CODEWITHSUNDEEP
azure-active-directoryazure-functionsazure-function-appazure-digital-twins
Suresh Kumar Mani
Suresh Kumar Mani

Reputation: 29

How to access azure digital twin API using Service Principal?

My use case is whenever i get a trigger from Cosmos DB in Azure functions, need to interact with Azure digital twin APIs without any human interaction.
From the below link, I understood we can use service principal to achieve it.
Is it possible to configure Azure Digital Twins API access for a Daemon App?

But I don't know how to authenticate service principal with digital twin APIs.
1)What type of authentication is required and how the flow will be?
2)If it is Oauth2, what is the grant type and scope for accessing digital twin?

Thanks in advance.

Upvotes: 0

Views: 746

Answers (2)

Matthijs van der Veer
Matthijs van der Veer

Reputation: 4085

There is an (almost) undocumented way to use the Digital Twins API without an On-Behalf-Of flow. I use it for automated tasks to manipulate the contents of ADT or to give certain applications read-only view of the data. It all starts with a role assignment. See this snippet from the YAML that I use to provision my ADT instance when I first make it.

- roleId: 98e44ad7-28d4-4007-853b-b9968ad132d1 # Space Administrator
  objectId: abcd1234-5556-44a2-1234-402dbd999619 # Service Principal object ID
  objectIdType: ServicePrincipalId
  tenantId: 1234567-8901-2345-abcd-123456789 # Azure subscription tenant

The ServicePrincipalId object type is described on this page but is never mentioned in any of the samples again. This snippet gives Space Administrator rights to a service principal. You can then use a client secret to retrieve an access token that will allow you access to ADT. When making an app registration for ADT in your Azure Active Directory, go to Certificates & Secrets and make a new client secret. enter image description here

The next step is to retrieve the objectId of the Service Principal, this is not the objectId of the application registration. When you go to the Overview tab of your App Registration you can copy the Application ID and perform the following command in the cloud console:

az ad sp show --id {the id you copied}

This will show a lot of details about your Service Principal including the objected. Copy this as well. Almost there, to retrieve an Access Token you need 4 things:

  1. Authority: https://login.microsoftonline.com/{your tenant id}
  2. ClientId: The application id of your app registration.
  3. ClientSecret: The client secret you created.
  4. DigitalTwinsAppId: This is always 0b07f429-9f4b-4714-9392-cc5e8e80c8b0

Retrieving the Access Token in .NET Core

var authContext = new AuthenticationContext({Authority});
var clientCredential = new ClientCredential({ClientId}, {ClientSecret});
var result = await authContext.AcquireTokenAsync({DigitalTwinsAppId}, clientCredential);
return result.AccessToken;

Add that to your headers (HttpClient example below) and you are good to go!

httpClient.DefaultRequestHeaders.Add("Authorization", "Bearer " + accessToken);

Upvotes: 2

Allen Wu
Allen Wu

Reputation: 16448

1)What type of authentication is required and how the flow will be?

As the post you have referred to, you should use OAuth 2.0 On-Behalf-Of flow. The main flow is here: Call Digital Twins from a middle-tier web API.

2)If it is Oauth2, what is the grant type and scope for accessing digital twin?

You can refer to this sample:

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer

And for scope, it should be the digital twin API you want to access. (eg. spaces, devices, users or sensors). See API summary.

Upvotes: 0

Related Questions