[Python] Azure Function App using python: how to get the principal name and ID information

I have set up the identity provider for my Function App. When I access the function URL:

https://myfunc-dev-we-01.azurewebsites.net/api/http_trigger

it correctly redirects me to the Microsoft authentication page, and authentication works fine.

However, my goal is to retrieve the authenticated user's email. I attempted to extract it using the X-MS-CLIENT-PRINCIPAL header, but I’m unable to get it to work.

Here’s my current Function App code:

import azure.functions as func
import logging
import base64
import json

app = func.FunctionApp(http_auth_level=func.AuthLevel.ANONYMOUS)

@app.route(route="http_trigger")
def http_trigger(req: func.HttpRequest) -> func.HttpResponse:
logging.info('Python HTTP trigger function processed a request.')

# Retrieve the X-MS-CLIENT-PRINCIPAL header
client_principal_header = req.headers.get('X-MS-CLIENT-PRINCIPAL')
logging.info(f"X-MS-CLIENT-PRINCIPAL header: {client_principal_header}")
user_name = None

if client_principal_header:
try:
# Decode the Base64-encoded header
decoded_header = base64.b64decode(client_principal_header).decode('utf-8')
logging.info(f"Decoded X-MS-CLIENT-PRINCIPAL: {decoded_header}")
client_principal = json.loads(decoded_header)

# Log the entire client principal for debugging
logging.info(f"Client Principal: {client_principal}")

# Extract the user's name from the claims
user_name = client_principal.get('userPrincipalName') or client_principal.get('name')
except Exception as e:
logging.error(f"Error decoding client principal: {e}")

if user_name:
return func.HttpResponse(f"Hello, {user_name}. This HTTP triggered function executed successfully.")
else:
return func.HttpResponse(
"This HTTP triggered function executed successfully. However, no authenticated user information was found.",
status_code=200
)


Issue:

I keep getting the response:

"This HTTP triggered function executed successfully. However, no authenticated user information was found."

What am I missing?

Do I need to configure additional settings in Azure AD authentication for the email claim to be included?

Is there another way to retrieve the authenticated user’s email?

Continue reading...