Skip to content

Commit 0e1b3c2

Browse files
anushakolanAniruddh25souvikghosh04aaronburtleCopilot
authored
Changed the default auth provider from SWA to AppService (#2943)
## Why make this change? - Closes [#2943](#2644) Change default auth provider to AppService from StaticWebApps. Azure Static Web Apps EasyAuth is being deprecated, so DAB should no longer default to [StaticWebApps](vscode-file://vscode-app/c:/Program%20Files/Microsoft%20VS%20Code/resources/app/out/vs/code/electron-browser/workbench/workbench.html) as its authentication provider. - Moving the default to `AppService` aligns DAB with the long‑term supported `EasyAuth` path while keeping behavior equivalent for existing workloads. `StaticWebApps` remains supported when explicitly configured, but new configurations and `dab init` flows should guide users toward `AppService` instead of a deprecated option. ## What is this change? -Config and runtime behavior - Changed the default authentication provider from `Static Web Apps` to `App Service` in the core configuration model and JSON schema. - Added validation that logs a warning when Static Web Apps is explicitly selected (since it’s deprecated as a default). -CLI and `dab init` - Updated `dab init` so that, when no auth provider is specified, it now generates configs using App Service as the provider instead of Static Web Apps. - Adjusted CLI configuration generation and option handling so any “default provider” usage now points to App Service. - Updated end-to-end CLI tests and initialization tests so their expected configurations and arguments reference App Service as the default. -Schema, samples, and built‑in configs - Updated the JSON schema to set the default of the `authentication.provider` property to `AppService`. - Updated sample configuration snippets in the main documentation to show App Service as the provider. - Updated the built‑in `dab-config` JSON files (for all supported databases and multi‑DAB scenarios) so their runtime host sections use App Service. -Engine tests and helpers - Updated test helpers to generate EasyAuth principals appropriate for the configured provider, and to treat App Service as the default in REST and GraphQL integration tests. - Adjusted configuration and health‑endpoint tests to no longer assume Static Web Apps as the implicit provider and to accept App Service as the default. -Snapshots and expected outputs - updated a large set of snapshot files (CLI snapshots, configuration snapshots, entity update/add snapshots) so that anywhere the authentication section previously showed Static Web Apps as the provider, it now shows App Service. -Note We updated `AddEnvDetectedEasyAuth` so that it always registers both the `App Service` and `Static Web Apps` `EasyAuth` schemes in development mode, instead of only adding App Service when certain environment variables are present. This aligns with the new default of using App Service as the primary `EasyAuth` provider and makes dev/test/CI behavior deterministic, while still letting configuration (runtime.host.authentication.provider) choose which scheme is actually used. ## How was this tested? - [x] Integration Tests - [x] Unit Tests ## Sample Request(s) `dab init --database-type mssql --connection-string "<conn-string>"` Generates, `"runtime": { "host": { "authentication": { "provider": "AppService" } } }` Users who still want Static Web Apps can override: `dab init --database-type mssql --connection-string "<conn-string>" --auth.provider StaticWebApps` --------- Co-authored-by: Aniruddh Munde <[email protected]> Co-authored-by: Souvik Ghosh <[email protected]> Co-authored-by: aaronburtle <[email protected]> Co-authored-by: Copilot <[email protected]> Co-authored-by: Anusha Kolan <[email protected]>
1 parent 9bbe252 commit 0e1b3c2

159 files changed

Lines changed: 516 additions & 259 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ The file `dab-config.json` is automatically created through this process. These
169169
"allow-credentials": false
170170
},
171171
"authentication": {
172-
"provider": "StaticWebApps"
172+
"provider": "AppService"
173173
},
174174
"mode": "development"
175175
}

schemas/dab.draft.schema.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -370,7 +370,7 @@
370370
"description": "Custom authentication provider defined by the user. Use the JWT property to configure the custom provider."
371371
}
372372
],
373-
"default": "StaticWebApps"
373+
"default": "AppService"
374374
},
375375
"jwt": {
376376
"type": "object",

src/Azure.DataApiBuilder.Mcp/BuiltInTools/DescribeEntitiesTool.cs

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,30 @@ public Task<CallToolResult> ExecuteAsync(
111111
}
112112
}
113113

114+
// Get current user's role for permission filtering
115+
// For discovery tools like describe_entities, we use the first valid role from the header
116+
// This differs from operation-specific tools that check permissions per entity per operation
117+
if (httpContext != null && authResolver.IsValidRoleContext(httpContext))
118+
{
119+
string roleHeader = httpContext.Request.Headers[AuthorizationResolver.CLIENT_ROLE_HEADER].ToString();
120+
if (!string.IsNullOrWhiteSpace(roleHeader))
121+
{
122+
string[] roles = roleHeader
123+
.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
124+
125+
if (roles.Length > 1)
126+
{
127+
logger?.LogWarning("Multiple roles detected in request header: [{Roles}]. Using first role '{FirstRole}' for entity discovery. " +
128+
"Consider using a single role for consistent permission reporting.",
129+
string.Join(", ", roles), roles[0]);
130+
}
131+
132+
// For discovery operations, take the first role from comma-separated list
133+
// This provides a consistent view of available entities for the primary role
134+
currentUserRole = roles.FirstOrDefault();
135+
}
136+
}
137+
114138
(bool nameOnly, HashSet<string>? entityFilter) = ParseArguments(arguments, logger);
115139

116140
if (currentUserRole == null)

src/Cli.Tests/AddOpenTelemetryTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ private static string GenerateRuntimeSection(string telemetrySection)
138138
""allow-credentials"": false
139139
}},
140140
""authentication"": {{
141-
""provider"": ""StaticWebApps""
141+
""provider"": ""AppService""
142142
}}
143143
}},
144144
{telemetrySection}

src/Cli.Tests/AddTelemetryTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ private static string GenerateRuntimeSection(string telemetrySection)
140140
""allow-credentials"": false
141141
}},
142142
""authentication"": {{
143-
""provider"": ""StaticWebApps""
143+
""provider"": ""AppService""
144144
}}
145145
}},
146146
{telemetrySection}

src/Cli.Tests/ConfigGeneratorTests.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ public void TestSpecialCharactersInConnectionString()
139139
setSessionContext: false,
140140
hostMode: HostMode.Production,
141141
corsOrigin: null,
142-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
142+
authenticationProvider: EasyAuthType.AppService.ToString(),
143143
config: TEST_RUNTIME_CONFIG_FILE);
144144

145145
StringBuilder expectedRuntimeConfigJson = new(
@@ -173,7 +173,7 @@ public void TestSpecialCharactersInConnectionString()
173173
""allow-credentials"": false
174174
},
175175
""authentication"": {
176-
""provider"": ""StaticWebApps""
176+
""provider"": ""AppService""
177177
},
178178
""mode"": ""production""
179179
}

src/Cli.Tests/EndToEndTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ public void TestEnablingMultipleCreateOperation(CliBool isMultipleCreateEnabled,
226226
public void TestAddEntity()
227227
{
228228
string[] initArgs = { "init", "-c", TEST_RUNTIME_CONFIG_FILE, "--host-mode", "development", "--database-type",
229-
"mssql", "--connection-string", TEST_ENV_CONN_STRING, "--auth.provider", "StaticWebApps" };
229+
"mssql", "--connection-string", TEST_ENV_CONN_STRING, "--auth.provider", "AppService" };
230230
Program.Execute(initArgs, _cliLogger!, _fileSystem!, _runtimeConfigLoader!);
231231

232232
Assert.IsTrue(_runtimeConfigLoader!.TryLoadConfig(TEST_RUNTIME_CONFIG_FILE, out RuntimeConfig? runtimeConfig));

src/Cli.Tests/InitTests.cs

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ public Task MsSQLDatabase()
4949
setSessionContext: true,
5050
hostMode: HostMode.Development,
5151
corsOrigin: new List<string>() { "http://localhost:3000", "http://nolocalhost:80" },
52-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
52+
authenticationProvider: EasyAuthType.AppService.ToString(),
5353
restPath: "rest-api",
5454
config: TEST_RUNTIME_CONFIG_FILE);
5555

@@ -71,7 +71,7 @@ public Task CosmosDbPostgreSqlDatabase()
7171
setSessionContext: false,
7272
hostMode: HostMode.Development,
7373
corsOrigin: new List<string>() { "http://localhost:3000", "http://nolocalhost:80" },
74-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
74+
authenticationProvider: EasyAuthType.AppService.ToString(),
7575
restPath: "/rest-endpoint",
7676
config: TEST_RUNTIME_CONFIG_FILE);
7777

@@ -94,7 +94,7 @@ public Task TestInitializingConfigWithoutConnectionString()
9494
setSessionContext: false,
9595
hostMode: HostMode.Development,
9696
corsOrigin: new List<string>() { "http://localhost:3000", "http://nolocalhost:80" },
97-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
97+
authenticationProvider: EasyAuthType.AppService.ToString(),
9898
config: TEST_RUNTIME_CONFIG_FILE);
9999

100100
return ExecuteVerifyTest(options);
@@ -118,7 +118,7 @@ public Task CosmosDbNoSqlDatabase()
118118
setSessionContext: false,
119119
hostMode: HostMode.Production,
120120
corsOrigin: null,
121-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
121+
authenticationProvider: EasyAuthType.AppService.ToString(),
122122
config: TEST_RUNTIME_CONFIG_FILE);
123123

124124
return ExecuteVerifyTest(options);
@@ -151,7 +151,7 @@ bool expectSuccess
151151
setSessionContext: false,
152152
hostMode: HostMode.Production,
153153
corsOrigin: null,
154-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
154+
authenticationProvider: EasyAuthType.AppService.ToString(),
155155
restEnabled: CliBool.True,
156156
graphqlEnabled: CliBool.True,
157157
config: TEST_RUNTIME_CONFIG_FILE);
@@ -189,7 +189,7 @@ public void VerifyRequiredOptionsForCosmosDbNoSqlDatabase(
189189
setSessionContext: false,
190190
hostMode: HostMode.Production,
191191
corsOrigin: null,
192-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
192+
authenticationProvider: EasyAuthType.AppService.ToString(),
193193
config: TEST_RUNTIME_CONFIG_FILE);
194194

195195
Assert.AreEqual(expectedResult, TryCreateRuntimeConfig(options, _runtimeConfigLoader!, _fileSystem!, out RuntimeConfig? _));
@@ -219,7 +219,7 @@ public void EnsureFailureWhenBothRestAndGraphQLAreDisabled(
219219
setSessionContext: false,
220220
hostMode: HostMode.Production,
221221
corsOrigin: null,
222-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
222+
authenticationProvider: EasyAuthType.AppService.ToString(),
223223
restEnabled: restEnabled,
224224
graphqlEnabled: graphQLEnabled,
225225
restDisabled: restDisabled,
@@ -245,7 +245,7 @@ public Task TestSpecialCharactersInConnectionString()
245245
setSessionContext: false,
246246
hostMode: HostMode.Production,
247247
corsOrigin: null,
248-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
248+
authenticationProvider: EasyAuthType.AppService.ToString(),
249249
config: TEST_RUNTIME_CONFIG_FILE);
250250

251251
return ExecuteVerifyTest(options);
@@ -267,7 +267,7 @@ public void EnsureFailureOnReInitializingExistingConfig()
267267
setSessionContext: false,
268268
hostMode: HostMode.Development,
269269
corsOrigin: new List<string>() { },
270-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
270+
authenticationProvider: EasyAuthType.AppService.ToString(),
271271
config: TEST_RUNTIME_CONFIG_FILE);
272272

273273
// Config generated successfully for the first time.
@@ -346,7 +346,7 @@ public void EnsureFailureReInitializingExistingConfigWithDifferentCase()
346346
setSessionContext: true,
347347
hostMode: HostMode.Development,
348348
corsOrigin: new List<string>() { "http://localhost:3000", "http://nolocalhost:80" },
349-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
349+
authenticationProvider: EasyAuthType.AppService.ToString(),
350350
restPath: "rest-api",
351351
config: TEST_RUNTIME_CONFIG_FILE);
352352
Assert.AreEqual(true, TryGenerateConfig(initOptionsWithAllLowerCaseFileName, _runtimeConfigLoader!, _fileSystem!));
@@ -361,7 +361,7 @@ public void EnsureFailureReInitializingExistingConfigWithDifferentCase()
361361
setSessionContext: true,
362362
hostMode: HostMode.Development,
363363
corsOrigin: new List<string>() { "http://localhost:3000", "http://nolocalhost:80" },
364-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
364+
authenticationProvider: EasyAuthType.AppService.ToString(),
365365
restPath: "rest-api",
366366
config: TEST_RUNTIME_CONFIG_FILE.ToUpper());
367367
// Platform Dependent
@@ -384,7 +384,7 @@ public Task RestPathWithoutStartingSlashWillHaveItAdded()
384384
setSessionContext: false,
385385
hostMode: HostMode.Production,
386386
corsOrigin: null,
387-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
387+
authenticationProvider: EasyAuthType.AppService.ToString(),
388388
restPath: "abc",
389389
config: TEST_RUNTIME_CONFIG_FILE);
390390

@@ -403,7 +403,7 @@ public Task GraphQLPathWithoutStartingSlashWillHaveItAdded()
403403
setSessionContext: false,
404404
hostMode: HostMode.Production,
405405
corsOrigin: null,
406-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
406+
authenticationProvider: EasyAuthType.AppService.ToString(),
407407
graphQLPath: "abc",
408408
config: TEST_RUNTIME_CONFIG_FILE);
409409

@@ -466,7 +466,7 @@ public Task VerifyCorrectConfigGenerationWithMultipleMutationOptions(DatabaseTyp
466466
setSessionContext: true,
467467
hostMode: HostMode.Development,
468468
corsOrigin: new List<string>() { "http://localhost:3000", "http://nolocalhost:80" },
469-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
469+
authenticationProvider: EasyAuthType.AppService.ToString(),
470470
restPath: "rest-api",
471471
config: TEST_RUNTIME_CONFIG_FILE,
472472
multipleCreateOperationEnabled: isMultipleCreateEnabled);
@@ -482,7 +482,7 @@ public Task VerifyCorrectConfigGenerationWithMultipleMutationOptions(DatabaseTyp
482482
setSessionContext: true,
483483
hostMode: HostMode.Development,
484484
corsOrigin: new List<string>() { "http://localhost:3000", "http://nolocalhost:80" },
485-
authenticationProvider: EasyAuthType.StaticWebApps.ToString(),
485+
authenticationProvider: EasyAuthType.AppService.ToString(),
486486
restPath: "rest-api",
487487
config: TEST_RUNTIME_CONFIG_FILE,
488488
multipleCreateOperationEnabled: isMultipleCreateEnabled);

src/Cli.Tests/ModuleInitializer.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,8 @@ public static void Init()
8181
VerifierSettings.IgnoreMember<RuntimeConfig>(config => config.McpDmlTools);
8282
// Ignore the IsStaticWebAppsIdentityProvider as that's unimportant from a test standpoint.
8383
VerifierSettings.IgnoreMember<RuntimeConfig>(config => config.IsStaticWebAppsIdentityProvider);
84+
// Ignore the IsAppServiceIdentityProvider as that's unimportant from a test standpoint.
85+
VerifierSettings.IgnoreMember<RuntimeConfig>(config => config.IsAppServiceIdentityProvider);
8486
// Ignore the RestPath as that's unimportant from a test standpoint.
8587
VerifierSettings.IgnoreMember<RuntimeConfig>(config => config.RestPath);
8688
// Ignore the GraphQLPath as that's unimportant from a test standpoint.

src/Cli.Tests/Snapshots/AddEntityTests.AddEntityWithAnExistingNameButWithDifferentCase.verified.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
AllowCredentials: false
1919
},
2020
Authentication: {
21-
Provider: StaticWebApps
21+
Provider: AppService
2222
}
2323
}
2424
},

0 commit comments

Comments
 (0)