Skip to content

v3.5.1

Choose a tag to compare

View all tags
@placerda placerda released this 15 Jul 17:21
v3.5.1
1b7a879

What's new

Admin dashboard sign-in with Microsoft Entra ID.

The orchestrator dashboard at /dashboard/ can now require MSAL sign-in and the exact Entra app role Admin before dashboard APIs return administrative data. This closes the prior gap where the dashboard authorization model expected bearer tokens but the SPA had no built-in sign-in flow.

Existing deployments are unchanged unless dashboard authentication is enabled with App Configuration.

Configuration

Set these keys under the gpt-rag-orchestrator label:

  • ENABLE_DASHBOARD=true
  • OAUTH_AZURE_AD_TENANT_ID=<tenant-id>
  • OAUTH_AZURE_AD_CLIENT_ID=<single-app-registration-client-id>
  • OAUTH_AZURE_AD_API_SCOPE=api://<client-id>/access_as_user (optional, this is the default)

Use one App Registration as both the dashboard SPA and orchestrator API. Define the app role value as exactly Admin under App registrations > app > App roles, then assign users under Enterprise applications > app > Users and groups.

Fixed

  • Dashboard API authorization now validates the orchestrator API audience and enforces the verified roles claim.
  • Partial Entra configuration fails closed instead of silently skipping audience validation.
  • Malformed role claims are rejected.
  • The dashboard SPA now obtains API-scoped MSAL tokens, sends them as bearer tokens, and distinguishes reauthentication (401) from missing Admin role (403).
  • Sign-in, sign-out, account switching, loading, error, and accessible alert states were added to the dashboard SPA.

Documentation

  • README now documents the single App Registration model, Admin role definition and assignment, token scope behavior, Assignment required? = No for app-level 403 validation, and the need to sign out/in after app role changes.
  • .azure/deployment-plan.md captures the prepared Azure validation plan and notes that the previous rg-gptrag-546val validation resource group no longer exists.

Validation

  • PR #260 checks passed.
  • Focused dashboard tests: 32 passed.
  • Full test suite before release preparation: 297 passed.
  • Frontend ESLint and Vite/TypeScript build passed.

Follow-up

Live tenant validation still needs a recreated or selected GPT-RAG validation environment, because the previous rg-gptrag-546val resource group is no longer present in the target subscription.

Assets 2
Loading