Authentication differences between isolated and in-process?

[mronnblom-ith]

Hello!

I have an injected mode FunctionApp hosting DfMon. Currently it's using in-process mode (DurableFunctionsMonitor.DotNetBackend v6.7.1) and I have gotten server-directed login flow working, in accordance with the documentation.

Then, I tried switching to DfMon Isolated (DurableFunctionsMonitor.DotNetIsolated v6.7.3), but then the authentication breaks (401). Are there any differences in authentication configuration between in-process and isolated? How about the redirect URL? Should it still be this for isolated:
https://<my-dfm-function-app-name>.azurewebsites.net/.auth/login/aad/callback

Any help with troubleshooting appreciated!

[scale-tone]

Hi Mathias Rönnblom (@mronnblom-ith) , there is no difference in auth process/config between InProc and Isolated.
I suggest you check logs for the exact reason of those 401s.

[mronnblom-ith]

This is the error from the logs:

Result: DFM failed to authenticate request
Type:
Exception: DurableFunctionsMonitor.DotNetIsolated.DfmUnauthorizedException: User myemail@mydomain.com doesn't have any of roles mentioned in DFM_ALLOWED_APP_ROLES, DFM_ALLOWED_FULL_ACCESS_APP_ROLES or DFM_ALLOWED_READ_ONLY_APP_ROLES config setting. Call is rejected
at DurableFunctionsMonitor.DotNetIsolated.Auth.ValidateIdentityAsync(HttpRequestData request, OperationKind operationKind, DfmSettings settings, DfmExtensionPoints extensionPoints)
at DurableFunctionsMonitor.DotNetIsolated.ExtensionMethods.<>c__DisplayClass0_0.<<UseDurableFunctionsMonitor>b__1>d.MoveNext()
Stack: at DurableFunctionsMonitor.DotNetIsolated.Auth.ValidateIdentityAsync(HttpRequestData request, OperationKind operationKind, DfmSettings settings, DfmExtensionPoints extensionPoints)
at DurableFunctionsMonitor.DotNetIsolated.ExtensionMethods.<>c__DisplayClass0_0.<<UseDurableFunctionsMonitor>b__1>d.MoveNext()

The thing is that the same config is used for in-process mode, which works. The pipeline and biceps (including bicepparam where the role app settings are) are identical, except for:
FUNCTIONS_WORKER_RUNTIME: 'dotnet-isolated'
and

  siteConfig: {
    linuxFxVersion: 'DOTNET-ISOLATED|8.0'

[mronnblom-ith]

Here are the packages used for each:

in-proc:

	<ItemGroup>
		<PackageReference Include="Azure.Identity" Version="1.17.1" />
		<PackageReference Include="Fluid.Core" Version="2.31.0" />
		<PackageReference Include="DurableFunctionsMonitor.DotNetBackend" Version="6.7.3" />
		<PackageReference Include="Microsoft.Azure.Functions.Extensions" Version="1.1.0" />
		<PackageReference Include="Microsoft.Azure.WebJobs.Extensions.DurableTask" Version="3.8.0" />
		<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.15.0" />
		<PackageReference Include="Microsoft.NET.Sdk.Functions" Version="4.6.0" />
	</ItemGroup>

isolated:

	<ItemGroup>
		<FrameworkReference Include="Microsoft.AspNetCore.App" />
		<PackageReference Include="Azure.Identity" Version="1.17.1" />
		<PackageReference Include="Fluid.Core" Version="2.31.0" />
		<PackageReference Include="DurableFunctionsMonitor.DotNetIsolated" Version="6.7.3" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker" Version="2.51.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.DurableTask" Version="1.11.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http" Version="3.3.0" />
		<PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="2.0.7" />
		<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.15.0" />
	</ItemGroup>

[epDugas]

I seem to have run into this as well, attempting to troubleshoot, no luck yet.

Installed stand-alone from:
https://github.com/microsoft/DurableFunctionsMonitor/blob/main/durablefunctionsmonitor.dotnetisolated/arm-template.json

Application registration has two different app roles defined (dfmon_reader and dfmon_writer), and these are assigned to:
DFM_ALLOWED_READ_ONLY_APP_ROLES
DFM_ALLOWED_FULL_ACCESS_APP_ROLES

My users is assigned to dfmon_writer, and I get an exception thrown from the same location.

Experience only with the isolated, not in-proc.

Mathias Rönnblom (@mronnblom-ith) - did you ever figure out a solution?

[epDugas]

Update - just jotting down some details in case it helps anyone.

When I was experiencing the issue, hitting https://dfm.sitename.com/.auth/me - I could see roles weren't being returned.

I removed and re-added the authentication provider, and during the course of that,
created a client secret on the app registration and assigned it to env var: MICROSOFT_PROVIDER_AUTHENTICATION_SECRET
After doing this, /.auth/me returned the roles, and I was able to launch DFMon.

[mronnblom-ith]

@mronnblom-ith - did you ever figure out a solution?

No. Still running the in-proc version, and waiting for a reply here.