string ,
]
,
}
,
allowedApplications:
{
Description: The configuration settings of the Azure Active Directory allowed applications. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
isAutoProvisioned:
{
Description: Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property. ,
Required: False ,
}
boolean ,
}
,
facebook:
{
Description: The configuration settings of the Facebook provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Facebook provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Facebook provider. ,
Required: False ,
}
{
appId:
{
Description: The App ID of the app used for login. ,
Required: False ,
}
string ,
appSecretSettingName:
{
Description: The app setting name that contains the app secret. ,
Required: False ,
}
string ,
}
,
graphApiVersion:
{
Description: The version of the Facebook api to be used while logging in. ,
Required: False ,
}
string ,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
gitHub:
{
Description: The configuration settings of the GitHub provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the GitHub provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the GitHub provider. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
google:
{
Description: The configuration settings of the Google provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Google provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Google provider. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
validation:
{
Description: The configuration settings of the Azure Active Directory token validation flow. ,
Required: False ,
}
{
allowedAudiences:
{
Description: The configuration settings of the allowed list of audiences from which to validate the JWT token. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
twitter:
{
Description: The configuration settings of the Twitter provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Twitter provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Twitter provider. ,
Required: False ,
}
{
consumerKey:
{
Description: The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in ,
Required: False ,
}
string ,
consumerSecretSettingName:
{
Description: The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in. ,
Required: False ,
}
string ,
}
,
}
,
apple:
{
Description: The configuration settings of the Apple provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Apple provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Apple registration. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
azureStaticWebApps:
{
Description: The configuration settings of the Azure Static Web Apps provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Azure Static Web Apps provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Azure Static Web Apps registration. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
}
,
}
,
customOpenIdConnectProviders:
{
Description: The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider. ,
Required: False ,
}
object ,
}
,
login:
{
Description: The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
routes:
{
Description: The routes that specify the endpoints used for login and logout requests. ,
Required: False ,
}
{
logoutEndpoint:
{
Description: The endpoint at which a logout request should be made. ,
Required: False ,
}
string ,
}
,
tokenStore:
{
Description: The configuration settings of the token store. ,
Required: False ,
}
{
enabled:
{
Description: true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false. ,
Required: False ,
}
boolean ,
tokenRefreshExtensionHours:
{
Description: The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours. ,
Format: double ,
Required: False ,
}
number ,
azureBlobStorage:
{
Description: The configuration settings of the storage of the tokens if blob storage is used. ,
Required: False ,
}
{
sasUrlSettingName:
{
Description: The name of the app secrets containing the SAS URL of the blob storage containing the tokens. ,
Required: True ,
}
string ,
}
,
}
,
preserveUrlFragmentsForLogins:
{
Description: true if the fragments from the request are preserved after the login request is made; otherwise, false. ,
Required: False ,
}
boolean ,
allowedExternalRedirectUrls:
{
Description: External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed. ,
Required: False ,
}
[
string ,
]
,
cookieExpiration:
{
Description: The configuration settings of the session cookie's expiration. ,
Required: False ,
}
{
convention:
{
Description: The convention used when determining the session cookie's expiration. ,
Enum:
{
FixedTime: No description available. ,
IdentityProviderDerived: No description available. ,
}
,
Required: False ,
}
enum ,
timeToExpiration:
{
Description: The time after the request is made when the session cookie should expire. ,
Required: False ,
}
string ,
}
,
nonce:
{
Description: The configuration settings of the nonce used in the login flow. ,
Required: False ,
}
{
validateNonce:
{
Description: false if the nonce should not be validated while completing the login flow; otherwise, true. ,
Required: False ,
}
boolean ,
nonceExpirationInterval:
{
Description: The time after the request is made when the nonce should expire. ,
Required: False ,
}
string ,
}
,
}
,
httpSettings:
{
Description: The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
requireHttps:
{
Description: false if the authentication/authorization responses not having the HTTPS scheme are permissible; otherwise, true. ,
Required: False ,
}
boolean ,
routes:
{
Description: The configuration settings of the paths HTTP requests. ,
Required: False ,
}
{
apiPrefix:
{
Description: The prefix that should precede all the authentication/authorization paths. ,
Required: False ,
}
string ,
}
,
forwardProxy:
{
Description: The configuration settings of a forward proxy used to make the requests. ,
Required: False ,
}
{
convention:
{
Description: The convention used to determine the url of the request made. ,
Enum:
{
NoProxy: No description available. ,
Standard: No description available. ,
Custom: No description available. ,
}
,
Required: False ,
}
enum ,
customHostHeaderName:
{
Description: The name of the header containing the host of the request. ,
Required: False ,
}
string ,
customProtoHeaderName:
{
Description: The name of the header containing the scheme of the request. ,
Required: False ,
}
string ,
}
,
}
,
encryptionSettings:
{
Description: The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
containerAppAuthEncryptionSecretName:
{
Description: The secret name which is referenced for EncryptionKey. ,
Required: False ,
}
string ,
containerAppAuthSigningSecretName:
{
Description: The secret name which is referenced for SigningKey. ,
Required: False ,
}
string ,
}
,
}
,
}
,
]
,
nextLink:
{
Description: Link to next page of resources. ,
Required: False ,
}
string ,
}

⚐ Response (default)

{
error:
{
Description: Error model. ,
Required: False ,
}
{
code:
{
Description: Standardized string to programmatically identify the error. ,
Required: False ,
}
string ,
message:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
target:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
details:
{
Description: Details or the error ,
Required: False ,
}
[
{
code:
{
Description: Standardized string to programmatically identify the error. ,
Required: False ,
}
string ,
message:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
target:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
}
,
]
,
innererror:
{
Description: More information to debug error. ,
Required: False ,
}
string ,
}
,
}
ContainerAppsAuthConfigs_Get (updated)
Description :  Get a AuthConfig of a Container App.
Reference :  Link ¶

⚶ Changes

{
  "#id": "ContainerAppsAuthConfigs_Get",
  "$responses": {
    "200": {
      "$properties": {
        "properties": [
          {
            "identityProviders": [
              {
                "azureActiveDirectory": [
                  {
                    "registration": [
                      {
                        "#name": "openIdIssuer",
                        "Description": {
                          "new": "The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.\nWhen using Azure Active Directory, this value is the URI of the directory tenant, e.g. `https://login.microsoftonline.com/v2.0/{tenant-guid}/`.\nThis URI is a case-sensitive identifier for the token issuer.\nMore information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html",
                          "old": "The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.\nWhen using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/.\nThis URI is a case-sensitive identifier for the token issuer.\nMore information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html"
                        }
                      }
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    }
  }
}

⚼ Request

GET:  /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.App/containerApps/{containerAppName}/authConfigs/{authConfigName}
{
subscriptionId:
{
Description: The ID of the target subscription. ,
Required: True ,
}
string ,
resourceGroupName:
{
Description: The name of the resource group. The name is case insensitive. ,
Required: True ,
}
string ,
containerAppName:
{
Description: Name of the Container App. ,
Required: True ,
}
string ,
authConfigName:
{
Description: Name of the Container App AuthConfig. ,
Required: True ,
}
string ,
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
properties:
{
Description: AuthConfig resource specific properties ,
Required: False ,
}
{
platform:
{
Description: The configuration settings of the platform of ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
enabled:
{
Description: true if the Authentication / Authorization feature is enabled for the current app; otherwise, false. ,
Required: False ,
}
boolean ,
runtimeVersion:
{
Description: The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module. ,
Required: False ,
}
string ,
}
,
globalValidation:
{
Description: The configuration settings that determines the validation flow of users using Service Authentication/Authorization. ,
Required: False ,
}
{
unauthenticatedClientAction:
{
Description: The action to take when an unauthenticated client attempts to access the app. ,
Enum:
{
RedirectToLoginPage: No description available. ,
AllowAnonymous: No description available. ,
Return401: No description available. ,
Return403: No description available. ,
}
,
Required: False ,
}
enum ,
redirectToProvider:
{
Description: The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage". ,
Required: False ,
}
string ,
excludedPaths:
{
Description: The paths for which unauthenticated flow would not be redirected to the login page. ,
Required: False ,
}
[
string ,
]
,
}
,
identityProviders:
{
Description: The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
azureActiveDirectory:
{
Description: The configuration settings of the Azure Active directory provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Azure Active Directory provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Azure Active Directory app registration. ,
Required: False ,
}
{
openIdIssuer:
{
Description: The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. `https://login.microsoftonline.com/v2.0/{tenant-guid}/`. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html ,
Required: False ,
}
string ,
clientId:
{
Description: The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret of the relying party application. ,
Required: False ,
}
string ,
clientSecretCertificateThumbprint:
{
Description: An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional. ,
Required: False ,
}
string ,
clientSecretCertificateSubjectAlternativeName:
{
Description: An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint. It is also optional. ,
Required: False ,
}
string ,
clientSecretCertificateIssuer:
{
Description: An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint. It is also optional. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the Azure Active Directory login flow. ,
Required: False ,
}
{
loginParameters:
{
Description: Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value". ,
Required: False ,
}
[
string ,
]
,
disableWWWAuthenticate:
{
Description: true if the www-authenticate provider should be omitted from the request; otherwise, false. ,
Required: False ,
}
boolean ,
}
,
validation:
{
Description: The configuration settings of the Azure Active Directory token validation flow. ,
Required: False ,
}
{
jwtClaimChecks:
{
Description: The configuration settings of the checks that should be made while validating the JWT Claims. ,
Required: False ,
}
{
allowedGroups:
{
Description: The list of the allowed groups. ,
Required: False ,
}
[
string ,
]
,
allowedClientApplications:
{
Description: The list of the allowed client applications. ,
Required: False ,
}
[
string ,
]
,
}
,
allowedAudiences:
{
Description: The list of audiences that can make successful authentication/authorization requests. ,
Required: False ,
}
[
string ,
]
,
defaultAuthorizationPolicy:
{
Description: The configuration settings of the default authorization policy. ,
Required: False ,
}
{
allowedPrincipals:
{
Description: The configuration settings of the Azure Active Directory allowed principals. ,
Required: False ,
}
{
groups:
{
Description: The list of the allowed groups. ,
Required: False ,
}
[
string ,
]
,
identities:
{
Description: The list of the allowed identities. ,
Required: False ,
}
[
string ,
]
,
}
,
allowedApplications:
{
Description: The configuration settings of the Azure Active Directory allowed applications. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
isAutoProvisioned:
{
Description: Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property. ,
Required: False ,
}
boolean ,
}
,
facebook:
{
Description: The configuration settings of the Facebook provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Facebook provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Facebook provider. ,
Required: False ,
}
{
appId:
{
Description: The App ID of the app used for login. ,
Required: False ,
}
string ,
appSecretSettingName:
{
Description: The app setting name that contains the app secret. ,
Required: False ,
}
string ,
}
,
graphApiVersion:
{
Description: The version of the Facebook api to be used while logging in. ,
Required: False ,
}
string ,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
gitHub:
{
Description: The configuration settings of the GitHub provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the GitHub provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the GitHub provider. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
google:
{
Description: The configuration settings of the Google provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Google provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Google provider. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
validation:
{
Description: The configuration settings of the Azure Active Directory token validation flow. ,
Required: False ,
}
{
allowedAudiences:
{
Description: The configuration settings of the allowed list of audiences from which to validate the JWT token. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
twitter:
{
Description: The configuration settings of the Twitter provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Twitter provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Twitter provider. ,
Required: False ,
}
{
consumerKey:
{
Description: The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in ,
Required: False ,
}
string ,
consumerSecretSettingName:
{
Description: The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in. ,
Required: False ,
}
string ,
}
,
}
,
apple:
{
Description: The configuration settings of the Apple provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Apple provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Apple registration. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
azureStaticWebApps:
{
Description: The configuration settings of the Azure Static Web Apps provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Azure Static Web Apps provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Azure Static Web Apps registration. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
}
,
}
,
customOpenIdConnectProviders:
{
Description: The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider. ,
Required: False ,
}
object ,
}
,
login:
{
Description: The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
routes:
{
Description: The routes that specify the endpoints used for login and logout requests. ,
Required: False ,
}
{
logoutEndpoint:
{
Description: The endpoint at which a logout request should be made. ,
Required: False ,
}
string ,
}
,
tokenStore:
{
Description: The configuration settings of the token store. ,
Required: False ,
}
{
enabled:
{
Description: true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false. ,
Required: False ,
}
boolean ,
tokenRefreshExtensionHours:
{
Description: The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours. ,
Format: double ,
Required: False ,
}
number ,
azureBlobStorage:
{
Description: The configuration settings of the storage of the tokens if blob storage is used. ,
Required: False ,
}
{
sasUrlSettingName:
{
Description: The name of the app secrets containing the SAS URL of the blob storage containing the tokens. ,
Required: True ,
}
string ,
}
,
}
,
preserveUrlFragmentsForLogins:
{
Description: true if the fragments from the request are preserved after the login request is made; otherwise, false. ,
Required: False ,
}
boolean ,
allowedExternalRedirectUrls:
{
Description: External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed. ,
Required: False ,
}
[
string ,
]
,
cookieExpiration:
{
Description: The configuration settings of the session cookie's expiration. ,
Required: False ,
}
{
convention:
{
Description: The convention used when determining the session cookie's expiration. ,
Enum:
{
FixedTime: No description available. ,
IdentityProviderDerived: No description available. ,
}
,
Required: False ,
}
enum ,
timeToExpiration:
{
Description: The time after the request is made when the session cookie should expire. ,
Required: False ,
}
string ,
}
,
nonce:
{
Description: The configuration settings of the nonce used in the login flow. ,
Required: False ,
}
{
validateNonce:
{
Description: false if the nonce should not be validated while completing the login flow; otherwise, true. ,
Required: False ,
}
boolean ,
nonceExpirationInterval:
{
Description: The time after the request is made when the nonce should expire. ,
Required: False ,
}
string ,
}
,
}
,
httpSettings:
{
Description: The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
requireHttps:
{
Description: false if the authentication/authorization responses not having the HTTPS scheme are permissible; otherwise, true. ,
Required: False ,
}
boolean ,
routes:
{
Description: The configuration settings of the paths HTTP requests. ,
Required: False ,
}
{
apiPrefix:
{
Description: The prefix that should precede all the authentication/authorization paths. ,
Required: False ,
}
string ,
}
,
forwardProxy:
{
Description: The configuration settings of a forward proxy used to make the requests. ,
Required: False ,
}
{
convention:
{
Description: The convention used to determine the url of the request made. ,
Enum:
{
NoProxy: No description available. ,
Standard: No description available. ,
Custom: No description available. ,
}
,
Required: False ,
}
enum ,
customHostHeaderName:
{
Description: The name of the header containing the host of the request. ,
Required: False ,
}
string ,
customProtoHeaderName:
{
Description: The name of the header containing the scheme of the request. ,
Required: False ,
}
string ,
}
,
}
,
encryptionSettings:
{
Description: The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
containerAppAuthEncryptionSecretName:
{
Description: The secret name which is referenced for EncryptionKey. ,
Required: False ,
}
string ,
containerAppAuthSigningSecretName:
{
Description: The secret name which is referenced for SigningKey. ,
Required: False ,
}
string ,
}
,
}
,
}

⚐ Response (default)

{
error:
{
Description: Error model. ,
Required: False ,
}
{
code:
{
Description: Standardized string to programmatically identify the error. ,
Required: False ,
}
string ,
message:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
target:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
details:
{
Description: Details or the error ,
Required: False ,
}
[
{
code:
{
Description: Standardized string to programmatically identify the error. ,
Required: False ,
}
string ,
message:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
target:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
}
,
]
,
innererror:
{
Description: More information to debug error. ,
Required: False ,
}
string ,
}
,
}
ContainerAppsAuthConfigs_CreateOrUpdate (updated)
Description :  Create or update the AuthConfig for a Container App.
Reference :  Link ¶

⚶ Changes

{
  "#id": "ContainerAppsAuthConfigs_CreateOrUpdate",
  "$parameters": {
    "authConfigEnvelope": {
      "$properties": {
        "properties": [
          {
            "identityProviders": [
              {
                "azureActiveDirectory": [
                  {
                    "registration": [
                      {
                        "#name": "openIdIssuer",
                        "Description": {
                          "new": "The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.\nWhen using Azure Active Directory, this value is the URI of the directory tenant, e.g. `https://login.microsoftonline.com/v2.0/{tenant-guid}/`.\nThis URI is a case-sensitive identifier for the token issuer.\nMore information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html",
                          "old": "The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.\nWhen using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/.\nThis URI is a case-sensitive identifier for the token issuer.\nMore information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html"
                        }
                      }
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    }
  },
  "$responses": {
    "200": {
      "$properties": {
        "properties": [
          {
            "identityProviders": [
              {
                "azureActiveDirectory": [
                  {
                    "registration": [
                      {
                        "#name": "openIdIssuer",
                        "Description": {
                          "new": "The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.\nWhen using Azure Active Directory, this value is the URI of the directory tenant, e.g. `https://login.microsoftonline.com/v2.0/{tenant-guid}/`.\nThis URI is a case-sensitive identifier for the token issuer.\nMore information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html",
                          "old": "The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.\nWhen using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/.\nThis URI is a case-sensitive identifier for the token issuer.\nMore information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html"
                        }
                      }
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    }
  }
}

⚼ Request

PUT:  /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.App/containerApps/{containerAppName}/authConfigs/{authConfigName}
{
subscriptionId:
{
Description: The ID of the target subscription. ,
Required: True ,
}
string ,
resourceGroupName:
{
Description: The name of the resource group. The name is case insensitive. ,
Required: True ,
}
string ,
containerAppName:
{
Description: Name of the Container App. ,
Required: True ,
}
string ,
authConfigName:
{
Description: Name of the Container App AuthConfig. ,
Required: True ,
}
string ,
authConfigEnvelope:
{
Description: Properties used to create a Container App AuthConfig ,
Required: True ,
}
{
properties:
{
Description: AuthConfig resource specific properties ,
Required: False ,
}
{
platform:
{
Description: The configuration settings of the platform of ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
enabled:
{
Description: true if the Authentication / Authorization feature is enabled for the current app; otherwise, false. ,
Required: False ,
}
boolean ,
runtimeVersion:
{
Description: The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module. ,
Required: False ,
}
string ,
}
,
globalValidation:
{
Description: The configuration settings that determines the validation flow of users using Service Authentication/Authorization. ,
Required: False ,
}
{
unauthenticatedClientAction:
{
Description: The action to take when an unauthenticated client attempts to access the app. ,
Enum:
{
RedirectToLoginPage: No description available. ,
AllowAnonymous: No description available. ,
Return401: No description available. ,
Return403: No description available. ,
}
,
Required: False ,
}
enum ,
redirectToProvider:
{
Description: The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage". ,
Required: False ,
}
string ,
excludedPaths:
{
Description: The paths for which unauthenticated flow would not be redirected to the login page. ,
Required: False ,
}
[
string ,
]
,
}
,
identityProviders:
{
Description: The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
azureActiveDirectory:
{
Description: The configuration settings of the Azure Active directory provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Azure Active Directory provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Azure Active Directory app registration. ,
Required: False ,
}
{
openIdIssuer:
{
Description: The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. `https://login.microsoftonline.com/v2.0/{tenant-guid}/`. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html ,
Required: False ,
}
string ,
clientId:
{
Description: The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret of the relying party application. ,
Required: False ,
}
string ,
clientSecretCertificateThumbprint:
{
Description: An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional. ,
Required: False ,
}
string ,
clientSecretCertificateSubjectAlternativeName:
{
Description: An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint. It is also optional. ,
Required: False ,
}
string ,
clientSecretCertificateIssuer:
{
Description: An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint. It is also optional. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the Azure Active Directory login flow. ,
Required: False ,
}
{
loginParameters:
{
Description: Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value". ,
Required: False ,
}
[
string ,
]
,
disableWWWAuthenticate:
{
Description: true if the www-authenticate provider should be omitted from the request; otherwise, false. ,
Required: False ,
}
boolean ,
}
,
validation:
{
Description: The configuration settings of the Azure Active Directory token validation flow. ,
Required: False ,
}
{
jwtClaimChecks:
{
Description: The configuration settings of the checks that should be made while validating the JWT Claims. ,
Required: False ,
}
{
allowedGroups:
{
Description: The list of the allowed groups. ,
Required: False ,
}
[
string ,
]
,
allowedClientApplications:
{
Description: The list of the allowed client applications. ,
Required: False ,
}
[
string ,
]
,
}
,
allowedAudiences:
{
Description: The list of audiences that can make successful authentication/authorization requests. ,
Required: False ,
}
[
string ,
]
,
defaultAuthorizationPolicy:
{
Description: The configuration settings of the default authorization policy. ,
Required: False ,
}
{
allowedPrincipals:
{
Description: The configuration settings of the Azure Active Directory allowed principals. ,
Required: False ,
}
{
groups:
{
Description: The list of the allowed groups. ,
Required: False ,
}
[
string ,
]
,
identities:
{
Description: The list of the allowed identities. ,
Required: False ,
}
[
string ,
]
,
}
,
allowedApplications:
{
Description: The configuration settings of the Azure Active Directory allowed applications. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
isAutoProvisioned:
{
Description: Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property. ,
Required: False ,
}
boolean ,
}
,
facebook:
{
Description: The configuration settings of the Facebook provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Facebook provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Facebook provider. ,
Required: False ,
}
{
appId:
{
Description: The App ID of the app used for login. ,
Required: False ,
}
string ,
appSecretSettingName:
{
Description: The app setting name that contains the app secret. ,
Required: False ,
}
string ,
}
,
graphApiVersion:
{
Description: The version of the Facebook api to be used while logging in. ,
Required: False ,
}
string ,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
gitHub:
{
Description: The configuration settings of the GitHub provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the GitHub provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the GitHub provider. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
google:
{
Description: The configuration settings of the Google provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Google provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Google provider. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
validation:
{
Description: The configuration settings of the Azure Active Directory token validation flow. ,
Required: False ,
}
{
allowedAudiences:
{
Description: The configuration settings of the allowed list of audiences from which to validate the JWT token. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
twitter:
{
Description: The configuration settings of the Twitter provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Twitter provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Twitter provider. ,
Required: False ,
}
{
consumerKey:
{
Description: The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in ,
Required: False ,
}
string ,
consumerSecretSettingName:
{
Description: The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in. ,
Required: False ,
}
string ,
}
,
}
,
apple:
{
Description: The configuration settings of the Apple provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Apple provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Apple registration. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
azureStaticWebApps:
{
Description: The configuration settings of the Azure Static Web Apps provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Azure Static Web Apps provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Azure Static Web Apps registration. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
}
,
}
,
customOpenIdConnectProviders:
{
Description: The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider. ,
Required: False ,
}
object ,
}
,
login:
{
Description: The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
routes:
{
Description: The routes that specify the endpoints used for login and logout requests. ,
Required: False ,
}
{
logoutEndpoint:
{
Description: The endpoint at which a logout request should be made. ,
Required: False ,
}
string ,
}
,
tokenStore:
{
Description: The configuration settings of the token store. ,
Required: False ,
}
{
enabled:
{
Description: true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false. ,
Required: False ,
}
boolean ,
tokenRefreshExtensionHours:
{
Description: The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours. ,
Format: double ,
Required: False ,
}
number ,
azureBlobStorage:
{
Description: The configuration settings of the storage of the tokens if blob storage is used. ,
Required: False ,
}
{
sasUrlSettingName:
{
Description: The name of the app secrets containing the SAS URL of the blob storage containing the tokens. ,
Required: True ,
}
string ,
}
,
}
,
preserveUrlFragmentsForLogins:
{
Description: true if the fragments from the request are preserved after the login request is made; otherwise, false. ,
Required: False ,
}
boolean ,
allowedExternalRedirectUrls:
{
Description: External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed. ,
Required: False ,
}
[
string ,
]
,
cookieExpiration:
{
Description: The configuration settings of the session cookie's expiration. ,
Required: False ,
}
{
convention:
{
Description: The convention used when determining the session cookie's expiration. ,
Enum:
{
FixedTime: No description available. ,
IdentityProviderDerived: No description available. ,
}
,
Required: False ,
}
enum ,
timeToExpiration:
{
Description: The time after the request is made when the session cookie should expire. ,
Required: False ,
}
string ,
}
,
nonce:
{
Description: The configuration settings of the nonce used in the login flow. ,
Required: False ,
}
{
validateNonce:
{
Description: false if the nonce should not be validated while completing the login flow; otherwise, true. ,
Required: False ,
}
boolean ,
nonceExpirationInterval:
{
Description: The time after the request is made when the nonce should expire. ,
Required: False ,
}
string ,
}
,
}
,
httpSettings:
{
Description: The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
requireHttps:
{
Description: false if the authentication/authorization responses not having the HTTPS scheme are permissible; otherwise, true. ,
Required: False ,
}
boolean ,
routes:
{
Description: The configuration settings of the paths HTTP requests. ,
Required: False ,
}
{
apiPrefix:
{
Description: The prefix that should precede all the authentication/authorization paths. ,
Required: False ,
}
string ,
}
,
forwardProxy:
{
Description: The configuration settings of a forward proxy used to make the requests. ,
Required: False ,
}
{
convention:
{
Description: The convention used to determine the url of the request made. ,
Enum:
{
NoProxy: No description available. ,
Standard: No description available. ,
Custom: No description available. ,
}
,
Required: False ,
}
enum ,
customHostHeaderName:
{
Description: The name of the header containing the host of the request. ,
Required: False ,
}
string ,
customProtoHeaderName:
{
Description: The name of the header containing the scheme of the request. ,
Required: False ,
}
string ,
}
,
}
,
encryptionSettings:
{
Description: The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
containerAppAuthEncryptionSecretName:
{
Description: The secret name which is referenced for EncryptionKey. ,
Required: False ,
}
string ,
containerAppAuthSigningSecretName:
{
Description: The secret name which is referenced for SigningKey. ,
Required: False ,
}
string ,
}
,
}
,
}
,
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
properties:
{
Description: AuthConfig resource specific properties ,
Required: False ,
}
{
platform:
{
Description: The configuration settings of the platform of ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
enabled:
{
Description: true if the Authentication / Authorization feature is enabled for the current app; otherwise, false. ,
Required: False ,
}
boolean ,
runtimeVersion:
{
Description: The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module. ,
Required: False ,
}
string ,
}
,
globalValidation:
{
Description: The configuration settings that determines the validation flow of users using Service Authentication/Authorization. ,
Required: False ,
}
{
unauthenticatedClientAction:
{
Description: The action to take when an unauthenticated client attempts to access the app. ,
Enum:
{
RedirectToLoginPage: No description available. ,
AllowAnonymous: No description available. ,
Return401: No description available. ,
Return403: No description available. ,
}
,
Required: False ,
}
enum ,
redirectToProvider:
{
Description: The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage". ,
Required: False ,
}
string ,
excludedPaths:
{
Description: The paths for which unauthenticated flow would not be redirected to the login page. ,
Required: False ,
}
[
string ,
]
,
}
,
identityProviders:
{
Description: The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
azureActiveDirectory:
{
Description: The configuration settings of the Azure Active directory provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Azure Active Directory provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Azure Active Directory app registration. ,
Required: False ,
}
{
openIdIssuer:
{
Description: The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. `https://login.microsoftonline.com/v2.0/{tenant-guid}/`. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html ,
Required: False ,
}
string ,
clientId:
{
Description: The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret of the relying party application. ,
Required: False ,
}
string ,
clientSecretCertificateThumbprint:
{
Description: An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional. ,
Required: False ,
}
string ,
clientSecretCertificateSubjectAlternativeName:
{
Description: An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint. It is also optional. ,
Required: False ,
}
string ,
clientSecretCertificateIssuer:
{
Description: An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint. It is also optional. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the Azure Active Directory login flow. ,
Required: False ,
}
{
loginParameters:
{
Description: Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value". ,
Required: False ,
}
[
string ,
]
,
disableWWWAuthenticate:
{
Description: true if the www-authenticate provider should be omitted from the request; otherwise, false. ,
Required: False ,
}
boolean ,
}
,
validation:
{
Description: The configuration settings of the Azure Active Directory token validation flow. ,
Required: False ,
}
{
jwtClaimChecks:
{
Description: The configuration settings of the checks that should be made while validating the JWT Claims. ,
Required: False ,
}
{
allowedGroups:
{
Description: The list of the allowed groups. ,
Required: False ,
}
[
string ,
]
,
allowedClientApplications:
{
Description: The list of the allowed client applications. ,
Required: False ,
}
[
string ,
]
,
}
,
allowedAudiences:
{
Description: The list of audiences that can make successful authentication/authorization requests. ,
Required: False ,
}
[
string ,
]
,
defaultAuthorizationPolicy:
{
Description: The configuration settings of the default authorization policy. ,
Required: False ,
}
{
allowedPrincipals:
{
Description: The configuration settings of the Azure Active Directory allowed principals. ,
Required: False ,
}
{
groups:
{
Description: The list of the allowed groups. ,
Required: False ,
}
[
string ,
]
,
identities:
{
Description: The list of the allowed identities. ,
Required: False ,
}
[
string ,
]
,
}
,
allowedApplications:
{
Description: The configuration settings of the Azure Active Directory allowed applications. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
isAutoProvisioned:
{
Description: Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property. ,
Required: False ,
}
boolean ,
}
,
facebook:
{
Description: The configuration settings of the Facebook provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Facebook provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Facebook provider. ,
Required: False ,
}
{
appId:
{
Description: The App ID of the app used for login. ,
Required: False ,
}
string ,
appSecretSettingName:
{
Description: The app setting name that contains the app secret. ,
Required: False ,
}
string ,
}
,
graphApiVersion:
{
Description: The version of the Facebook api to be used while logging in. ,
Required: False ,
}
string ,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
gitHub:
{
Description: The configuration settings of the GitHub provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the GitHub provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the GitHub provider. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
google:
{
Description: The configuration settings of the Google provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Google provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Google provider. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
validation:
{
Description: The configuration settings of the Azure Active Directory token validation flow. ,
Required: False ,
}
{
allowedAudiences:
{
Description: The configuration settings of the allowed list of audiences from which to validate the JWT token. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
twitter:
{
Description: The configuration settings of the Twitter provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Twitter provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the app registration for the Twitter provider. ,
Required: False ,
}
{
consumerKey:
{
Description: The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in ,
Required: False ,
}
string ,
consumerSecretSettingName:
{
Description: The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in. ,
Required: False ,
}
string ,
}
,
}
,
apple:
{
Description: The configuration settings of the Apple provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Apple provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Apple registration. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
clientSecretSettingName:
{
Description: The app setting name that contains the client secret. ,
Required: False ,
}
string ,
}
,
login:
{
Description: The configuration settings of the login flow. ,
Required: False ,
}
{
scopes:
{
Description: A list of the scopes that should be requested while authenticating. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
azureStaticWebApps:
{
Description: The configuration settings of the Azure Static Web Apps provider. ,
Required: False ,
}
{
enabled:
{
Description: false if the Azure Static Web Apps provider should not be enabled despite the set registration; otherwise, true. ,
Required: False ,
}
boolean ,
registration:
{
Description: The configuration settings of the Azure Static Web Apps registration. ,
Required: False ,
}
{
clientId:
{
Description: The Client ID of the app used for login. ,
Required: False ,
}
string ,
}
,
}
,
customOpenIdConnectProviders:
{
Description: The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider. ,
Required: False ,
}
object ,
}
,
login:
{
Description: The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
routes:
{
Description: The routes that specify the endpoints used for login and logout requests. ,
Required: False ,
}
{
logoutEndpoint:
{
Description: The endpoint at which a logout request should be made. ,
Required: False ,
}
string ,
}
,
tokenStore:
{
Description: The configuration settings of the token store. ,
Required: False ,
}
{
enabled:
{
Description: true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false. ,
Required: False ,
}
boolean ,
tokenRefreshExtensionHours:
{
Description: The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours. ,
Format: double ,
Required: False ,
}
number ,
azureBlobStorage:
{
Description: The configuration settings of the storage of the tokens if blob storage is used. ,
Required: False ,
}
{
sasUrlSettingName:
{
Description: The name of the app secrets containing the SAS URL of the blob storage containing the tokens. ,
Required: True ,
}
string ,
}
,
}
,
preserveUrlFragmentsForLogins:
{
Description: true if the fragments from the request are preserved after the login request is made; otherwise, false. ,
Required: False ,
}
boolean ,
allowedExternalRedirectUrls:
{
Description: External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed. ,
Required: False ,
}
[
string ,
]
,
cookieExpiration:
{
Description: The configuration settings of the session cookie's expiration. ,
Required: False ,
}
{
convention:
{
Description: The convention used when determining the session cookie's expiration. ,
Enum:
{
FixedTime: No description available. ,
IdentityProviderDerived: No description available. ,
}
,
Required: False ,
}
enum ,
timeToExpiration:
{
Description: The time after the request is made when the session cookie should expire. ,
Required: False ,
}
string ,
}
,
nonce:
{
Description: The configuration settings of the nonce used in the login flow. ,
Required: False ,
}
{
validateNonce:
{
Description: false if the nonce should not be validated while completing the login flow; otherwise, true. ,
Required: False ,
}
boolean ,
nonceExpirationInterval:
{
Description: The time after the request is made when the nonce should expire. ,
Required: False ,
}
string ,
}
,
}
,
httpSettings:
{
Description: The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
requireHttps:
{
Description: false if the authentication/authorization responses not having the HTTPS scheme are permissible; otherwise, true. ,
Required: False ,
}
boolean ,
routes:
{
Description: The configuration settings of the paths HTTP requests. ,
Required: False ,
}
{
apiPrefix:
{
Description: The prefix that should precede all the authentication/authorization paths. ,
Required: False ,
}
string ,
}
,
forwardProxy:
{
Description: The configuration settings of a forward proxy used to make the requests. ,
Required: False ,
}
{
convention:
{
Description: The convention used to determine the url of the request made. ,
Enum:
{
NoProxy: No description available. ,
Standard: No description available. ,
Custom: No description available. ,
}
,
Required: False ,
}
enum ,
customHostHeaderName:
{
Description: The name of the header containing the host of the request. ,
Required: False ,
}
string ,
customProtoHeaderName:
{
Description: The name of the header containing the scheme of the request. ,
Required: False ,
}
string ,
}
,
}
,
encryptionSettings:
{
Description: The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization. ,
Required: False ,
}
{
containerAppAuthEncryptionSecretName:
{
Description: The secret name which is referenced for EncryptionKey. ,
Required: False ,
}
string ,
containerAppAuthSigningSecretName:
{
Description: The secret name which is referenced for SigningKey. ,
Required: False ,
}
string ,
}
,
}
,
}

⚐ Response (default)

{
error:
{
Description: Error model. ,
Required: False ,
}
{
code:
{
Description: Standardized string to programmatically identify the error. ,
Required: False ,
}
string ,
message:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
target:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
details:
{
Description: Details or the error ,
Required: False ,
}
[
{
code:
{
Description: Standardized string to programmatically identify the error. ,
Required: False ,
}
string ,
message:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
target:
{
Description: Detailed error description and debugging information. ,
Required: False ,
}
string ,
}
,
]
,
innererror:
{
Description: More information to debug error. ,
Required: False ,
}
string ,
}
,
}