Skip to content

Commit e16b07b

Browse files
benhovingarobinesThangHuuVu
authored
fix(providers): Microsoft Entra ID (#12616)
* Add Microsoft Entra ID to OAuth providers list * Add Microsoft Entra ID to Issue Template providers dropdown * Fix MicrosoftEntraIDProfile to include all id_token claims and optional claims * Fix MicrosoftEntraID TSDoc Clarified the usage of issuer parameter * Fix Microsoft Entra ID documentation * Fix unset issuer overriding environment variable * Add example of environment variables * Fix typo in microsoft-entra-id.mdx Co-authored-by: Robin <16273164+robines@users.noreply.github.com> * Only return default profile --------- Co-authored-by: Robin <16273164+robines@users.noreply.github.com> Co-authored-by: Thang Vu <hi@thvu.dev>
1 parent 63d90a0 commit e16b07b

File tree

4 files changed

+461
-74
lines changed

4 files changed

+461
-74
lines changed

‎.github/ISSUE_TEMPLATE/2_bug_provider.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ body:
7171
- "Mail.ru"
7272
- "Mastodon"
7373
- "Medium"
74+
- "Microsoft Entra ID"
7475
- "Naver"
7576
- "Netlify"
7677
- "NetSuite"

‎docs/pages/data/manifest.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@
9292
"mastodon": "Mastodon",
9393
"mattermost": "Mattermost",
9494
"medium": "Medium",
95+
"microsoft-entra-id": "Microsoft Entra ID",
9596
"naver": "Naver",
9697
"netlify": "Netlify",
9798
"notion": "Notion",
@@ -147,6 +148,7 @@
147148
"logto",
148149
"mastodon",
149150
"mattermost",
151+
"microsoft-entra-id",
150152
"nextcloud",
151153
"okta",
152154
"ory-hydra",

‎docs/pages/getting-started/providers/microsoft-entra-id.mdx

Lines changed: 78 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,13 @@ https://example.com/auth/callback/microsoft-entra-id
4747
```
4848

4949
</Code.Svelte>
50+
<Code.Express>
51+
52+
```bash
53+
https://example.com/auth/callback/microsoft-entra-id
54+
```
55+
56+
</Code.Express>
5057
</Code>
5158

5259
### Environment Variables
@@ -57,6 +64,48 @@ AUTH_MICROSOFT_ENTRA_ID_SECRET
5764
AUTH_MICROSOFT_ENTRA_ID_ISSUER
5865
```
5966

67+
### Register Application
68+
69+
1. Log in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
70+
71+
2. In the left sidebar, navigate to Identity --> Applications --> App
72+
Registrations.
73+
74+
3. Click on New registration.
75+
76+
4. Give your application a name. This name will be displayed to the user when
77+
they log in.
78+
79+
5. Select the account types you want to allow to log in. The
80+
`AUTH_MICROSOFT_ENTRA_ID_ISSUER` variable will be based on the selection you
81+
make here.
82+
83+
- **Single tenant only** - Only allow users from your organization.<br />
84+
`https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0`
85+
86+
- **Multi-tenant** - Allow users from any organization.<br />
87+
`https://login.microsoftonline.com/organizations/v2.0`
88+
89+
- **Multi-tenant + Personal** - Allow any Microsoft account (work, school,
90+
personal).<br />
91+
`https://login.microsoftonline.com/common/v2.0`
92+
93+
- **Personal Only** - Only allow personal Microsoft accounts.<br />
94+
`https://login.microsoftonline.com/consumers/v2.0`
95+
96+
6. Set the Redirect URI platform to `web` and the Callback URI for your
97+
application. When developing you will set this to your local host
98+
environment
99+
(example `http://localhost:3000/api/auth/callback/microsoft-entra-id`).
100+
101+
7. From the application overview page copy the **Application (client) ID** and
102+
paste it in the `AUTH_MICROSOFT_ENTRA_ID_ID` variable.
103+
104+
8. Navigate to Certificates & secrets and create a new client secret.
105+
106+
9. Copy the secret value (this will be hidden when you leave this page) and
107+
paste it in the `AUTH_MICROSOFT_ENTRA_ID_SECRET` variable.
108+
60109
### Configuration
61110

62111
<Code>
@@ -82,12 +131,12 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
82131

83132
```ts filename="/src/routes/plugin@auth.ts"
84133
import { QwikAuth$ } from "@auth/qwik"
85-
import Entra from "@auth/qwik/providers/microsoft-entra-id"
134+
import MicrosoftEntraID from "@auth/qwik/providers/microsoft-entra-id"
86135

87136
export const { onRequest, useSession, useSignIn, useSignOut } = QwikAuth$(
88137
() => ({
89138
providers: [
90-
Entra({
139+
MicrosoftEntraID({
91140
clientId: import.meta.env.AUTH_MICROSOFT_ENTRA_ID_ID,
92141
clientSecret: import.meta.env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
93142
issuer: import.meta.env.AUTH_MICROSOFT_ENTRA_ID_ISSUER,
@@ -102,15 +151,19 @@ export const { onRequest, useSession, useSignIn, useSignOut } = QwikAuth$(
102151

103152
```ts filename="/src/auth.ts"
104153
import { SvelteKitAuth } from "@auth/sveltekit"
105-
import Entra from "@auth/sveltekit/providers/microsoft-entra-id"
106-
import { env } from "$env/dynamic/private"
154+
import MicrosoftEntraID from "@auth/sveltekit/providers/microsoft-entra-id"
155+
import {
156+
AUTH_MICROSOFT_ENTRA_ID_ID,
157+
AUTH_MICROSOFT_ENTRA_ID_SECRET,
158+
AUTH_MICROSOFT_ENTRA_ID_ISSUER,
159+
} from "$env/static/private"
107160

108161
export const { handle, signIn, signOut } = SvelteKitAuth({
109162
providers: [
110-
Entra({
111-
clientId: env.AUTH_MICROSOFT_ENTRA_ID_ID,
112-
clientSecret: env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
113-
issuer: process.env.AUTH_MICROSOFT_ENTRA_ID_ISSUER,
163+
MicrosoftEntraID({
164+
clientId: AUTH_MICROSOFT_ENTRA_ID_ID,
165+
clientSecret: AUTH_MICROSOFT_ENTRA_ID_SECRET,
166+
issuer: AUTH_MICROSOFT_ENTRA_ID_ISSUER,
114167
}),
115168
],
116169
})
@@ -121,13 +174,13 @@ export const { handle, signIn, signOut } = SvelteKitAuth({
121174

122175
```ts filename="/src/app.ts"
123176
import { ExpressAuth } from "@auth/express"
124-
import Entra from "@auth/express/providers/microsoft-entra-id"
177+
import MicrosoftEntraID from "@auth/express/providers/microsoft-entra-id"
125178

126179
app.use(
127180
"/auth/*",
128181
ExpressAuth({
129182
providers: [
130-
Entra({
183+
MicrosoftEntraID({
131184
clientId: process.env.AUTH_MICROSOFT_ENTRA_ID_ID,
132185
clientSecret: process.env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
133186
issuer: process.env.AUTH_MICROSOFT_ENTRA_ID_ISSUER,
@@ -140,30 +193,21 @@ app.use(
140193
</Code.Express>
141194
</Code>
142195

143-
### Notes
144-
145-
1. Allow only Specific Active Directory Users
146-
147-
- In https://entra.microsoft.com/ select Identity from the left bar menu.
148-
- Next, go to "App Registration" in the left menu, and create a new one.
149-
- Pay close attention to "Who can use this application or access this API?"
150-
- This allows you to scope access to specific types of user accounts
151-
- Only your tenant, all Microsoft tenants, or all Microsoft tenants and public Microsoft accounts (Skype, Xbox, Outlook.com, etc.)
152-
- When asked for a redirection URL, use `https://yourapplication.com/api/auth/callback/microsoft-entra-id` or for development `http://localhost:3000/api/auth/callback/microsoft-entra-id`.
153-
- After your App Registration is created, under "Client Credential" create your Client secret.
154-
- Now copy your:
155-
- Application (client) ID
156-
- Client secret (value)
157-
- Issuer
158-
159-
In `.env.local` create the following entries:
160-
161-
```
162-
AUTH_MICROSOFT_ENTRA_ID_ID=<copy Application (client) ID here>
163-
AUTH_MICROSOFT_ENTRA_ID_SECRET=<copy generated client secret value here>
164-
AUTH_MICROSOFT_ENTRA_ID_ISSUER=https://login.microsoftonline.com/<copy the issuer here>/v2.0
196+
```env filename=".env.local"
197+
AUTH_MICROSOFT_ENTRA_ID_ID="<Application (client) ID>"
198+
AUTH_MICROSOFT_ENTRA_ID_SECRET="<Client secret value>"
199+
AUTH_MICROSOFT_ENTRA_ID_ISSUER="https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0"
165200
```
166201

167-
That will default the tenant to use the `common` authorization endpoint. [For more details see here](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols#endpoints).
202+
## Notes
203+
204+
- If the issuer paramater is not set it will default to
205+
`https://login.microsoftonline.com/common/v2.0`.
168206

169-
- Microsoft Entra returns the profile picture in an ArrayBuffer, instead of just a URL to the image, so our provider converts it to a base64 encoded image string and returns that instead. See: https://learn.microsoft.com/en-us/graph/api/profilephoto-get?view=graph-rest-1.0&tabs=http#examples. The default image size is 48x48 to avoid [running out of space](https://next-auth.js.org/faq#:~:text=What%20are%20the%20disadvantages%20of%20JSON%20Web%20Tokens%3F) in case the session is saved as a JWT.
207+
- Microsoft Entra returns the profile picture in an ArrayBuffer, instead of
208+
just a URL to the image, so our provider converts it to a base64 encoded
209+
image string and returns that instead. See
210+
[Microsoft Graph profilePhoto](https://learn.microsoft.com/en-us/graph/api/profilephoto-get?view=graph-rest-1.0&tabs=http#examples).
211+
The default image size is 48x48 to avoid
212+
[running out of space](https://next-auth.js.org/faq#json-web-tokens) in case
213+
the session is saved as a JWT.

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy