Backslash support for Azure SSO #8
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
klimburg
reviewed
Jun 2, 2022
christosachilleoudis
force-pushed
the
add-azure-sso
branch
from
331d4c6 to
f03297e
Compare
klimburg
approved these changes
Jun 8, 2022
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
Many organizations use Azure Active Directory to manage employee accounts. As a result, it is useful to support Azure AD for SSO for backslash.
Description
This PR adds SSO capability with Azure AD to backslash. The flow is as follows.
(1) Via the backslash frontend the user clicks the sign in with Azure AD button and is prompted for their username and password. This is implemented via the torii extension for azure active directory. The authorization code returned by azure is then redirected to the backslash backend. The authorization code also has privileges to be able to request user information.
(2) Using the authorization code, the backslash backend requests a user identity token (using the
MSALlibrary). This token has the user email, first name, and last name. The user is then signed in using this information. If the authorization token is illegitimate, the identity token request will error out and the user will be asked to sign in again.Verification
Manually, tested that azure SSO works and regular login still works.