0

We have created an Azure Function which integrate with Active Directory App.

Here is our active directory App which have a self-signed certificate:-

User's image

now inside our Azure function we are passing those values to authenticate the Azure function with Azure Active Directory App:-

  1. Client Id
  2. Tenant ID
  3. Certificate Thumbprint

so i think all those 3 values are considered as public , and none of them are actually confidential (similar to secrets or passwords which should not be exposed) am i correct? and if this is the case, then where is the security in passing those 3 values? in other words, how we can be sure that only our Azure function is calling the Azure Ad APP? i am not sure if it is done using the certificate password which we have applied when creating the certificate?

Regards

1 Answer 1

0

You do not authenticate using the certificate thumbprint, you instead authenticate using the certificate itself. You can therefore be sure that only you are calling the app because only you have the certificate to authenticate with the app. Worth noting that self-signed certificates should not be used in production and you should instead obtain a certificate from a trusted certificate authority.

Create a self-signed public certificate to authenticate your application

4
  • so at the end the private key (the certificate password) is what do the actual authentication?
    – John John
    Feb 25, 2023 at 8:48
  • The private key is not the same thing as a certificate password, but yes it uses the private key to authenticate with your application. Feb 25, 2023 at 11:22
  • ok i see, so my self-signed certificate has a password, public key and private key?
    – John John
    Feb 25, 2023 at 14:43
  • The password is to protect your private key. I would recommend reading about certificates if you require further information, this is off topic from SharePoint. Feb 25, 2023 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.