Hop til hovedindhold
Document status35 - Reviewed

Domain Routing and Authentication

This document describes the Azure Front Door endpoint configuration and Entra ID (Azure AD) redirect URIs for the EnergyConnect platform.

Overview​

EnergyConnect uses Azure Front Door as a global load balancer and CDN to route traffic to the appropriate backend services. Each customer/environment combination has dedicated Front Door endpoints to ensure complete isolation between:

  • Client Application - Angular SPA for the main EnergyConnect UI
  • Documentation Application - React Docusaurus-based documentation site (where enabled)

Both applications use MSAL (Microsoft Authentication Library) for client-side authentication against a shared Entra ID App Registration.

Front Door Endpoints​

Naming Convention​

ServiceEndpoint Name Pattern
Clientec-{customer}-{environment}-fde
Docsec-{customer}-{environment}-docs-fde

Front Door Architecture​

Key Design Decisions​

  1. Separate Endpoints - Client and Docs have separate Front Door endpoints to ensure complete isolation. This prevents deployment of one service from affecting the other.

  2. Separate Origin Groups - Each service has its own origin group ({customer}-{environment}-origin-group vs {customer}-{environment}-docs-origin-group).

  3. Separate Routes - Each custom domain is routed to its specific origin group via a dedicated route.

Entra ID App Registration​

Both the Client and Documentation applications share a single Entra ID App Registration per customer/environment. This allows users to have consistent roles and permissions across both applications.

App Registration Naming​

{ENVIRONMENT}.{CUSTOMER}.EnergyConnect.3.0.Client.Auth

SPA Redirect URIs​

The App Registration is configured with SPA (Single Page Application) redirect URIs for MSAL authentication.

Authentication Flow​

  1. User accesses the application via the custom domain
  2. Front Door routes the request to the appropriate Container App
  3. If not authenticated, MSAL redirects to Entra ID login
  4. After successful login, Entra ID redirects back to /auth with an authorization code
  5. MSAL exchanges the code for tokens and stores them in session storage

Required App Role(s)​

To access the Documentation application the users must have the app role MeteringPointReader assigned via Entra ID Groups. This role as can be granted through membership of any of the 4 Application Entra ID groups.

To access the Client application, the endpoints of the application requires various roles. 9 Different app roles exist and controls user access in the client application.