Authentication Enabled | Vulnerability Database

App Service authentication is activated

Enabling authentication ensures that all communications in the application are authenticated. The auth_settings block needs to be filled out with the appropriate auth backend settings

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Log in to the Microsoft Azure Management Console.
Find the search bar at the top and search for App Services.
Select the “App Service” by clicking on “Name” to go to its configuration.
Scroll down the selected “App Services” navigation panel and under “Settings” click on “Authentication”.
On the “Authentication” page check if “App Service Authentication” is “Disabled”. If it’s “Disabled”, then all unauthenticated requests to the app will not be redirected to the login page. It is recommended to have authentication enabled for all requests.
If the “App Service Authentication” is “Disabled”, then click on “Enable authentication” button to enable authentication.
Wait for the confirmation message on top right to ensure authentication is now enabled.
If there is no “Identity provider” then you will see the “Add identity provider” button.
Click on the “Add identity provider” button and choose your desired “Identity provider” by selecting the relevant provider’s name.
Now configure the behavior and click “Add” to complete the setup.
Verify that “Authentication” is now enabled.
Repeat steps 3 to 11 to enable “Authentication” across all “App Services” in the account.

Enable authentication to prevent anonymous request being accepted

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


resource "azurerm_app_service" "good_example" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  auth_settings {
    enabled = true
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#enabled