如何通过编程方式为Azure Web App添加身份提供商？

ARM模板示例 #

要在ARM模板中配置Web App的Microsoft Entra ID（原Azure AD）OpenID身份认证，需在Web App资源的siteConfig.authSettingsV2节点下定义identityProviders配置。以下是完整的资源片段：

{
  "type": "Microsoft.Web/sites",
  "apiVersion": "2023-01-01",
  "name": "[parameters('webAppName')]",
  "location": "[parameters('location')]",
  "dependsOn": [
    "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]"
  ],
  "properties": {
    "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]",
    "siteConfig": {
      "authSettingsV2": {
        "enabled": true,
        "defaultProvider": "AzureActiveDirectory",
        "unauthenticatedClientAction": "RedirectToLoginPage",
        "identityProviders": {
          "azureActiveDirectory": {
            "enabled": true,
            "login": {
              "loginParameters": []
            },
            "registration": {
              "openIdIssuer": "[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/v2.0')]",
              "clientId": "[parameters('aadClientId')]",
              "clientSecretSettingName": "AAD_Client_Secret"
            }
          }
        }
      }
    }
  }
}

参数说明 #

• openIdIssuer: 格式为https://login.microsoftonline.com/{租户ID}/v2.0，替换为你的Entra ID租户ID
• clientId: 注册在Entra ID中的应用程序客户端ID
• clientSecretSettingName: Web App应用设置中存储客户端密钥的名称（无需在模板中硬编码密钥，可通过Azure DevOps管道变量或密钥库注入）

Azure PowerShell示例 #

使用Azure PowerShell直接配置Web App的Entra ID OpenID认证，可通过Set-AzWebApp命令修改AuthSettingsV2属性：

# 定义参数
$webAppName = "your-webapp-name"
$resourceGroupName = "your-resource-group"
$tenantId = "your-tenant-id"
$aadClientId = "your-aad-app-client-id"
$clientSecretSettingName = "AAD_Client_Secret"

# 获取Web App现有配置
$webApp = Get-AzWebApp -Name $webAppName -ResourceGroupName $resourceGroupName

# 构建AuthSettingsV2配置
$authSettingsV2 = @{
  Enabled = $true
  DefaultProvider = "AzureActiveDirectory"
  UnauthenticatedClientAction = "RedirectToLoginPage"
  IdentityProviders = @{
    AzureActiveDirectory = @{
      Enabled = $true
      Registration = @{
        OpenIdIssuer = "https://login.microsoftonline.com/$tenantId/v2.0"
        ClientId = $aadClientId
        ClientSecretSettingName = $clientSecretSettingName
      }
    }
  }
}

# 更新Web App配置
$webApp.SiteConfig.AuthSettingsV2 = $authSettingsV2
Set-AzWebApp -WebApp $webApp

注意事项 #

• 客户端密钥需预先添加到Web App的应用设置中（可通过Set-AzWebAppSlotConfig或Azure DevOps管道任务完成）
• 若使用Entra ID v1.0端点，只需将openIdIssuer改为https://login.microsoftonline.com/{租户ID}/

内容的提问来源于stack exchange，提问作者WinBoss