Migrate Pritunl Azure SSO to Microsoft Graph API

[sgrzemski]

Hello Pritunl developers,

Azure AD Graph API is deprecated. Pritunl has to be switched to use Microsoft Graph API.
Previously, Pritunl required Directory.Read.All API permission, which was excessive and potentially vulnerable. It might be also a problem when working with big AD sets. I have introduced the new API url, fixed all request params and changed the logic of getting user groups to match new Microsoft Graph API.

Thank you in advance,
Szymon

[zachhuff386]

This wouldn't be compatible with existing configurations. All users currently have only the Azure Active Directory Graph API permissions configured. This change would break all existing configurations. A migration to the new API will be added in a future release.

[TheBigBear]

@zachhuff386 can you show where this was added instead, so it does indeed get actioned ASAP? we really need this, this is NOT really an "optional" improvement, this is a MUST do.

@sgrzemski Szymon is the SSO provider in pritunl FREE, or is this functionality dependant on having some sort of ongoing subscription with or for pritunl ?

[sgrzemski]

@TheBigBear yes, it's in paid Enterprise plan.

[eimann]

Apparently the Enterprise subscription still doesn't support Microsoft Graph API.
The Pritunl docs are outdated and refer to the old AAD Graph API.
Support requests aren't answered.

[zachhuff386]

An update for the new Azure API will be available in the unstable repository in a few hours. The command sudo pritunl set app.sso_azure_version 2 will enable the new API.

[eimann]

Thanks Zach. Using the unstable repo and enabling the new API worked like a charm.

[Akashdeep-Munjal]

An update for the new Azure API will be available in the unstable repository in a few hours. The command sudo pritunl set app.sso_azure_version 2 will enable the new API.

@zachhuff386 I updated to sudo pritunl set app.sso_azure_version 2, but still getting same error with MS Graph API.

[Akashdeep-Munjal]

It worked.

[samalazau]

For everyone who struggles the same issue on AWS Linux:

wget https://repo.pritunl.com/unstable/yum/amazonlinux/2/pritunl-1.30.2969.92-1.amzn2.x86_64.rpm && yum localinstall pritunl-*.rpm && sudo pritunl set app.sso_azure_version 2