Skip to content

Commit 190ae05

Browse files
v-thepetv-thepet
committed
2 drafts
1 parent 8e6724a commit 190ae05

3 files changed

Lines changed: 54 additions & 49 deletions

File tree

‎articles/app-service/configure-authentication-provider-google.md‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Configure Google Authentication
33
description: Learn how to configure Google authentication as an identity provider for your App Service or Azure Functions app.
44
ms.assetid: 2b2f9abf-9120-4aac-ac5b-4a268d9b6e2b
55
ms.topic: how-to
6-
ms.date: 03/29/2021
6+
ms.date: 07/08/2025
77
ms.custom: fasttrack-edit, AppServiceIdentity
88
author: cephalin
99
ms.author: cephalin
@@ -19,32 +19,34 @@ To complete the procedure, you must have a Google account that has a verified em
1919

2020
## <a name="register"> </a>Register your application with Google
2121

22-
1. Follow the Google documentation at [Sign In with Google for Web - Setup](https://developers.google.com/identity/gsi/web/guides/fedcm-migration) to create a client ID and client secret. You don't need to make any code changes. Use the following information:
23-
- For **Authorized JavaScript Origins**, use `https://<app-name>.azurewebsites.net` with the name of your app in *\<app-name>*.
24-
- For **Authorized Redirect URI**, use `https://<app-name>.azurewebsites.net/.auth/login/google/callback`.
25-
1. Copy the **App ID** and the **App Secret** values.
22+
1. Follow the Google documentation at [Sign In with Google for Web - Setup](https://developers.google.com/identity/gsi/web/guides/fedcm-migration) to create a client ID and client secret. You don't need to make any code changes.
23+
- For **Authorized JavaScript Origins**, use `https://<app-name>.azurewebsites.net`, replacing `<app-name>` with the name of your app.
24+
- For **Authorized Redirect URI**, use `https://<app-name>.azurewebsites.net/.auth/login/google/callback`.
25+
1. Make a note of the **App ID** and the **App Secret** values to use later.
2626

27-
> [!IMPORTANT]
28-
> The **App Secret** value is an important security credential. Don't share this secret with anyone or distribute it within a client application.
27+
> [!IMPORTANT]
28+
> The **App Secret** value is an important security credential. Don't share this secret with anyone or distribute it within a client application.
2929
3030
## <a name="secrets"> </a>Add Google information to your application
3131

32-
1. Sign in to the [Azure portal] and go to your app.
33-
1. Select **Authentication** on the left menu. Select **Add identity provider**.
34-
1. Select **Google** in the identity provider dropdown. Paste in the **App ID** and **App Secret** values that you obtained previously.
32+
1. On the [Azure portal] page for your app, select **Authentication** under **Settings** in the left navigation menu.
3533

36-
The secret is stored as a slot-sticky [application setting](./configure-common.md#configure-app-settings) named `GOOGLE_PROVIDER_AUTHENTICATION_SECRET`. You can later update that setting to use [Key Vault references](./app-service-key-vault-references.md) if you wish to manage the secret in Azure Key Vault.
34+
1. On the **Authentication** page, select **Add identity provider**, or select **Add provider** in the **Identity provider** section.
3735

38-
1. If this is the first identity provider configured for the application, you're also prompted with an **App Service authentication settings** section. Otherwise, you can move to the next step.
39-
40-
The **App Service authentication settings** values determine how your application responds to unauthenticated requests. The default selections will redirect all requests to sign in with this new provider. You can customize this behavior now or adjust these settings later from the main **Authentication** screen by choosing **Edit** next to **Authentication settings**. To learn more about these options, see [Authentication flow](overview-authentication-authorization.md#authentication-flow).
36+
1. On the **Add an identity provider** page, select **Google** in the identity provider dropdown.
4137

42-
1. Select **Add**.
38+
1. Enter the **App ID** and **App Secret** values you obtained previously.
4339

44-
> [!NOTE]
45-
> For adding scope: You can define what permissions your application has in the provider's registration portal. The app can request scopes at the time of sign-in, which use these permissions.
40+
1. Leave the rest of the settings at their default values, and select **Add**.
41+
42+
On the **Authentication** page, the **Google** provider appears in the **Identity provider** section. The **Authentication settings** section shows settings such as how your application responds to unauthenticated requests.
43+
44+
The default selections redirect all requests to sign in with the new provider. You can customize this behavior now or later by selecting **Edit** next to **Authentication settings**. To learn more about the options, see [Authentication flow](overview-authentication-authorization.md#authentication-flow).
4645

47-
You're now ready to use Google for authentication in your app. The provider is listed on the **Authentication** screen. From there, you can edit or delete this provider configuration.
46+
The application secret is stored as a slot-sticky [application setting](configure-common.md#configure-app-settings) named `GOOGLE_PROVIDER_AUTHENTICATION_SECRET`. You can see the setting on the **App Settings** tab of your app's **Environment variables** page in the portal. If you want to manage the secret in Azure Key Vault, you can update the setting later to use [Key Vault references](app-service-key-vault-references.md).
47+
48+
> [!NOTE]
49+
> To add scopes, define the permissions your application has in the provider's registration portal. The app can request scopes that use these permissions at sign-in time.
4850
4951
## Related content
5052

‎articles/app-service/configure-authentication-provider-openid-connect.md‎

Lines changed: 32 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -2,74 +2,76 @@
22
title: Configure an OpenID Connect Provider
33
description: Learn how to configure an OpenID Connect provider as an identity provider for your App Service or Azure Functions app.
44
ms.topic: how-to
5-
ms.date: 04/02/2025
5+
ms.date: 07/08/2025
66
ms.reviewer: mahender
77
ms.custom: AppServiceIdentity
88
author: cephalin
99
ms.author: cephalin
1010
#customer intent: As an app developer, I want to use a custom authentication provider that uses the OpenID Connect specification in Azure App Service.
1111
---
1212

13-
# Configure your App Service or Azure Functions app to sign in by using an OpenID Connect provider
13+
# Configure your App Service or Azure Functions app to use an OpenID Connect provider
1414

1515
[!INCLUDE [app-service-mobile-selector-authentication](../../includes/app-service-mobile-selector-authentication.md)]
1616

17-
This article shows you how to configure Azure App Service or Azure Functions to use a custom authentication provider that adheres to the [OpenID Connect (OIDC) specification](https://openid.net/connect/). OIDC is an industry standard that many identity providers (IDPs) use. You don't need to understand the details of the specification for your app to use an OIDC identity provider.
17+
This article shows you how to configure Azure App Service or Azure Functions to use a custom authentication provider that adheres to the [OpenID Connect (OIDC) specification](https://openid.net/connect/). OIDC is an industry standard that many identity providers use. You don't need to understand the details of the specification for your app to use an OIDC identity provider.
1818

19-
You can configure your app to use one or more OIDC providers. Each provider must have a unique alphanumeric name in the configuration. Only one provider can serve as the default redirect target.
19+
You can configure your app to use one or more OIDC providers. You must give each OIDC provider a unique friendly name in the configuration. Only one provider can serve as the default redirect target.
2020

21-
## <a name="register"> </a>Register your application with the identity provider
21+
## <a name="register"> </a>Register your app with the OIDC identity provider
2222

23-
Your provider requires you to register the details of your application with it. One of these steps involves specifying a redirect URI that has the form `<app-url>/.auth/login/<provider-name>/callback`. Each identity provider should provide more instructions on how to complete the steps. The `<provider-name>` value refers to the friendly name that you give to the OpenID provider name in Azure.
23+
Your provider requires you to register your application by specifying a redirect URI in the form `<app-url>/.auth/login/<provider-name>/callback`. The `<provider-name>` is a friendly name you give the OpenID provider in Azure.
2424

2525
> [!NOTE]
26-
> Some providers might require extra steps for their configuration and for using the values that they provide. For example, Apple provides a private key that isn't itself used as the OIDC client secret. You use it to create a JSON Web Token (JWT). You use the web token as the secret that you provide in your app configuration. For more information, see [Creating a client secret](https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens).
26+
> The OpenID provider name can't contain a hyphen `-`, because an App Service application setting is created based on this name, and application settings don't support hyphens. You can use an underscore `_` instead.
2727
28-
You need to collect a *client ID* and a *client secret* for your application. The client secret is an important security credential. Don't share this secret with anyone or distribute it in a client application.
28+
You need to collect a *client ID* for your application. You also need to provide a *client secret* if you want the user to acquire access tokens using the interactive authorization code flow. If you don't want to acquire access tokens, you don't need to use a secret.
2929

30-
> [!NOTE]
31-
> You only need to provide a client secret to the configuration if you would like to acquire access tokens for the user through interactive login flow using the authorization code flow. If this is not your case, collecting a secret is not required.
30+
The client secret is an important security credential. Don't share this secret with anyone or distribute it in a client application.
31+
32+
Each identity provider should provide instructions on how to complete the registration steps. Some providers might require extra steps for their configuration and for using the values that they provide.
3233

33-
You also need the OIDC metadata for the provider. This metadata is often exposed in a [configuration metadata document](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig), which is the provider's issuer URL suffixed with `/.well-known/openid-configuration`. Get this configuration URL.
34+
For example, Apple provides a private key that you use to create a JSON Web Token (JWT). You provide the JWT as the secret in your app configuration. For more information, see [Creating a client secret](https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens).
35+
36+
You also need the OIDC metadata for the provider. This metadata is often exposed in a [configuration metadata document](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) that you can get at the path formed by appending `/.well-known/openid-configuration` to the provider's issuer URL.
3437

3538
If you can't use a configuration metadata document, get the following values separately:
3639

37-
- The issuer URL (sometimes shown as `issuer`)
38-
- The [OAuth 2.0 authorization endpoint](https://tools.ietf.org/html/rfc6749#section-3.1) (sometimes shown as `authorization_endpoint`)
39-
- The [OAuth 2.0 token endpoint](https://tools.ietf.org/html/rfc6749#section-3.2) (sometimes shown as `token_endpoint`)
40-
- The URL of the [OAuth 2.0 JSON Web Key set](https://tools.ietf.org/html/rfc8414#section-2) document (sometimes shown as `jwks_uri`)
40+
- The issuer URL, sometimes shown as `issuer`.
41+
- The [OAuth 2.0 authorization endpoint](https://tools.ietf.org/html/rfc6749#section-3.1), sometimes shown as `authorization_endpoint`.
42+
- The [OAuth 2.0 token endpoint](https://tools.ietf.org/html/rfc6749#section-3.2), sometimes shown as `token_endpoint`.
43+
- The URL of the [OAuth 2.0 JSON Web Key set](https://tools.ietf.org/html/rfc8414#section-2) document, sometimes shown as `jwks_uri`.
4144

4245
## <a name="configure"> </a>Add provider information to your application
4346

44-
To add provider information for your OpenID Connect provider, follow these steps.
47+
To configure the OpenID Connect provider, follow these steps:
4548

46-
1. Sign in to the [Azure portal] and go to your app.
49+
1. On the [Azure portal](https://portal.azure.com) page for your app, select **Authentication** under **Settings** in the left navigation menu.
4750

48-
1. On the left menu, select **Settings** > **Authentication**. Then select **Add identity provider**.
51+
1. On the **Authentication** page, select **Add identity provider**, or select **Add provider** in the **Identity provider** section.
4952

50-
1. For **Identity provider**, select **OpenID Connect**.
53+
1. On the **Add an identity provider** page, select **OpenID Connect** as the provider.
5154

52-
1. For **OpenID provider name**, provide the unique alphanumeric name that you selected earlier.
55+
1. For **OpenID provider name**, enter the friendly name you chose for your OIDC provider.
5356

54-
1. If you have the URL for the metadata document from the identity provider, provide that value for **Metadata URL**.
57+
1. Under **OpenID Connect provider configuration**, if you have a metadata document from the identity provider, select **Document URL** for **Metadata entry**.
5558

56-
Otherwise, select **Provide endpoints separately**. Put each URL from the identity provider in the appropriate field.
59+
If you don't have a metadata document, select **Enter metadata**, and enter each URL from the identity provider in the appropriate field.
5760

58-
1. Provide the values that you collected earlier for **Client ID**. If the **Client secret** was also collected, provide it as part of the configuration process.
61+
1. Under **App registration**, provide the values you collected earlier for **Client ID** and **Client secret**.
5962

60-
1. Specify an application setting name for your client secret. Your client secret is stored as an app setting to ensure that secrets are stored in a secure fashion. If you want to manage the secret in Azure Key vault, update that setting later to use [Azure Key Vault references](./app-service-key-vault-references.md).
63+
1. Leave the rest of the settings at their default values, and select **Add** to finish setting up the identity provider.
6164

62-
1. Select **Add** to finish setting up the identity provider.
65+
Your client secret is stored as an application setting to ensure that it's stored securely. If you want to manage the secret in Azure Key vault, update the setting later to use [Azure Key Vault references](app-service-key-vault-references.md).
6366

64-
> [!NOTE]
65-
> The OpenID provider name can't contain a hyphen (-) because an app setting is created based on this name. The app setting doesn't support hyphens. Use an underscore (_) instead.
67+
>[!NOTE]
68+
>To add scopes, define the permissions your application has in the provider's registration portal. The app can request scopes that use these permissions at sign-in time.
6669
>
67-
> It also requires that the `aud` scope in your token be the same as the **Client Id** as configured above. It is currently not possible to configure the allowed audiences for this provider at the moment.
70+
>Azure requires `openid`, `profile`, and `email` scopes. Make sure that you configure your app registration in your ID provider with at least these scopes.
6871
>
69-
> Azure requires `openid`, `profile`, and `email` scopes. Make sure that you configure your app registration in your ID provider with at least these scopes.
72+
>The `aud` scope must be the same as the configured **Client Id**. You can't configure the allowed audiences for this provider.
7073
7174
## <a name="related-content"> </a>Related content
7275

7376
[!INCLUDE [app-service-mobile-related-content-get-started-users](../../includes/app-service-mobile-related-content-get-started-users.md)]
7477

75-
[Azure portal]: https://portal.azure.com

‎includes/app-service-mobile-selector-authentication.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,14 @@
22
author: conceptdev
33
ms.service: app-service-mobile
44
ms.topic: include
5-
ms.date: 05/21/2024
5+
ms.date: 07/08/2025
66
ms.author: crdun
77
---
88
> [!div class="op_single_selector"]
99
> * [Microsoft Entra](../articles/app-service/configure-authentication-provider-aad.md)
1010
> * [Facebook](../articles/app-service/configure-authentication-provider-facebook.md)
1111
> * [Google](../articles/app-service/configure-authentication-provider-google.md)
12+
> * [GitHub](../articles/app-service/configure-authentication-provider-github.md)
1213
> * [X](../articles/app-service/configure-authentication-provider-twitter.md)
1314
> * [OpenID Connect provider](../articles/app-service/configure-authentication-provider-openid-connect.md)
1415
> * [Sign in with Apple (preview)](../articles/app-service/configure-authentication-provider-apple.md)

0 commit comments

Comments
 (0)