2

Trying to figure out how to use Azure AppConfiguration REST API (mostly to retrieve and create key-values). So far I found two sources of information: Configuration Stores REST API docs and this GitHub repo Azure App Configuration.

How these two sources are corresponding with each other? They apparently describe some different AppConfig REST API.

I managed to retrieve values from my AppConfig store using this type of URI and AAD authorization https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/listKeyValue?api-version=2019-10-01 But it allows to get only one value of one particular key.

The other approach uses URI based on AppConfig endpoint {StoreName}.azconfig.io/kv/... and must have more flexible ways to retrieve data. But I can't make it work. I tried to follow instructions. And I tried to make a request to this URI using AAD token as I did for the first type of API. In both cases I get 401 auth error. Could anyone share some detailed working examples (Powershell, Postman)? Any help would be appreciated.

Improve this question

2 Answers 2

Reset to default
4

https://management.azure.com/ is the Azure Resource Management API, while the azconfig.io one is App Configuration's own API.

I think you should use App Configuration's own API. The same Azure AD token will not work for this API however. You need to request another access token with resource=https://yourstorename.azconfig.io or scope=https://yourstorename.azconfig.io/.default, depending if you use v1 or v2 token endpoint of Azure AD.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Thank you, @juunas! One short answer and everything fell into place. I wish MS documentation was that clear)
0

Use the $headers in the script to authenticate your api calls:

function Sign-Request( [string] $hostname, [string] $method, # GET, PUT, POST, DELETE [string] $url, # path+query [string] $body, # request body [string] $credential, # access key id [string] $secret # access key value (base64 encoded) ) { $verb = $method.ToUpperInvariant() $utcNow = (Get-Date).ToUniversalTime().ToString("R", [Globalization.DateTimeFormatInfo]::InvariantInfo) $contentHash = Compute-SHA256Hash $body $signedHeaders = "x-ms-date;host;x-ms-content-sha256"; # Semicolon separated header names $stringToSign = $verb + "`n" + $url + "`n" + $utcNow + ";" + $hostname + ";" + $contentHash # Semicolon separated signedHeaders values $signature = Compute-HMACSHA256Hash $secret $stringToSign # Return request headers return @{ "x-ms-date" = $utcNow; "x-ms-content-sha256" = $contentHash; "Authorization" = "HMAC-SHA256 Credential=" + $credential + "&SignedHeaders=" + $signedHeaders + "&Signature=" + $signature } } function Compute-SHA256Hash( [string] $content ) { $sha256 = [System.Security.Cryptography.SHA256]::Create() try { return [Convert]::ToBase64String($sha256.ComputeHash([Text.Encoding]::ASCII.GetBytes($content))) } finally { $sha256.Dispose() } } function Compute-HMACSHA256Hash( [string] $secret, # base64 encoded [string] $content ) { $hmac = [System.Security.Cryptography.HMACSHA256]::new([Convert]::FromBase64String($secret)) try { return [Convert]::ToBase64String($hmac.ComputeHash([Text.Encoding]::ASCII.GetBytes($content))) } finally { $hmac.Dispose() } } # Stop if any error occurs $ErrorActionPreference = "Stop" $uri = [System.Uri]::new("https://{myconfig}.azconfig.io/kv?api-version=1.0") $method = "GET" $body = $null $credential = "<Credential>" $secret = "<Secret>" $headers = Sign-Request $uri.Authority $method $uri.PathAndQuery $body $credential $secret

Sauce: https://github.com/Azure/AppConfiguration/blob/master/docs/REST/authentication/hmac.md#JavaScript

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.