swelham / ueberauth_microsoft

Microsoft Strategy for Überauth

Überauth Microsoft

Microsoft OAuth2 strategy for Überauth.

Quick start blog post: Authenticating users with Microsoft OAuth

Installation

1. Register an application in the Azure Portal (see Microsoft tutorial for more info).

2. Add :ueberauth_microsoft to your list of dependencies in mix.exs:

   def deps do
     [
       {:ueberauth_microsoft, "~> 0.23"}
     ]
   end

3. Add the strategy to your applications:

   def application do
     [
       applications: [:ueberauth_microsoft]
     ]
   end

4. Add Microsoft to your Überauth configuration:

   config :ueberauth, Ueberauth,
     providers: [
       microsoft: {Ueberauth.Strategy.Microsoft, []}
     ]

5. Update your provider configuration:

   config :ueberauth, Ueberauth.Strategy.Microsoft.OAuth,
     client_id: System.get_env("MICROSOFT_CLIENT_ID"),
     client_secret: System.get_env("MICROSOFT_CLIENT_SECRET")

6. Include the Überauth plug in your controller:

   defmodule MyApp.AuthController do
     use MyApp.Web, :controller
     plug Ueberauth
     ...
   end

7. Create the request and callback routes if you haven't already:

   scope "/auth", MyApp do
     pipe_through :browser
   
     get "/:provider", AuthController, :request
     get "/:provider/callback", AuthController, :callback
   end

8. Your controller needs to implement callbacks to deal with Ueberauth.Auth and Ueberauth.Failure responses.

For an example implementation see the Überauth Example application.

Single Tenancy

If you are going to use your app only internally you may need to configure it for a single tenant. To do so you only need to add tenant_id to your provider configuration like:

config :ueberauth, Ueberauth.Strategy.Microsoft.OAuth,
  tenant_id: System.get_env("MICROSOFT_TENANT_ID"),
  client_id: System.get_env("MICROSOFT_CLIENT_ID"),
  client_secret: System.get_env("MICROSOFT_CLIENT_SECRET")

Calling

Depending on the configured url you can initial the request through:

/auth/microsoft

By default the scopes used are:

• openid
• email
• offline_access
• https://graph.microsoft.com/user.read

Note: at least one service scope is required in order for a token to be returned by the Microsoft endpoint

You can configure additional scopes to be used by passing the extra_scopes option into the provider:

config :ueberauth, Ueberauth,
  providers: [
    microsoft: {
      Ueberauth.Strategy.Microsoft,
      [extra_scopes: "https://graph.microsoft.com/calendars.read"]
    }
  ]

If you would like users to have the option to choose an alternate account to authenticate with instead of defaulting to the logged in account, you may pass the prompt option in to the provider (per Microsoft documentation):

config :ueberauth, Ueberauth,
  providers: [
    microsoft: {Ueberauth.Strategy.Microsoft, [prompt: "select_account"]}
  ]

Copyright and License

Copyright (c) 2017 Stuart Welham

Released under the MIT License, which can be found in the repository in LICENSE.

ueberauth_microsoft's Issues

SSL failure on OTP 26

The provided ssl_options to the OAuth client request opts cause an SSL failure as the default voor :verify is now :verify_peer, but no certificates are provided.

Solution is to remove the ssl_options altogether which causes the system default to be used, I think this is safe anyway since TLS 1.3 is preferred over 1.2. Will create a PR.

CSRF not implemented

#25 updated the ueberauth to version 0.7, which requires strategies to prevent CSRF attacks.

Because the library was simply updated, and no protection added, every attempt to sign in results in an error. I would therefore recommend retiring the version 0.11.0.

Authorize and token url on dynamic tenant_id

Hi,
when use dynamic config, the authorize and token url must be setted, because the tenant_id variable is only readed from env config

ueberauth_microsoft/lib/ueberauth/strategy/microsoft/oauth.ex

Line 45 in dd84b84

defp defaults(config) do

` defp defaults(config) do
tenant_id = config[:tenant_id] || "common"

[
  strategy: __MODULE__,
  site: "https://graph.microsoft.com",
  authorize_url: "https://login.microsoftonline.com/#{tenant_id}/oauth2/v2.0/authorize",
  token_url: "https://login.microsoftonline.com/#{tenant_id}/oauth2/v2.0/token",
  request_opts: [ssl_options: [versions: [:"tlsv1.2"]]]
]

end`

Single callback_url for multiple tenants / subdomain

Could you please add a global option for a single redirect_uri for multi tenant with subdomains ?

Ueberauth Strategy for Google has this similar feature.

config.exs

config :ueberauth, Ueberauth,
  providers: [
    ...
    microsoft: {Ueberauth.Strategy.Microsoft, [
      callback_url: "https://subdomain.example.com/auth/microsoft/callback"
    ]},
  ]

Thanks.

Client side callback validations

I have been implementing my own ueberauth strategy for Azure Active Directory and only noticed this one as it was nearing completion. I have had a quick look at your code and can't see the callback validations? I would expect there to at least be a check for the nonce. The openid specification expects validations for the following:

• aud
• iss
• nbf
• iat
• exp
• nonce

Are you using a protocol that doesn't need these validations? Or are the developers using this library expected to do these validations to allow for more flexibility?

Implement logout

As far as I see, there is no logout implemented. Or did I missed something?

https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-web-app-sign-user-sign-in?tabs=aspnetcore#sign-out

Not parsing token properly?

I'm having an odd issue with the fetch_user/2 portion of the app. It seems like I get my OAuth2 tokens just fine, but when trying to fetch the user data from https://graph.microsoft.com/v1.0/me, it's trying to pass a JSON representation of the token instead of the token itself. Turning on OAuth2's debug logging, I'm getting something like this:

[debug]   OAuth2 Provider Request
  url: "https://graph.microsoft.com/v1.0/me/"
  method: :get
  headers: [{"accept", "application/json"}, {"authorization", "Bearer {\"token_type\":\"Bearer\",\"scope\":\"email openid profile https://graph.microsoft.com/Calendars.Read https://graph.microsoft.com/User.Read\",\"expires_in\":3599,\"ext_expires_in\":3599,\"access_token\":\"eyJ0eXAiOiJKV1QiLCJub25jZSI6Ik02N...\", \"refresh_token\":\"OAQABAAAAAAAP0wLl...\", \"id_token\": "eyJ0eXAiO..."}]
  body: ""
  req_opts: [ssl_options: [versions: [:"tlsv1.2"]]]

This results in an error from the MS Graph API along the lines of CompactToken parsing failed with error code: 80049217

If I extract the "access_token" string from this JSON and manually pass it as a bearer token via CURL, everything works, so I know the token is valid.

What's perplexing to me is why is that "Bearer" in the OAuth2.Client.get (in ueberauth/strategy/microsoft.ex#105) passing an whole stringified-JSON instead of just the plain ASCII access token?

It seems "show stopping" enough that I'm wondering if I have some odd configuration causing this issues, but it seems like a pretty simple setup so I'm not sure what I could have done wrong.

Appreciate any advice.

Merge extra scopes with default scopes

Hi,
I previously submitted a PR which contains a flaw where the given :extra_scopes is not merged with default scopes. Sorry about that 😕

I have submitted a new PR #36 which fixes this issue (and also bumps a patch version).