Can a WebJob written in C# create a Azure database?

user_6682134 0
Viewed 346

I've been playing with PowerShell this week creating a new Azure environment for our deployment, the final part of this calls for a WebJob written in C# to accept a message from a queue and create a new database and create the structure as required.

I was wondering if anyone here has done this before, I have found the azure management libraries for .NET which have examples of database creation but I'm stuck on the authorisation as this will be done from a back end process?

Is there anyway I can create a trust in my Azure environment to allow my WebJob to connect Azure (although the app is running in the same subscription) and create a new database?

At this time I don't really have any code more like ideas which is why I'm asking for help :)

I am assuming I would use something like this to authenticate?

var credentials = SdkContext.AzureCredentialsFactory.FromServicePrincipal(
            "clientid",
            "clientsecret",
            "tenantid",
            AzureEnvironment.AzureGlobalCloud);

        // Connect to Azure
        var azure = Azure.Authenticate(credentials).WithDefaultSubscription();

I assume I may need to do something in Azure itself to trust the WebJob to have the access to create a new Azure database but this is the part I'm not sure about.

From PowerShell I've done the authentication by letting PS bring up the Microsoft Live Login Screen but this is not practical for a WebJob with no UI.

Hope this makes sense, and someone can shed some light on it for me?

azure-webjobs azure authentication database c#
1 Answers

You are on the right track.

You will have to create a service principal for the WebJob, which is essentially credentials for an app. You will get a client id and secret for it (which are the app's username and password), which it can use to authenticate against Azure Active Directory, and get an access token to call into APIs (such as Azure's management APIs).

You can see here how to create the app in Azure AD (which also creates the service principal): https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal#create-an-azure-active-directory-application

Then you can assign a role for the service principal on any resource/resource group/subscription. Since you need it to be able to create resources, it should be a Contributor on a resource group at least. If you also need to create a resource group for

So:

  1. Create the app as in the documentation
  2. Add a key (client secret) to the app as in the documentation
  3. Copy the client id and secret + the tenant id as you will need them later when using the APIs
  4. Assign a role/roles for the service principal via the Portal
  5. You can now write the program which uses the credentials you got (this library is pretty nice: https://docs.microsoft.com/en-us/dotnet/azure/dotnet-sdk-azure-concepts?view=azure-dotnet)

Short note on storing secrets:

You should be careful with the client secret, it is essentially a password. At minimum, you should store it in the App Settings of the Web App, not in code. An even better way is to use Azure Key Vault together with Azure AD Managed Service Identity: https://joonasw.net/view/azure-ad-managed-service-identity.

user_16589060
Related