{"id":2155,"date":"2024-11-13T08:53:38","date_gmt":"2024-11-13T16:53:38","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/identity\/?p=2155"},"modified":"2024-11-28T03:10:12","modified_gmt":"2024-11-28T11:10:12","slug":"azure-openai-app-with-python-and-external-id","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/identity\/azure-openai-app-with-python-and-external-id\/","title":{"rendered":"Creating an Azure OpenAI app with Python using External ID authentication"},"content":{"rendered":"<p>In the world of artificial intelligence (AI), creating secure and robust applications is essential. Integrating powerful AI models, such as those offered by Azure&#8217;s OpenAI services, with secure authentication through External ID, you can confidently deploy powerful AI-driven applications. This guide shows you how to bring these capabilities together using Python and Azure\u2019s built-in tools, as well as leveraging External ID authentication to make it easy to create an app with secure access to AI-driven functionalities.<\/p>\n<p>We\u2019ll be using a mix of Azure CLI commands (azd) and Bicep templates to get an app up and running and configured with External ID and Azure infrastructure.<\/p>\n<h2>Objectives<\/h2>\n<p>To securely access and manage AI-driven functionality, we have two main tasks:<\/p>\n<ol>\n<li><strong>Implementing user authentication:<\/strong> We\u2019ll take an OpenAI application and add user authentication to it so that a user can log in and securely use our app.<\/li>\n<li><strong>Automated setup:<\/strong> We want the set up to be fully automated so we will use a combination of Bicep templates with the Microsoft Graph SDK using Python. <\/li>\n<\/ol>\n<h2>Streamlining authentication and authorization<\/h2>\n<p>Typically, developers would need to build custom logic on their backend to verify the authorization code flow, handle OAuth, and return an access token. This process can be time-consuming and requires considerable development effort to manage authentication.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/identity\/wp-content\/uploads\/sites\/74\/2024\/11\/OAuth2-authentication-flow-with-OIDC.png\" alt=\"OAuth2 authentication flow with OIDC\" \/><\/p>\n<p>Instead, we\u2019ll use Azure\u2019s built-in authentication for App Service which intercepts requests, figures out which users are not logged in, manages token issuance, and redirects users back to the application upon successful sign in. This allows you to focus on building application features while the platform manages authentication and authorization.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/identity\/wp-content\/uploads\/sites\/74\/2024\/11\/Built-in-authentication-for-App-Service.png\" alt=\"Built in authentication for App Service\" \/><\/p>\n<h2>Setting up and running the application<\/h2>\n<h3>Prerequisites<\/h3>\n<ul>\n<li>Install <a href=\"https:\/\/www.python.org\/downloads\/\">Python<\/a> (Python 3+ recommended).<\/li>\n<li>After installing Python, install <a href=\"https:\/\/pip.pypa.io\/en\/stable\/installation\/\">pip<\/a> if it doesn\u2019t exist.<\/li>\n<li><a href=\"https:\/\/docs.docker.com\/desktop\/install\/windows-install\/\">Docker<\/a> for Windows\/Linux. <\/li>\n<li>An external tenant with a subscription. \n<ul>\n<li>If you don\u2019t have one, you can create one using our\u202f<a href=\"https:\/\/aka.ms\/ciam\/freetrial-info\">30-day free trial<\/a>\u202for\u202f<a href=\"https:\/\/aka.ms\/ExternalIDConsumerApps\">create an external tenant<\/a>\u202fwith an Azure subscription.<\/li>\n<\/ul>\n<\/li>\n<li>(Optional): <a href=\"https:\/\/ai.azure.com\/\">Quota<\/a> increase on open AI. This can be done by going to the quotas tab and asking for an increase in gpt-4o-mini.<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/identity\/wp-content\/uploads\/sites\/74\/2024\/11\/External-id-tenant-architecture.png\" alt=\"External id tenant architecture\" \/><\/p>\n<p>We are going to set up our architecture using two tenants:<\/p>\n<ul>\n<li>a workforce\/default tenant where we will create the Azure infrastructure, and <\/li>\n<li>an external tenant where we will work on creating all the Entra resources.<\/li>\n<\/ul>\n<h3>Setting up the virtual environment<\/h3>\n<p>You will install all dependencies and set up the environment on your local machine to run the Python scripts.<\/p>\n<ul>\n<li>\n<p>Clone the following repository:<\/p>\n<p>git clone https:\/\/github.com\/Azure-Samples\/openai-chat-app-entra-auth-builtin.git<\/p>\n<\/li>\n<li>\n<p>Cd to where the openai chat application is<\/p>\n<p>cd openai-chat-app-entra-auth-builtin<\/p>\n<\/li>\n<li>\n<p>Create a Python virtual environment. This will create <code>tutorial-env<\/code> if it doesn\u2019t exist and create directories inside it containing a copy of the Python interpreter and various supporting files.<\/p>\n<p>python -m venv tutorial-env<\/p>\n<\/li>\n<li>\n<p>Now, activate the environment by running:<\/p>\n<\/li>\n<\/ul>\n<p><strong>Windows<\/strong><\/p>\n<pre><code>tutorial-env\\Scripts\\activate\n<\/code><\/pre>\n<p><strong>Linux\/MacOS<\/strong><\/p>\n<pre><code>source tutorial-env\/bin\/activate\n<\/code><\/pre>\n<ul>\n<li>\n<p>Install the requirements:<\/p>\n<p>python -m pip install -r requirements-dev.txt<\/p>\n<\/li>\n<\/ul>\n<h3>Setting up Microsoft Entra External ID<\/h3>\n<p>You will create an app and an associated user flow in an external tenant.<\/p>\n<p>To request tokens from the Microsoft Identity platform, you will need to create a service principal that can programmatically create an app registration, application roles, and a user flow, and link your app to the user flow. This is because azd doesn\u2019t let you create an app and user flow directly. However, you can create a service principal with azd, which you can then use with the Microsoft Graph SDK to set up an application and user flow in Microsoft Entra.<\/p>\n<p>Next, we\u2019ll run a script that will do the following:<\/p>\n<ul>\n<li>\n<p>Create a service principal in the external tenant.<\/p>\n<\/li>\n<li>\n<p>Create an application.<\/p>\n<\/li>\n<li>\n<p>Granting application roles.<\/p>\n<\/li>\n<li>\n<p>Creating a user flow.<\/p>\n<\/li>\n<li>\n<p>Link the application to the user flow.<\/p>\n<\/li>\n<li>\n<p>Create a new azd environment<\/p>\n<p>azd env new<\/p>\n<\/li>\n<\/ul>\n<p>This will create the folder under <code>.azure\/<\/code> in your project to store the configuration for this deployment.<\/p>\n<ul>\n<li>\n<p>Set the <code>AZURE_AUTH_TENANT_ID<\/code> azd environment variable to the external tenant you want to use for authentication. This can be found on the Entra portal under tenant properties.<\/p>\n<\/li>\n<li>\n<p>Set the <code>AZURE_AUTH_LOGIN_ENDPOINT<\/code> for the External ID tenant, which usually appears as <code>TenantName.ciamlogin.com<\/code>. You can find it on the Entra portal, under <strong>Settings<\/strong> \u2699\ufe0f. Simply pick the tenantname and add .ciamlogin.com<\/p>\n<p>azd env set AZURE_AUTH_TENANT_ID your-tenant-id<\/p>\n<\/li>\n<li>\n<p>Login to azd CLI with the External ID tenant ID:<\/p>\n<p>azd auth login &#8211;tenant-id AUTH-TENANT-ID<\/p>\n<\/li>\n<\/ul>\n<p>Run the script that will set up the app registration, service principals, roles, and permissions on Entra:<\/p>\n<p><strong>Linux<\/strong><\/p>\n<pre><code>.\/scripts\/setup_for_external_id.ps1 \n\n.\/scripts\/setup_for_external_id.sh \n<\/code><\/pre>\n<p><strong>Windows<\/strong><\/p>\n<p><em>In PowerShell, run:<\/em><\/p>\n<pre><code>.\\setup_for_external_id.ps1\n<\/code><\/pre>\n<p><em>In Git Bash, run the shell script:<\/em><\/p>\n<pre><code>.\/setup_for_external_id.sh\n<\/code><\/pre>\n<h3>Deploying the application<\/h3>\n<p>You will deploy resources in the workforce (or default) tenant using a Bicep file which will include the provisioning of a resource group, Azure Key Vault, Log Analytics, and your application as an Azure Container App.<\/p>\n<p>Once you have set up Microsoft Entra External ID you can now log in to your Azure tenant to deploy your app.<\/p>\n<ul>\n<li>\n<p>Log in to the default or workforce tenant on the Azure portal where you want to deploy your application. This will be a different tenant from your external tenant.<\/p>\n<p>azd auth login &#8211;tenant-id AZURE-TENANT-ID<\/p>\n<\/li>\n<li>\n<p>Set your quota capacity to 8 as that\u2019s currently the max quota available , unless you request an increase.<\/p>\n<p>azd env set AZURE_OPENAI_DEPLOYMENT_CAPACITY 8<\/p>\n<\/li>\n<li>\n<p>You can customize the deployment by setting the environment variables to use existing Azure resources.<\/p>\n<\/li>\n<li>\n<p>Provision and deploy all the resources.<\/p>\n<p>azd up<\/p>\n<\/li>\n<li>\n<p>When azd has finished deploying you will see an endpoint URL in the command output. Visit the URL and you should see the chat app running with External ID.<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/identity\/wp-content\/uploads\/sites\/74\/2024\/11\/Output-from-running-azd-up.png\" alt=\"Output from running azd up\" \/><\/p>\n<ul>\n<li>\n<p>When you make any changes to the app, you can run:<\/p>\n<p>azd deploy<\/p>\n<\/li>\n<\/ul>\n<h3>Running the application<\/h3>\n<p>Once deployment has completed, you will be able to run your application using the endpoint provided after the azd deployment.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/identity\/wp-content\/uploads\/sites\/74\/2024\/11\/Application-endpoint-URL.png\" alt=\"screenshot\" \/><\/p>\n<ul>\n<li>\n<p>Run the endpoint in the browser. It should look like:<\/p>\n<p>https:\/\/containername.randomname.<region>.azurecontainerapps.io<\/p>\n<\/li>\n<li>\n<p>In the browser, sign up or sign in to your Open AI application with a user within your external tenant.<\/p>\n<\/li>\n<li>\n<p>Once signed in, you can now interact with the app as shown below:<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/identity\/wp-content\/uploads\/sites\/74\/2024\/11\/Azure-open-AI-chat-app-and-Microsoft-Entra.png\" alt=\"Azure open AI chat app and Microsoft Entra\" \/><\/p>\n<h2>Let\u2019s recap<\/h2>\n<p>You have now successfully set up External ID as an identity provider for your container application using Open AI and Python.<\/p>\n<p>In this blog post, you have learned how to:<\/p>\n<ul>\n<li>create an OpenAI application using Python.<\/li>\n<li>add authentication to your Function App using External ID.<\/li>\n<li>configure external authentication by creating and adding a user flow with customized branding. <\/li>\n<li>sign up and sign in an External ID user with email and password on your website. <\/li>\n<\/ul>\n<h2>Stay connected<\/h2>\n<p>To learn more or test out features in the Microsoft Entra portfolio, visit our\u202f<a href=\"https:\/\/aka.ms\/dev\/external-id\">developer center<\/a>. Make sure you subscribe to the\u202f<a href=\"https:\/\/aka.ms\/devblog\/external-id\">Identity developer blog<\/a>\u202ffor more insights and to keep up with the latest on all things Identity. And, follow us on\u202f<a href=\"https:\/\/www.youtube.com\/@MicrosoftSecurity\/playlists\">YouTube<\/a>\u202ffor video overviews, tutorials, and deep dives.<\/p>\n<p>Join our <a href=\"https:\/\/ux.microsoft.com\/Panel\/MicrosoftEntraExternalID?utm_campaign=ExternalID&amp;utm_source=AppService&amp;utm_medium=Blog\">research panel<\/a> to receive occasional invites to participate in customer research.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn how to securely integrate Azure\u2019s OpenAI services with External ID authentication, using Python, Azure CLI, and Bicep templates. This guide walks you through setting up a secure AI-driven application with streamlined access management on Azure.<\/p>\n","protected":false},"author":165107,"featured_media":1825,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[48],"tags":[59,38,44,20,16,47,4],"class_list":["post-2155","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","tag-ai","tag-authentication","tag-authorization","tag-devex","tag-entra","tag-external-id","tag-security"],"acf":[],"blog_post_summary":"<p>Learn how to securely integrate Azure\u2019s OpenAI services with External ID authentication, using Python, Azure CLI, and Bicep templates. This guide walks you through setting up a secure AI-driven application with streamlined access management on Azure.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/posts\/2155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/users\/165107"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/comments?post=2155"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/posts\/2155\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/media\/1825"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/media?parent=2155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/categories?post=2155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/identity\/wp-json\/wp\/v2\/tags?post=2155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}