stable
Clone or download
The Azure AD implementation of OIDC authentication flow can be configured to support one of the following scenario [0]: * Only users from a specific Azure AD tenant (currently the only scenario supported by Tuleap) can sign in * Only users with a personal Microsoft account can sign in * Only users with work/school account from Azure AD can sign in * Any users with work/school account from Azure AD or a personal Microsoft account can sign in This contribution puts all the necessary mechanisms in place to support the described scenarii in place. Nothing is displayed in the UI yet but it's already possible to play with the information stored in the DB to select the scenario you want to test. You will note that the expected GUID in the issuer URL is hardcoded by Microsoft. There is a doubt on what is the GUID in the issuer URL when a user with a work/school from another tenant sign in. This is not really clear in the documentation provided by Microsoft and I'm do not have the necessary accounts to reproduce this scenario. In the worst case, users from other tenants cannot connect which means the 'organizations' mode is identical to the 'tenant_specific' mode. Part of request #14368: Support sign-in with any personal Microsoft account or Azure AD account [0] https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols#endpoints Change-Id: I3f70bf0c62d6ac5e63ed4a7d15b15853e18a5f49
Modified Files
| Name | ||||
|---|---|---|---|---|
| M | plugins/openidconnectclient/db/install.sql | +2 | −1 | Go to diff View file |
| A | plugins/openidconnectclient/db/mysql/2020/202001071800_add_acceptable_tenant_column.php | +58 | −0 | Go to diff View file |
| M | plugins/openidconnectclient/include/OpenIDConnectClient/Administration/Controller.php | +5 | −1 | Go to diff View file |
| M | plugins/openidconnectclient/include/OpenIDConnectClient/Authentication/AzureProviderIssuerClaimValidator.php | +12 | −1 | Go to diff View file |
| A | plugins/openidconnectclient/include/OpenIDConnectClient/Provider/AzureADProvider/AcceptableTenantForAuthenticationConfiguration.php | +115 | −0 | Go to diff View file |
| M | plugins/openidconnectclient/include/OpenIDConnectClient/Provider/AzureADProvider/AzureADProvider.php | +25 | −11 | Go to diff View file |
| M | plugins/openidconnectclient/include/OpenIDConnectClient/Provider/AzureADProvider/AzureADProviderDao.php | +8 | −6 | Go to diff View file |
| M | plugins/openidconnectclient/include/OpenIDConnectClient/Provider/AzureADProvider/AzureADProviderManager.php | +11 | −3 | Go to diff View file |
| A | plugins/openidconnectclient/include/OpenIDConnectClient/Provider/AzureADProvider/UnknownAcceptableTenantForAuthenticationIdentifierException.php | +31 | −0 | Go to diff View file |
| M | plugins/openidconnectclient/phpunit/Authentication/AzureProviderIssuerClaimValidatorTest.php | +12 | −8 | Go to diff View file |
| A | plugins/openidconnectclient/phpunit/Provider/AzureADProvider/AcceptableTenantForAuthenticationConfigurationTest.php | +102 | −0 | Go to diff View file |
| A | plugins/openidconnectclient/phpunit/Provider/AzureADProvider/AzureADProviderTest.php | +71 | −0 | Go to diff View file |
| M | plugins/openidconnectclient/phpunit/Provider/AzureADProviderManagerTest.php | +5 | −2 | Go to diff View file |
| M | plugins/openidconnectclient/phpunit/Provider/ProviderManagerTest.php | +3 | −3 | Go to diff View file |