Manual set up of DotAlign on Azure

Updated 2 months ago by Jaspreet Bakshi

Typically, the DotAlign solution is deployed via a PowerShell based deployment script provided by DotAlign, Inc. However, in situations where the resources are not deployed using the DotAlign deployment script, the following permissions and settings, and other components need to be considered get the solution up an running.

Authentication and authorization

Azure AD and app registration

For Azure based deployments, DotAlign uses Azure AD for authentication and authorization. Users are forwarded to their firm's Azure AD instance (which may further include additional identity management platforms), and when authenticated, they are redirected back to DotAlign.

To support this, an app registration needs to be created inside your Azure tenant, and granted the following MS Graph permissions.

For user sign-in

For web app functionality

For background processing

Admin group

Inside DotAlign, one (or more) Azure AD security group(s) must be designated as the "Admin group". Doing this gives the group's members an application level administrative role inside DotAlign, allowing them to perform tasks like setting up teams and adding members etc. This group is specified by adding its GUID to an application setting on the web app. To be clear, membership in this group does not grant any additional rights outside of the DotAlign solution.

The setting that is can be used to specify the admin group is "AzureAd:DotAlignAdminGroupIds:0" and its value must be the GUID of the group in Azure AD.

Redirect URI

To enable interactive authentication, a redirect URI needs to be specified within the app registration. This can be done by going to the "Authentication" section of the app registration and clicking on the "Add a platform" button. Then choose "Single-page application" as your platform, and add the following URI in the space provided.

https://<BASE_URI>/aad-auth

Access via managed identity

The following permissions need to be applied only in the case where the web app and function app are using managed identity to connect to the database and storage account.

Database access

The web and function apps communicate with the database using their managed identities. This is done by creating an Azure AD group that has the managed identities of the web app and the function app, as members. Then that Azure AD group is granted admin rights to the DotAlign database.

Storage account access

The web app and function app also need to be granted access to a designated storage account. This is used for several features (like uploading data) by the web app and also as a part of the function app infrastructure.

To enable this, the following permissions need to be granted to both the web app and the function app.

1. Contributor Role
2. Storage Blob Data Owner
3. Storage Queue Data Contributor

Settings

Beside permissions related to database and the storage account, there are also certain settings/configuration that are required for the solution to work as expected.

Settings for both the web app (Falcon) and the function app (Gator)

The following settings need to be applied to both Falcon and Gator.

Function app (Gator) only settings

In addition to the settings that are applicable for both Falcon and Gator there are a handful of additional settings that need to be applied to just Gator.

How Did We Do?

Related Articles

• Set up DotAlign for Outlook
• DotAlign Cloud IT Administrator FAQs
• Network security