How to securely invoke a Azure Logic App from Azure Data Factory

user_10990028 0
Viewed 786

I have a Data Factory pipeline that calls a Logic App. The URL provided by the logic app designer includes a signature in the URL. In the Data Factory pipeline I have a Web activity that uses POST method to call the Logic App. This works, the app is called.

I would either prefer to separate this signature from the URL and store it in Azure Key Vault, or use authentication. Authentication options in Data Factory include; Basic, Managed Identity or Client Certificate. I tried to follow this article to enable authentication via Azure Active Directory OAuth but do not currently see how this would work with Azure Data Factory.

Data Factory Web activity authentication options

I know it is possible to enable API Management Gateway to enable more sophisticated authentication to APIs including Logic Apps but am not currently convinced that I should need to do this.

The other thing I noticed in the Logic App interface is that you cannot issue authorizations to execute. This differs from other Azure services like Data Lake for example where you can issue 'use-like' authorization to read a container. There is only the Authorization pane that can be used to define claims. I had a little go but I am missing key information.

Ultimately I would not want the signature exposed to developers including myself.

azure-data-factory azure-logic-apps authentication
2 Answers
user_104178390

I personally like storing the PostURL in the Azure KeyVault then doing an Azure KeyVault GET API Call in ADF, then passing the output securely in ADF to the request to trigger the logic app. It's two activities which is like nothing and it's a secure method that can just use managed identity authentication that's Native in ADF.

Here is example of how you get a value from AKV:

Getting value from AKV

Getting Value from AKV

Here is the URL for Azure KeyVault example secret:

https://kv-ccok-ops-@{pipeline().globalParameters.Environment}.vault.azure.net//secrets/FILESERVER-UserName?api-version=7.1

Using value from AKV

Using AKV Value

This example should be super easy to follow.

user_74109980
Related