Azure Application Insights - availability testing with basic auth?

Question

I am trying to setup availability testing (URL Ping Test) with Azure Application Insights on an endpoint that requires basic authentication. It seems that the standard approach with https://username:password@myendpoint.com isn't accepted by Azure (error message says that the URL is malformed and maybe I am missing https/http at the beginning).

Is there any other way to achieve this except of using multi-step web test or Azure Functions, assuming I want to stay in Azure ecosystem? :)

user_4859671 · Answer

Ping test should be relatively simple, there are currently several possibilities to prevent such url from anonymous access, like policies or action filters.

Policy-based authorization

Let's create a simple policy that requires a Secret key in the query string.

First, create the requirement with handler e.g.:

public class HasSecretKeyRequirement : IAuthorizationRequirement
{
}

public class HasSecretKeyRequirementHandler : AuthorizationHandler
{
   private readonly IHttpContextAccessor _httpContextAccessor;
   private readonly IConfiguration _configuration;

   public HasSecretKeyRequirementHandler(IHttpContextAccessor httpContextAccessor, IConfiguration configuration)
   {
       _httpContextAccessor = httpContextAccessor;
       _configuration = configuration;
   }

   protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HasApiKeyRequirement requirement)
   {
       var httpContext = _httpContextAccessor.HttpContext;
            
       if (httpContext == null)
       {
           context.Fail();
           return Task.CompletedTask;
       }
            
       if (httpContext.Request.Query.TryGetValue("SecretKey", out extractedSecretKey))
       {
           var secretKey= _configuration.GetValue("SecretKey");
 
           if (secretKey.Equals(extractedSecretKey))
           {
               context.Succeed(requirement);
               return Task.CompletedTask;
           }
        }
            
        httpContext.Response.ContentType = "text/plain";
        httpContext.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
                    
        context.Fail();
        return Task.CompletedTask;  
    }
}

Then create a new policy with requirement and register requirement handler:

services.AddAuthorization(options =>
{
   options.AddPolicy("HasSecretKey", policy =>
      policy.Requirements.Add(new HasSecretKeyRequirement()));
);

services.AddSingleton();

Apply policy to your ping endpoint:

[Authorize(Policy = "HasSecretKey")]
[HttpGet("api/ping")]
public IActionResult Ping()
{
   return Ok();
}

Finallddd configure your availability test:

https://yourapi.com/api/ping?SecretKey=yoursecretkey

This is just an example, you can create your own requirement and handling logic. You can reuse these policies in your application, e.g. in the healthcheck endpoint:

endpoints.MapHealthChecks("/health")
    .RequireAuthorization("HasSecretKey");

This form of authorization may be sufficient in such a simple case, but definitely should not be used in more advanced scenarios.

user_1537195 · Answer

For reference: Based on the snippet in the answer of @kaushal above, I was able to extend the Basic URL Ping test :) I use the XML in Terraform but you can also submit this via the REST API directly. In my case I needed to add an arbitrary header

I didn't find this documented anywhere but works just as expected for me.

Azure Application Insights - availability testing with basic auth?

3 Answers

Policy-based authorization