Secure Azure SOAP/REST API, END-TO-END process

Intro

• Azure Active Directory
• URL Authorization
• Logic Apps
• App Services
• WCF (yes soap   web app
• Public RESTful service (Postcode API)
• Azure API Management

End-to-End Scenario

The whole end-to-end scenario will be discussed in a few blogposts, and this first post will focus on publishing a WCF service and protecting it using Azure Active Directory and URL Authorization.

If you’ve been reading my blog for a long time, you will now that I tend to be pretty elaborate and this blogpost is no difference. So yes you might want to skip some items as you might already be familiar with it.

Create the customer WCF service

So first of create a new WCF service using your favourite IDE, in my case Visual Studio

using System;
using System.Runtime.Serialization;

namespace CustomerService
{
[Serializable]
[DataContract]
public class CustomerData
{
[DataMember]
public int CustomerId { get; set; }

[DataMember]
public string FirstName { get; set; }

[DataMember]
public string SurName { get; set; }

[DataMember]
public int PostCode { get; set; }

}
}

using System.Collections.Generic;
using System.ServiceModel;

namespace CustomerService
{

[ServiceContract]
public interface ICustomers
{
[OperationContract]
List<CustomerData> GetCustomers();

}

}

using System.Collections.Generic;
namespace CustomerService
{
public class Customers : ICustomers
{
public List<CustomerData> GetCustomers()
{

return CustomerFactory();
}

private List<CustomerData> CustomerFactory()
{
var result = new List<CustomerData>()
{
new CustomerData()
{
CustomerId = 1,
FirstName = “Rene”,
SurName = “Brauwers”,
PostCode = 2034
}
};

result.Add(new CustomerData()
{
CustomerId = 2,
FirstName = “Mick”,
SurName = “Badran”,
PostCode = 2031
});

result.Add(new CustomerData()
{
CustomerId = 3,
FirstName = “Crocodile”,
SurName = “Dundee”,
PostCode = 4880
});

return result;
}
}
}

Deploy the customer WCF service

In order to do so, you will require a Azure Subscription. If you do not have a Azure Subscription, you can sign up here for a free trial

1) From within VS.Net, right click on your WCF service and select Publish…

• the Web App Name (Name of the web application to deploy – your wcf service)
• the Azure Subscription in which the app will be deployed
• the resource-group to deploy to (you can select an existing Resource Group or create a new one (using the new button). In my case I selected an existing resource-group)

• the App Service Plan to use (you can select an existing app service plan, or create a new one. In my case I created a new one. Creating a new App Service Plan is straight forward as well. Just select the NEW button next to the App Service Plan.

• After you’ve pressed the new button, you simply fill out the required information consisting of the name for the App Service Plan, the location (data-centre) to deploy to and the size (pricing tier)

Test customer WCF service

you can choose from two options, which one you choose does not matter for SOAPUI. In my case I selected the singleWSDL one as this ensures that the whole web-service description is contained in one single file and as such it does not reference any other files. I usually choose this option to avoid any potential issues importing as some clients have issues importing a WSDL which has dependencies on multiple files)

7)  Your webservice should return a list of customers, which indicates that everything is working 

Secure your WCF Service

Enabling AAD as authentication provider for our web-app

Protecting our web-service

{
“routes”: [
{
“http_methods”: [ “GET” ],
“path_prefix”: “/”,
“policies”: {
“unauthenticated_action”: “AllowAnonymous”
}
},
{
“http_methods”: [ “POST” ],
“path_prefix”: “/Customers.svc”,
“policies”: {
“unauthenticated_action”: “RejectWith401”
}
}
]
}

Please note; adding the authorization.json file to you vs.net project and making it part of your deployment, will cause an error. “The page cannot be displayed because an internal server error has occurred.”  This is most likely due to the fact that the feature is currently in preview. Looking at the log indicates that there is a deserialization issue.

System.Runtime.Serialization.SerializationException: There was an error deserializing the object of type Microsoft.Azure.AppService.Routes.RoutesConfig. Encountered unexpected character ‘ï’. —> System.Xml.XmlException: Encountered unexpected character ‘ï’.

In order to resolve this issue we will be adding the authorization file manually by leveraging the App Service Editor from within the Portal
. Which is being described below:

Enabling authentication

{
“routes”: [
{
“http_methods”: [ “GET” ],
“path_prefix”: “/”,
“policies”: {
“unauthenticated_action”: “AllowAnonymous”
}
},
{
“http_methods”: [ “POST” ],
“path_prefix”: “/Customers.svc”,
“policies”: {
“unauthenticated_action”: “RejectWith401”
}
}
]
}

Test the protected webservice

Conclusion