How can I add Azure AD as auth provider in docker environment #85

pthoelken · 2023-09-12T13:42:42Z

Hello Contributors,

how can I add Azure AD (https://docs.yaade.io/users-groups.html#azuread) in my running docker environment as auth provider? It's possible for you to give me a exact path and config file / snippet to configure this auth provider?

Thanks.

jonrosner · 2023-09-12T17:53:52Z

You have to go to ⚙️ > Users > External. Inside the editor paste a config of the following form:

{
    "providers": [{
        "id": "azure-oauth",
        "label": "Azure SSO Login",
        "provider": "azureAD",
        "params": {
            "tenant": "your-tenant-id",
            "clientId": "your-client-id",
            "clientSecret": "your-client-secret",
            "callbackUrl": "your-domain/azure-oauth",
            "fields": {
                "username": "/email",
                "groups": "/groups",
                "defaultGroups": ["some-group"]
            },
            "scopes": ["openid"]
        }
    }]
}

You can get the tenant ID, client ID and client secret from Azure.

Note: if you do not see an editor in that tab, please update Yaade. I just published a bugfix that fixed a previous version not displaying this editor.

docker rm -f yaade
docker pull esperotech/yaade:latest
docker run -d --restart=always -p 9339:9339 \
    -e YAADE_ADMIN_USERNAME=admin -v yaade:/app/data \
    --name yaade esperotech/yaade:latest

pthoelken · 2023-09-18T07:02:03Z

Thanks, I'll check this today. Can you maybe update the base image because trivy found some critical vulnerbilities in there.

jonrosner · 2023-09-18T07:14:10Z

Thank you for pointing this out.

pthoelken · 2023-09-18T07:48:38Z

It works like charm. Thanks for your assistance in this case. But how the users can work in a same team. Like the example below:

All login via MS Azure Auth
Peter and John should work in "Team Backend"
Adam and Will should work in "Team Frontend"

Option 1 is, that the admins create the teams and add the users to the team.
Option 2 is (better option), the first user and creator of a team can add other members to their team (like hoppscotch).

Team Backend should not see the content from Team Frontend of course.

Is there a option or is this a feature request?

jonrosner · 2023-09-18T09:28:49Z

It should be possible to configure your groups in Active Directory. You can add your users to a specific group (e.g. "Team Backend", "Team Frontend"). https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-group-claims

Now what you need to do is configure your tokens in a way that they include the groups in the /groups field (see this line in the config "groups": "/groups",)

Now all users that belong to a group in AD will automatically have that group assigned in yaade as well.

Does that solve your problem?

pthoelken · 2023-09-18T09:44:18Z

Nice, do you have an config example for me, when I have more than two groups and a default group?

{
    "providers": [{
        "id": "azure-oauth",
        "label": "Azure SSO Login",
        "provider": "azureAD",
        "params": {
            "tenant": "your-tenant-id",
            "clientId": "your-client-id",
            "clientSecret": "your-client-secret",
            "callbackUrl": "your-domain/azure-oauth",
            "fields": {
                "username": "/email",
                "groups": "/groups/Team-Backend","/groups/Team-Frondend",
                "defaultGroups": ["default"]
            },
            "scopes": ["openid"]
        }
    }]
}

check the configuration above, is this right?

pthoelken · 2023-09-18T10:16:44Z

and @jonrosner as I know I can't create sub-groups in azureAD so how should the application fetch sub groups by the instruction which you told to me?

Thanks for your assistance. :-)

jonrosner · 2023-09-18T11:07:51Z

hey, the groups field should stay the same as I posted earlier "groups": "/groups". You will have to create and assign the proper groups in azure AD and you have to configure azure to put the groups into the /groups field in the JWT (id-token).

There is currently no way to configure specific external users in Yaade itself, so you will have to do it via Azure for now.

pthoelken · 2023-09-18T11:41:30Z

Hey @jonrosner we do this exactly like you describe but when I'm logged in with a new session and fresh cleared browser the group wasn't show up.

What we do in azures was this below:

We created groups (Team A, Team B)
We're added the groups to the auth app
We're configured the token like the /groups/groupname was imported to the token
We're added my user to the "Team A" Group
After restart of containers and browser cache clear, the groups doesn't shows up

"Default" comes from the configuration snippet.

jonrosner · 2023-09-19T13:17:45Z

Please check the JWT token and make sure that the groups are actually put into the correct field that you configured using the "groups" property. If possible you could post that part of the JWT.

pthoelken · 2023-09-19T14:41:19Z

Hey @jonrosner , may you have a reliable way to debug the token? How do you debug the jwt azure token?

jonrosner · 2023-09-19T15:13:31Z

you can do this via Yaade and your browser directly.

in your browser open a new tab and open the developer console (cmd+shift+c for chrome)
go to the network tab in developer console
now open the URL https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize?client_id=${client_id}&client_secret=${client_secret}&response_type=code&redirect_uri=${redirect_uri}&scope=${scope}&state=${state} where you replace all the variables with the respective values that you configured in yaade in the external provider tab. As state you can just put in 123456, scope must be openid.
now you should be prompted to log into your Microsoft account. Do that and upon successful login you will be redirected back to yaade.
The callback to yaade will probably fail, that's fine. The important thing is to extract the URL to where the call was made from the network tab. In the query parameters of this call there should be ?code=XXXX parameter. You need to copy this. Make sure to copy it correctly and do not have any other params in there.
Now open yaade as you would normally, create a new request that has the following form:

POST https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id=${client_id}
&client_secret=${client_secret}
&code=${code}
&redirect_uri=${redirect_uri}
&grant_type=authorization_code

Again set all the environment variables correctly to the things you defined in your external providers config. Also set the code to the value you copied earlier.
Now execute the request and you should receive a response of the following form

{
    "token_type": "Bearer",
    "scope": "profile openid email User.Read",
    "expires_in": 5288,
    "ext_expires_in": 5288,
    "access_token": "ey....",
    "id_token": "ey....
}

Copy the ID token into jwt.io to inspect it's content.

Unfortunately, I don't know an easier way to obtain the same access token that yaade would receive...

pthoelken · 2023-09-19T15:19:36Z

Thanks @jonrosner, can you told me, is this the right permissions for the application?

pthoelken · 2023-09-19T15:28:46Z

I think there is "openid" missing, right?

pthoelken · 2023-09-19T15:30:15Z

I will evaluate this tomorrow in the azure AD and the jwt token.

pthoelken · 2023-09-21T06:14:24Z

@jonrosner we're add also "openid" in the permissions tab but still not works for us. Maybe the migration to Entra Azure is a cause for this?

For your informations, this is my jwt azure token:

===========================================================================================
= Decoded JWT Azure AD Token
===========================================================================================

{
    "aud": "https://graph.microsoft.com",
    "iss": "https://sts.windows.net/XXXXXXXXXXXXXXXXXXX/",
    "iat": XXXXXXXXXXXXXXXXXXX,
    "nbf": XXXXXXXXXXXXXXXXXXX,
    "exp": XXXXXXXXXXXXXXXXXXX,
    "aio": "XXXXXXXXXXXXXXXXXXX",
    "app_displayname": "yaade",
    "appid": "XXXXXXXXXXXXXXXXXXX",
    "appidacr": "1",
    "idp": "https://sts.windows.net/XXXXXXXXXXXXXXXXXXX/",
    "idtyp": "app",
    "oid": "XXXXXXXXXXXXXXXXXXX",
    "rh": "XXXXXXXXXXXXXXXXXXX",
    "roles": [
        "User.Read.All"
    ],
    "sub": "XXXXXXXXXXXXXXXXXXX",
    "tenant_region_scope": "EU",
    "tid": "XXXXXXXXXXXXXXXXXXX",
    "uti": "XXXXXXXXXXXXXXXXXXX",
    "ver": "1.0",
    "wids": [
        "XXXXXXXXXXXXXXXXXXX"
    ],
    "xms_tcdt": XXXXXXXXXXXXXXXXXXX,
    "xms_tdbr": "EU"
}

===========================================================================================
= End of decoded JWT Azure AD Token
===========================================================================================

jonrosner · 2023-09-21T06:45:16Z

Unfortunately I don't know the exact working of Azure AD. But basically the solution to your problem is that you need to get your groups claims into this token somehow.

One thing that I see is that your claim is optional. This probably means that in your client that issues those yaade tokens you need to somehow make it required.

jonrosner · 2023-12-03T22:08:08Z

Closed due to inactivity.

tknisch · 2024-10-15T12:34:32Z

Hi,

we are also facing an issue when trying to configure Yaade with EntraID / AzureAD.

The id_token looks like this:

{
  "aud": "XXXXXXXXXXXXXXXXXXX",
  "iss": "https://login.microsoftonline.com/XXXXXXXXXXXXXXXXXXX/v2.0",
  "iat": 1728994999,
  "nbf": 1728994999,
  "exp": 1728998899,
  "email": "XXXXXXXXXXXXXXXXXXX",
  "groups": [
    "XXXXXXXXXXXXXXXXXXX"
  ],
  "idp": "https://sts.windows.net/XXXXXXXXXXXXXXXXXXX/",
  "login_hint": "XXXXXXXXXXXXXXXXXXX",
  "name": "XXXXXXXXXXXXXXXXXXX",
  "oid": "XXXXXXXXXXXXXXXXXXX",
  "preferred_username": "XXXXXXXXXXXXXXXXXXX",
  "rh": "XXXXXXXXXXXXXXXXXXX",
  "roles": [
    "admin"
  ],
  "sub": "XXXXXXXXXXXXXXXXXXX",
  "tid": "XXXXXXXXXXXXXXXXXXX",
  "uti": "XXXXXXXXXXXXXXXXXXX",
  "ver": "2.0"
}

We want to use the roles Array as Groups. But if we configure it with the following configuration:

{
    "providers": [{
        "id": "entra",
        "label": "Login with Entra",
        "provider": "azureAD",
        "params": {
            "tenant": "XXXXXXXXXXXXXXXXXXX",
            "clientId": "XXXXXXXXXXXXXXXXXXX",
            "clientSecret": "XXXXXXXXXXXXXXXXXXX",
            "callbackUrl": "https://yaade.mydomain.net/oidc/callback",
            "fields": {
                "username": "/email",
                "groups": "/roles"
            },
            "scopes": ["openid", "email", "profile"]
        }
    }]
}

the Groups are alwasy empty.

Any suggestions?

Best regards

jonrosner · 2024-10-15T12:55:13Z

This looks correct. Please check those two things as well:

you are using the id_token. Is this info available in the access_token?
can you try with a completely fresh yaade instance. Especially make sure that the AD user never logged into Yaade before.

tknisch · 2024-10-15T13:05:03Z

Hi,

thanks for the fast response!

No, the roles attribute is only present in the id_token. But when I test another attribute which is present in the access_token it is not working too.
I've tested it with a completely fresh instance and got the same behaviour.

Best regards

jonrosner · 2024-10-15T13:08:55Z

Does the email field work correctly? When logging in via OIDC open the Settings and go to account. Check if the Username displayed there matches your email.

tknisch · 2024-10-15T13:10:48Z

Yes, this is working fine. Only the groups are empty:

jonrosner · 2024-10-15T14:37:33Z

Thanks, I was able to replicate it. I will push a fix asap.

jonrosner · 2024-10-15T19:16:52Z

I added a fix for this. Can you pull the nightly container and check if it works?

tknisch · 2024-10-16T05:24:29Z

I added a fix for this. Can you pull the nightly container and check if it works?

Good morning Jonathan,

I've checked and can confirm it is working fine :)

Gave me the roles admin and user and got them both:

jonrosner closed this as completed Dec 3, 2023

jonrosner reopened this Oct 15, 2024

jonrosner closed this as completed Oct 26, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How can I add Azure AD as auth provider in docker environment #85

How can I add Azure AD as auth provider in docker environment #85

pthoelken commented Sep 12, 2023

jonrosner commented Sep 12, 2023 •

edited

Loading

pthoelken commented Sep 18, 2023

jonrosner commented Sep 18, 2023

pthoelken commented Sep 18, 2023

jonrosner commented Sep 18, 2023 •

edited

Loading

pthoelken commented Sep 18, 2023

pthoelken commented Sep 18, 2023

jonrosner commented Sep 18, 2023 •

edited

Loading

pthoelken commented Sep 18, 2023 •

edited

Loading

jonrosner commented Sep 19, 2023

pthoelken commented Sep 19, 2023

jonrosner commented Sep 19, 2023

pthoelken commented Sep 19, 2023

pthoelken commented Sep 19, 2023

pthoelken commented Sep 19, 2023

pthoelken commented Sep 21, 2023

jonrosner commented Sep 21, 2023

jonrosner commented Dec 3, 2023

tknisch commented Oct 15, 2024

jonrosner commented Oct 15, 2024

tknisch commented Oct 15, 2024

jonrosner commented Oct 15, 2024

tknisch commented Oct 15, 2024

jonrosner commented Oct 15, 2024

jonrosner commented Oct 15, 2024

tknisch commented Oct 16, 2024

How can I add Azure AD as auth provider in docker environment #85

How can I add Azure AD as auth provider in docker environment #85

Comments

pthoelken commented Sep 12, 2023

jonrosner commented Sep 12, 2023 • edited Loading

pthoelken commented Sep 18, 2023

jonrosner commented Sep 18, 2023

pthoelken commented Sep 18, 2023

jonrosner commented Sep 18, 2023 • edited Loading

pthoelken commented Sep 18, 2023

pthoelken commented Sep 18, 2023

jonrosner commented Sep 18, 2023 • edited Loading

pthoelken commented Sep 18, 2023 • edited Loading

jonrosner commented Sep 19, 2023

pthoelken commented Sep 19, 2023

jonrosner commented Sep 19, 2023

pthoelken commented Sep 19, 2023

pthoelken commented Sep 19, 2023

pthoelken commented Sep 19, 2023

pthoelken commented Sep 21, 2023

jonrosner commented Sep 21, 2023

jonrosner commented Dec 3, 2023

tknisch commented Oct 15, 2024

jonrosner commented Oct 15, 2024

tknisch commented Oct 15, 2024

jonrosner commented Oct 15, 2024

tknisch commented Oct 15, 2024

jonrosner commented Oct 15, 2024

jonrosner commented Oct 15, 2024

tknisch commented Oct 16, 2024

jonrosner commented Sep 12, 2023 •

edited

Loading

jonrosner commented Sep 18, 2023 •

edited

Loading

jonrosner commented Sep 18, 2023 •

edited

Loading

pthoelken commented Sep 18, 2023 •

edited

Loading