Proof of concept for azure static websites behind sso. Usecase: website published and only available to authorized users (in this case everyone in the tenant.)
infra contains a key vault and a static web app.
static web app uses system assigned identity to read client information from key vault.
infra code can be found under ./build/infra as bicep templates.
reuirements:
deploy ./build/infra/main.bicep to resource group:
# login to azure
az login
# create resource group
az group create --location <azure-location> --resource-group <resource-group-name>
# deploy resources
az deployment group create --resource-group <resource-group-name> --template-file build/infra/main.bicep
create app registration for webapp according to Azure Static Web Apps Documentation.
When configuring Authentication callbacks use the custom domain name from main.bicep as the value for <YOUR_SITE>
assign the appropriate users and/or groups the role Default access for the enterprise application.
upload client id and client secret to the create key vault as aadClientId and aadClientSecret.
replace <TENANT_ID> with your azure ad tenant if in the auth configuration in staticwebapp.config.json.
publish the static web app:
# login to azure
az login
# get publish key
az staticwebapp secrets list --name stapp-cn-isms --query "properties.apiKey"
# deploy using deploy key
SWA_CLI_DEPLOYMENT_TOKEN=123 swa deploy --env production