feat: adds azure AD as oauth2 provider

[vinayakkulkarni]

• Working off feat(oauth2): add aad provider #468

// cc @bmulholland

[bmulholland]

Took me a while to come back to this one :)

It looks good, and is pretty similar to the setup that I have. I'm not logging in to a particular tenant, so my tenantId is "common", and maybe that should be the default? But I think otherwise this is good, and I can add any fixes as I adopt it myself. @JoaoPedroAS51 thoughts?

[JoaoPedroAS51]

@vinayakkulkarni @noobling Hey! Nice work! 😃

I think we should set tenantId to common by default, as @bmulholland suggested.
And we can also add a scheme that modifies the logout, as suggested by @Dashboard-Community-Center in #1012

[vinayakkulkarni]

Suggested change

	authorization: `https://login.microsoftonline.com/${strategy.tenantId}/oauth2/v2.0/authorize`,
	userInfo: 'https://graph.microsoft.com/v1.0/me',
	token: `https://login.microsoftonline.com/${strategy.tenantId}/oauth2/v2.0/token`
	authorization: `https://login.microsoftonline.com/${strategy.tenantId || 'common'}/oauth2/v2.0/authorize`,
	userInfo: 'https://graph.microsoft.com/v1.0/me',
	token: `https://login.microsoftonline.com/${strategy.tenantId || 'common'}/oauth2/v2.0/token`

Does this make sense @JoaoPedroAS51 @bmulholland ?

[JoaoPedroAS51]

I think should be like this:

  const tenantId = strategy.tenantId || 'common'

  assignDefaults(strategy, {
    scheme: 'oauth2',
    endpoints: {
      authorization: `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`,
      userInfo: 'https://graph.microsoft.com/v1.0/me',
      token: `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`
    },
    codeChallengeMethod: 'S256',
    scope: ['openid', 'profile'],
    autoLogout: true
  })

[bmulholland]

Agreed, @JoaoPedroAS51's approach is much easier to read. I'd suggest a comment above the || "common" line that says this:

// Allows users with both personal Microsoft accounts and work/school accounts from Azure AD to sign into the application.
// https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols#endpoints

[JoaoPedroAS51]

The logout method should be something like this. But need to test.

schemes/ad.ts

import { encodeQuery, removeTokenPrefix } from '../utils'
import { Oauth2Scheme } from '../schemes/oauth2'

export class AzureADScheme extends Oauth2Scheme {
  logout() {
    if (this.options.endpoints.logout) {
      const token = removeTokenPrefix(this.token.get())

      const opts = {
        post_logout_redirect_uri: this.logoutRedirectURI,
        id_token_hint: token
      };
      const url = this.options.endpoints.logout + "?" + encodeQuery(opts)
      window.location.replace(url)
    }
    return this.$auth.reset()
  }
}

[JoaoPedroAS51]

Providers are not inside folders anymore. So you can move the file to providers dir, and rename to ad.ts

[luckb0x]

Any update on the PR progress?
Looks like it's been 8 months since it was raised. Comments seem to show that all work is completed. It would be great to use this as a provider! Thanks 🙌🏼