Skip to content

Social: Microsoft - Enable single-tenant app registrations #11207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Exordian wants to merge 1 commit into from
Closed

Social: Microsoft - Enable single-tenant app registrations #11207

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions services/src/main/java/org/keycloak/social/microsoft/MicrosoftIdentityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,15 +43,26 @@ public class MicrosoftIdentityProvider extends AbstractOAuth2IdentityProvider im

private static final Logger log = Logger.getLogger(MicrosoftIdentityProvider.class);

public static final String AUTH_URL = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize"; // authorization code endpoint
public static final String TOKEN_URL = "https://login.microsoftonline.com/common/oauth2/v2.0/token"; // token endpoint
public static final String COMMON_AUTH_URL = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize"; // authorization code endpoint
public static final String COMMON_TOKEN_URL = "https://login.microsoftonline.com/common/oauth2/v2.0/token"; // token endpoint
public static final String PROFILE_URL = "https://graph.microsoft.com/v1.0/me/"; // user profile service endpoint
public static final String DEFAULT_SCOPE = "User.read"; // the User.read scope should be sufficient to obtain all necessary user info

public MicrosoftIdentityProvider(KeycloakSession session, OAuth2IdentityProviderConfig config) {
super(session, config);
config.setAuthorizationUrl(AUTH_URL);
config.setTokenUrl(TOKEN_URL);

final MicrosoftIdentityProviderConfig microsoftConfig = ((MicrosoftIdentityProviderConfig)config);

if (microsoftConfig.getTenantId() == null) {
config.setAuthorizationUrl(COMMON_AUTH_URL);
config.setTokenUrl(COMMON_TOKEN_URL);
} else {
final String tenantAuthUrl = COMMON_AUTH_URL.replace("common", microsoftConfig.getTenantId());
final String tenantTokenUrl = COMMON_TOKEN_URL.replace("common", microsoftConfig.getTenantId());
config.setAuthorizationUrl(tenantAuthUrl);
config.setTokenUrl(tenantTokenUrl);
}

config.setUserInfoUrl(PROFILE_URL);
}

Expand Down
25 changes: 25 additions & 0 deletions services/src/main/java/org/keycloak/social/microsoft/MicrosoftIdentityProviderConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
package org.keycloak.social.microsoft;

@sguilhen sguilhen Jun 10, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add the copyright header to this new file


import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
import org.keycloak.models.IdentityProviderModel;

public class MicrosoftIdentityProviderConfig extends OIDCIdentityProviderConfig {

public MicrosoftIdentityProviderConfig(IdentityProviderModel model) {
super(model);
}

public MicrosoftIdentityProviderConfig() {

}

public String getTenantId() {
String tenantId = getConfig().get("tenantId");

return tenantId == null || tenantId.isEmpty() ? null : tenantId;
}

public void setTenantId(final String tenantId) {
getConfig().put("tenantId", tenantId);
}
}
4 changes: 2 additions & 2 deletions services/src/main/java/org/keycloak/social/microsoft/MicrosoftIdentityProviderFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,12 @@ public String getName() {

@Override
public MicrosoftIdentityProvider create(KeycloakSession session, IdentityProviderModel model) {
return new MicrosoftIdentityProvider(session, new OAuth2IdentityProviderConfig(model));
return new MicrosoftIdentityProvider(session, new MicrosoftIdentityProviderConfig(model));
}

@Override
public OAuth2IdentityProviderConfig createConfig() {
return new OAuth2IdentityProviderConfig();
return new MicrosoftIdentityProviderConfig();
}

@Override
Expand Down
2 changes: 2 additions & 0 deletions themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -687,6 +687,8 @@ identity-provider.google-userIp.tooltip=Set 'userIp' query parameter when invoki
offlineAccess=Request refresh token
identity-provider.google-offlineAccess.tooltip=Set 'access_type' query parameter to 'offline' when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
hostedDomain=Hosted Domain
tenantId=Tenant ID
identity-provider.microsoft-tenantId.tooltip=Set Tenant ID if you're using a single-tenant Microsoft app registration.
identity-provider.google-hostedDomain.tooltip=Set 'hd' query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When '*' is entered, any hosted account can be used.
identity-provider.facebook-fetchedFields.label=Additional user's profile fields
identity-provider.facebook-fetchedFields.tooltip=Provide additional fields which would be fetched using the profile request. This will be appended to the default set of 'id,name,email,first_name,last_name'.
Expand Down
7 changes: 7 additions & 0 deletions .../resources/theme/base/admin/resources/partials/realm-identity-provider-microsoft-ext.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<div class="form-group">
<label class="col-md-2 control-label" for="tenantId">{{:: 'tenantId' | translate}}</label>
<div class="col-md-6">
<input ng-model="identityProvider.config.tenantId" id="tenantId" class="form-control" />
</div>
<kc-tooltip>{{:: 'identity-provider.microsoft-tenantId.tooltip' | translate}}</kc-tooltip>
</div>