Przemek Sempruch przemos

## gist:550b4cc0bfd2af5b166ede43ecac46c8
1GB        768MB      512MB
5.15 secs  7.52 secs  8.90 secs
7.06 secs  7.52 secs  8.94 secs
7.06 secs  7.53 secs  8.95 secs
7.06 secs  7.67 secs  9.38 secs
7.06 secs  7.67 secs  9.41 secs
7.07 secs  7.72 secs  9.43 secs
7.12 secs  8.27 secs  10.31 secs
7.18 secs  8.39 secs  10.41 secs
7.19 secs  8.50 secs  10.61 secs

## worker.js
<< body of BRFv4_JS_trial.js>>

var brfv4 = null;
var brfManager = null;

function waitForSDK() {
	if (brfv4 === null) {
		brfv4 = {
			locateFile: function () {
				return "BRFv4_JS_trial.js.mem";

## bareToken
{
  "alg": "RS256",
  "typ": "JWT",
  "nonce": ""
}.{
  "sub": "9881ce0f-6461-eb11-a812-000d3ad5cb5a",
  "preferred_username": "9a5b39cb-529c-4656-a806-a9556f0aa2e9",
  "phone_number": "",
  "given_name": "John",
  "family_name": "Smith",

## papconfig.csv

          
            Key
            Value

            
              ImplicitGrantFlow/RegisteredClientId
              acmeApi1;acmeApi2

            
              ImplicitGrantFlow/acmeApi1/RedirectUri
              https://acme.powerappsportals.com/

            
              ImplicitGrantFlow/acmeApi2/RedirectUri
              https://acme.powerappsportals.com/

## jwt-validate-simple.xml
<validate-jwt header-name="Authorization"
              failed-validation-httpcode="401"
              require-scheme="Bearer"
              output-token-variable-name="securityToken">
  <issuer-signing-keys>
    :public_key_goes_here:
  </issuer-signing-keys>
  <audiences>
      <audience>acmeApi1</audience>
  </audiences>

## public_key_digestion.py
# Ensure the libraries below
# pip install cryptography
# pip install pycrypto
from Crypto.PublicKey import RSA
import base64
from binascii import unhexlify
import sys

def long_to_bytes (val):
    """

## jwt-validate-with-key.xml
<validate-jwt header-name="Authorization"
              failed-validation-httpcode="401"
              require-scheme="Bearer"
              output-token-variable-name="securityToken">
  <issuer-signing-keys>
    <key n="i4VjvPsOVIT+cQXcEnfCxEtT52NovR5kC7zyS/p9+Jduuwqmxe2Ev4Tt60sDUPYNv+gP3LXsG9xxeaR7FDTbD7QYOyO8vjlcwKcOLJQQnFXp+XVAj26YavuEMJspLMBVoa4fu9twc6yXAi25LNy7oRZ6y2cZRuwEfdIL4ezoErMAWwqFO/Dyyo5cFbwpqUXIqtrDcp0aOv4OA4GM2dUjE97M1VsdbCfP+kkp1RxDMQEyiHC4EO90ZptVDjfrbZ9rsbDNWHVZlLjoU+jk9aGOrkAzp7gwBMlL4RfNoc1S6yvMpaCqbIbYz9ZPIj8y9H3bn+3TU41wt1t7KcU0uc2wWw==" e="AQAB" />
  </issuer-signing-keys>
  <audiences>
      <audience>acmeApi1</audience>
  </audiences>

## rate-limiting-policy.xml
<rate-limit-by-key calls="1" renewal-period="60" counter-key="@{
        String token = ((String)context.Request.Headers.GetValueOrDefault("Authorization", "")).Split(' ')[1];
        String nonce = (string)JObject.Parse(Encoding.UTF8.GetString(Convert.FromBase64String(token.Split('.')[0])))["nonce"];
        String sub = ((Jwt)context.Variables["securityToken"]).Claims.GetValueOrDefault("sub", "");
        return sub + nonce;
    }" increment-condition="@(true)" />

## aws2azure_iampolicy.json
  {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:eu-west-1:<account_number>:<api_id>/*/GET/token/https://graph.microsoft.com/.default"
  }
	1GB 768MB 512MB
	5.15 secs 7.52 secs 8.90 secs
	7.06 secs 7.52 secs 8.94 secs
	7.06 secs 7.53 secs 8.95 secs
	7.06 secs 7.67 secs 9.38 secs
	7.06 secs 7.67 secs 9.41 secs
	7.07 secs 7.72 secs 9.43 secs
	7.12 secs 8.27 secs 10.31 secs
	7.18 secs 8.39 secs 10.41 secs
	7.19 secs 8.50 secs 10.61 secs
	<< body of BRFv4_JS_trial.js>>

	var brfv4 = null;
	var brfManager = null;

	function waitForSDK() {
	if (brfv4 === null) {
	brfv4 = {
	locateFile: function () {
	return "BRFv4_JS_trial.js.mem";
	{
	"alg": "RS256",
	"typ": "JWT",
	"nonce": ""
	}.{
	"sub": "9881ce0f-6461-eb11-a812-000d3ad5cb5a",
	"preferred_username": "9a5b39cb-529c-4656-a806-a9556f0aa2e9",
	"phone_number": "",
	"given_name": "John",
	"family_name": "Smith",
	Key	Value
	ImplicitGrantFlow/RegisteredClientId	acmeApi1;acmeApi2
	ImplicitGrantFlow/acmeApi1/RedirectUri	https://acme.powerappsportals.com/
	ImplicitGrantFlow/acmeApi2/RedirectUri	https://acme.powerappsportals.com/
	<validate-jwt header-name="Authorization"
	failed-validation-httpcode="401"
	require-scheme="Bearer"
	output-token-variable-name="securityToken">
	<issuer-signing-keys>
	:public_key_goes_here:
	</issuer-signing-keys>
	<audiences>
	<audience>acmeApi1</audience>
	</audiences>
	# Ensure the libraries below
	# pip install cryptography
	# pip install pycrypto
	from Crypto.PublicKey import RSA
	import base64
	from binascii import unhexlify
	import sys

	def long_to_bytes (val):
	"""
	<rate-limit-by-key calls="1" renewal-period="60" counter-key="@{
	String token = ((String)context.Request.Headers.GetValueOrDefault("Authorization", "")).Split(' ')[1];
	String nonce = (string)JObject.Parse(Encoding.UTF8.GetString(Convert.FromBase64String(token.Split('.')[0])))["nonce"];
	String sub = ((Jwt)context.Variables["securityToken"]).Claims.GetValueOrDefault("sub", "");
	return sub + nonce;
	}" increment-condition="@(true)" />
	{
	"Effect": "Allow",
	"Principal": "*",
	"Action": "execute-api:Invoke",
	"Resource": "arn:aws:execute-api:eu-west-1:<account_number>:<api_id>/*/GET/token/https://graph.microsoft.com/.default"
	}