>> Azure offers a lot of
services that Go developers can use in
their applications to improve security, and scalability,
while reducing complexity, such as
Azure Active Directory for strong authentication,
Redis for caching, and
Azure Storage to store any kind of data.
Josh Gavant is here to show us how to do
it today on Azure Friday.
>> Hi, everybody. Welcome to Azure Friday.
I'm Eric Saint Martin,
and today I have Josh Gavant here with me to talk
about some of the managed services
that are available to Go developers within Azure.
>> Yeah. Thank you, Eric.
Yeah, actually, we have
lots of managed services and we're
trying to make them more and more easy to
use for our Go developers.
So, if viewers watched our last talk,
we talked about this part of this diagram,
the different forms of compute,
the spectrum of compute, that's available.
But really, if you're writing apps for Cloud,
and it's great that we have a managed platform.
That's a very important part of it.
A managed compute platform.
But one of the big advantages and
something that people should
be looking to take advantage of,
is all the managed services that are available in Azure,
or whatever Cloud or data center you're running,
and set up managed services there.
I kind of grouped them in
this diagram into three categories,
and we're just going to talk about
a couple examples today.
But, there are a couple other sessions in the series,
where the other ones will be covered.
So, I kind of grouped them into storage services,
so databases like SQL, or even MySQL, or Postgres,
NoSQL databases through Cosmo's blob storage,
through the storage service, caches with Redis.
Actually, that's what I want to show
today is a Redis cache.
That's pretty important. Obviously, messages and events.
We have several services that
can help people communicate better,
and this is becoming more and more important in Cloud,
as people have these
decoupled micro services applications.
You know, at first, it's okay,
direct our PC, communicating between them,
but it starts to get more important
to understand a little better,
and have reliable messages there.
So, we have some services for that,
that are going to be covered in other videos.
Then finally I wanted to call out
authentication and authorization,
because you don't have to maintain
your own directory of users.
You don't need to find out their profile information.
You can wire up to Azure AD.
>> I have create all that,
all on my my own?
>> No.
>> You don't want [inaudible] to use your data?
>> Yeah, exactly. Let's get out of that business.
Yes, so that's another one that I want to show today,
is how you can add
user authentication to a Go application in Azure.
So, again, we're going to start
off with the app that I showed last time,
and I will, it's pretty similar.
It says, hello somebody,
and if I say name equals gopherman,
then it says hello gopherman.
I guess I should show you the inside of the code.
But this time, I made it a little more complex.
So, the basic tester function
is still down there. We say hello.
But then we've got a couple other handlers here,
where we kick off the authorization flow.
Maybe, I should take a step back here.
So, the way that
you integrate with Azure Active Directory,
to get the benefit of the directory that they have there,
the sign in, and the passwords, everything,
is through OAuth and OpenID connect.
>> Okay.
>> Standard open cloud protocols and Azure AD,
from toggle the window, they
go over and beyond to make sure that
they are complying with the protocol.
So, I wrote in a couple.
To get that user authentication,
there are a couple of handlers you need.
So, when the user first hits your app,
and they're not authenticated,
you have to send them over to Azure AD,
to the authorization server, redirect them there,
to get to sign in, and get a token to bring back to you.
Then, when they come back to you with,
actually now, a token, a code,
an authorization code, they hand it to you,
and then you as the server,
I'm talking about the developer,
you have to hand that off again to Azure AD,
and exchange it for a proper access
token or ID token if it's OpenID connect.
>> Just like a bearer token that
gets passed along with each request?
>> Yeah, exactly, and thenceforth,
if they wanted to access more things on your behalf.
For example, mainly the Office Services
and Microsoft Graph, they could do with this.
Actually, to access Azure services,
we recommend that more of a trusted account model.
So, we don't actually, most of what,
we're working on better supporting on
behalf of flows within Azure,
like databases, and storage, and things.
But, at this point, for that,
you would actually need a different principal,
and a little bit different scheme,
which I'll show you with the Redis example coming up.
>> Okay.
>> So, right here,
what I did is if somebody hits the root of my site,
then I register this handler.
I've used, basically, you could see way down deep,
just calling the tester function again.
But, I've wrapped it in a kind of middleware,
so that it takes a handler and returns a wrapped handler.
>> Okay.
>> So, I've wrapped it with the handler
that implements with authentication,
and then you see another one, slash log in.
The important thing here is that it's actually
the handler that's calling as
the authorization code handler.
Let me just show you what those look like, real quick.
That's the key point here.
Oops. So, in auth.go, and these.
Oh, I should mention,
these things I'm working on getting up
into our Azure SDK for Go samples repo.
Shameless plug here. I should mention that.
It's Azure samples, Azure SDK for Go samples on GitHub,
and these will all be up in here.
You could find them under
the apps directory or scenarios director,
I'm thinking about where to put them,
but they'll be in there,
so you can review the stuff.
They know we're going kind of quickly here.
So, the main thing
that I was pointing out to you earlier,
and I'll show you here, is that with authentication,
takes in the handler, wraps
it with the authentication stuff.
As you can kind of see here,
we check if the user is authenticated.
We're using oauth2Config.
Actually, I should go up to the top.
You can use, if you notice there on line 12 and 13,
we're using the standard x oauth2 library.
Actually, the package with
Microsoft end points is fully up to date, and works.
So, in there, I'm using x oauth2,
I am from, let's see,
this is the user coming in, I have to redirect them,
so I use that oauth2Config.
I create this URL here.
Then, I redirect them off to get authenticated.
That will send them over to
log in the microsoftonline.com,
the log in, and they will be redirected back here, then.
This [inaudible] will be redirected to the slash log in end point.
That will be handled by this.
So, here we check the state,
make sure that's correct.
We get the authorization code out,
and then we call again from
the x oauth2 package off, oauth2Config.exchange.
We exchange the code for a proper access token,
and then we do a little more work,
because it's an OpenID connect token.
So, we can actually parse that down further.
That's what I'm doing here. I'm taking the ID token,
parsing it as a jot,
getting out some parameters that I want.
Specifically, what I'm interested
in this is the key-line.
I'm able to get some standard claims out of there.
Then in lines 171 and 172,
I'm able to, well,
I'm using some constants for the key names.
But, I'm able to get out an email,
and a name, and then
I've actually created to show this all off.
I think it's the bottom of this file, though.
A little user handler which just reads,
instead of saying hello name equals gopherman,
or Eric, or whatever up there.
Instead, I get the user's name from the log in.
>> Okay.
>> So, and I've also deployed this out
to Azure app service.
>> So, now it's actually returning back
information about the user that authenticated,
and not just authenticating them
and giving you just the access to it.
>> Yes, exactly.
That's what OpenID adds to this whole thing.
Otherwise, with just oauth,
you would get a beabrer token,
but you wouldn't know anything about the person.
But, if you specify in the request,
I want OpenID information,
then you'll get that too.
I should also point out the place to sign up,
to create these things, is apps.dev.microsoft.com.
So, actually, I'm using this Go tester app,
to get my app ID, and client ID,
and some I redirect URLs.
Yes. So, let's see if this works.
Let's go to user info, maybe.
So, I'm already logged in on this site.
Let me, let me clear the cache real quick.
What was that called?
Go. Here we go. Toss that out.
Go off. Web apps.
Now, it redirects me,
and I get the standard Azure AD log in page.
I can log in with either of these.
Choose to do that one.
That the home page still doesn't tell you my name,
but when I go to the user info page, it's got it there.
Yeah, so that's,
that's what I want to show you about auth.
The next thing that I was going to bring up,
although we're probably running a little short
on time is Redis.
So, I actually, in the same application,
after the user is authenticated,
I want to keep that data around,
so that when they go to a different page,
I can still know their name.
>> Right.
>> Still verify that they're authenticated.
I've actually been using this in other,
I have a sign up app where I need to,
I want people to only be able to
use their own name to sign up.
Even though it's not a high security system,
but I wanted at least to guarantee their name,
so I had them sign in, and
I can track their name through the whole thing.
So, originally, I was using
Gorilla sessions module or
package to do that with a cookie store.
But, I'm able to use Azure's Redis cache really simply.
So, I'm just going to,
instead of showing you the cookie store,
I'll just skip right to that, kind of show you.
Oh, this is actually still using
a cookie store. Let me just see.
Oh, I need to check out the head.
That was my, I might have lost my shoe.
I can show you it on GitHub how about.
So, I accidentally seem to have deleted that last commit,
and I don't want to get it back right this second.
So, let's go to GitHub, joshgav/go-sample.auth.
Hopefully, I uploaded the Redis changes.
If not, we'll just talk about them.
So, in session.go here.
Yes.
This time, instead of creating a cookie store,
I went ahead and created
Redis store using a common package from the community.
Up here, you could see it's from this one.
This was really the only change I had to make,
because the store is an interface.
So, I just replaced
the cookie store with this Redis store I added to
my script AZ Redis create or ensure, whatever.
Make sure it's there. Then I ran this hall again,
and started using Redis behind the scenes,
I don't worry about it.
>> This is just provisioning a managed Redis.
>> Yeah. So, if I go into that dashboard here,
may be we'll even see it.
Yes. So, you see I've got
the Redis cache is one of these things,
and it's really nice for me.
I know what Redis is and I use it sometimes,
but I don't have time to go deep
into how to set up a Redis cluster and things like that.
>> Okay. Yeah.
>> Yeah. Who even knows.
So, at least I can get started,
and then I don't like
to use the portal necessarily from the start,
but I'll come back in here,
and review the kinds of stuff that's available,
kind of click around,
what kind of advance settings can I set.
So, truly, I mean,
I'm just trying to point out some of the benefits
of starting with a managed service.
Of course, this scales up and down and all around.
>> The more you use managed services,
the more you can focus on
your actual business logic, right?
>> Yeah, exactly. Yes. So, I'll
just bring us back to here.
This is your Go apps on editor.
Use that managed platform.
Use the managed services,
and go, go, go.
>> Thanks again for joining us.
So, today we were learning about some of
the managed services that Azure provides,
for you to be able to leverage things,
like authentication, and authorization, and data storage,
and things that you don't actually have to implement
yourself. Here on Azure Friday.