keycloak · ssilvert · Oct 10, 2023 · May 31, 2023 · Jun 12, 2023
@@ -13,6 +13,7 @@ import ProviderBaseGeneralSettingsPage from "../support/pages/admin-ui/manage/id
 import ProviderBaseAdvancedSettingsPage from "../support/pages/admin-ui/manage/identity_providers/ProviderBaseAdvancedSettingsPage";
 import ProviderGithubGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderGithubGeneralSettings";
 import ProviderGoogleGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderGoogleGeneralSettings";
+import ProviderMicrosoftGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderMicrosoftGeneralSettings";
 import ProviderOpenshiftGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderOpenshiftGeneralSettings";
 import ProviderPaypalGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderPaypalGeneralSettings";
 import ProviderStackoverflowGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderStackoverflowGeneralSettings";
@@ -50,6 +51,7 @@ describe("Identity provider test", () => {
     Facebook: new ProviderFacebookGeneralSettings(),
     Github: new ProviderGithubGeneralSettings(),
     Google: new ProviderGoogleGeneralSettings(),
+    Microsoft: new ProviderMicrosoftGeneralSettings(),
     "Openshift-v3": new ProviderOpenshiftGeneralSettings(),
     "Openshift-v4": new ProviderOpenshiftGeneralSettings(),
     Paypal: new ProviderPaypalGeneralSettings(),

@@ -0,0 +1,29 @@
+import ProviderBaseGeneralSettingsPage from "../ProviderBaseGeneralSettingsPage";
+
+const TENANT_ID_VALUE = "12345678-9abc-def0-1234-56789abcdef0";
+
+export default class ProviderMicrosoftGeneralSettings extends ProviderBaseGeneralSettingsPage {
+  private tenantIdTestId = "tenantId";
+
+  public typeTenantIdInput(value: string) {
+    cy.findByTestId(this.tenantIdTestId).type(value).blur();
+    return this;
+  }
+
+  public assertTenantIdInputEqual(value: string) {
+    cy.findByTestId(this.tenantIdTestId).should("have.value", value);
+    return this;
+  }
+
+  public fillData(idpName: string) {
+    this.fillCommonFields(idpName);
+    this.typeTenantIdInput(TENANT_ID_VALUE);
+    return this;
+  }
+
+  public assertFilledDataEqual(idpName: string) {
+    this.assertCommonFilledDataEqual(idpName);
+    this.assertTenantIdInputEqual(TENANT_ID_VALUE);
+    return this;
+  }
+}
@@ -20,7 +20,6 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import org.jboss.logging.Logger;
 import org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider;
-import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
 import org.keycloak.broker.oidc.mappers.AbstractJsonUserAttributeMapper;
 import org.keycloak.broker.provider.BrokeredIdentityContext;
 import org.keycloak.broker.provider.IdentityBrokerException;
@@ -32,26 +31,32 @@
 
 import org.keycloak.services.validation.Validation;
 
+import java.util.Optional;
+
 /**
- * 
+ *
  * Identity provider for Microsoft account. Uses OAuth 2 protocol of Microsoft Graph as documented at
  * <a href="https://docs.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/graph-oauth">https://docs.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/graph-oauth</a>
- * 
+ *
  * @author Vlastimil Elias (velias at redhat dot com)
  */
 public class MicrosoftIdentityProvider extends AbstractOAuth2IdentityProvider implements SocialIdentityProvider {
 
     private static final Logger log = Logger.getLogger(MicrosoftIdentityProvider.class);
 
-    public static final String AUTH_URL = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize"; // authorization code endpoint
-    public static final String TOKEN_URL = "https://login.microsoftonline.com/common/oauth2/v2.0/token"; // token endpoint
-    public static final String PROFILE_URL = "https://graph.microsoft.com/v1.0/me/"; // user profile service endpoint
-    public static final String DEFAULT_SCOPE = "User.read"; // the User.read scope should be sufficient to obtain all necessary user info
+    private static final String AUTH_URL_TEMPLATE = "https://login.microsoftonline.com/%s/oauth2/v2.0/authorize"; // authorization code endpoint
+    private static final String TOKEN_URL_TEMPLATE = "https://login.microsoftonline.com/%s/oauth2/v2.0/token"; // token endpoint
+    private static final String PROFILE_URL = "https://graph.microsoft.com/v1.0/me/"; // user profile service endpoint
+    private static final String DEFAULT_SCOPE = "User.read"; // the User.read scope should be sufficient to obtain all necessary user info
 
-    public MicrosoftIdentityProvider(KeycloakSession session, OAuth2IdentityProviderConfig config) {
+    public MicrosoftIdentityProvider(KeycloakSession session, MicrosoftIdentityProviderConfig config) {
         super(session, config);
-        config.setAuthorizationUrl(AUTH_URL);
-        config.setTokenUrl(TOKEN_URL);
+
+        // Use multi-tenant 'common' endpoints if not specified.
+        String tenant = Optional.ofNullable(config.getTenantId()).map(String::trim).orElse("common");
+
+        config.setAuthorizationUrl(String.format(AUTH_URL_TEMPLATE, tenant));
+        config.setTokenUrl(String.format(TOKEN_URL_TEMPLATE, tenant));
         config.setUserInfoUrl(PROFILE_URL);
     }
 

@@ -0,0 +1,42 @@
+/*
+ * Copyright 2023 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.social.microsoft;
+
+import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
+import org.keycloak.models.IdentityProviderModel;
+
+public class MicrosoftIdentityProviderConfig extends OIDCIdentityProviderConfig {
+
+    public MicrosoftIdentityProviderConfig(IdentityProviderModel model) {
+        super(model);
+    }
+
+    public MicrosoftIdentityProviderConfig() {
+
+    }
+
+    public String getTenantId() {
+        String tenantId = getConfig().get("tenantId");
+
+        return tenantId == null || tenantId.isEmpty() ? null : tenantId;
+    }
+
+    public void setTenantId(final String tenantId) {
+        getConfig().put("tenantId", tenantId);
+    }
+}
@@ -16,11 +16,14 @@
  */
 package org.keycloak.social.microsoft;
 
-import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
 import org.keycloak.broker.provider.AbstractIdentityProviderFactory;
 import org.keycloak.broker.social.SocialIdentityProviderFactory;
 import org.keycloak.models.IdentityProviderModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+
+import java.util.List;
 
 /**
  * @author Vlastimil Elias (velias at redhat dot com)
@@ -36,16 +39,26 @@ public String getName() {
 
     @Override
     public MicrosoftIdentityProvider create(KeycloakSession session, IdentityProviderModel model) {
-        return new MicrosoftIdentityProvider(session, new OAuth2IdentityProviderConfig(model));
+        return new MicrosoftIdentityProvider(session, new MicrosoftIdentityProviderConfig(model));
     }
 
     @Override
-    public OAuth2IdentityProviderConfig createConfig() {
-        return new OAuth2IdentityProviderConfig();
+    public MicrosoftIdentityProviderConfig createConfig() {
+        return new MicrosoftIdentityProviderConfig();
     }
 
     @Override
     public String getId() {
         return PROVIDER_ID;
     }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return ProviderConfigurationBuilder.create()
+                .property().name("tenantId")
+                .label("Tenant ID")
+                .helpText("Uses single-tenant auth endpoints when specified, uses 'common' multi-tenant endpoints otherwise.")
+                .type(ProviderConfigProperty.STRING_TYPE).add()
+                .build();
+    }
 }
@@ -84,6 +84,7 @@
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.INSTAGRAM;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.LINKEDIN;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.MICROSOFT;
+import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.MICROSOFT_SINGLE_TENANT;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.OPENSHIFT;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.OPENSHIFT4;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.OPENSHIFT4_KUBE_ADMIN;
@@ -126,6 +127,7 @@ public enum Provider {
         TWITTER("twitter", TwitterConsentLoginPage.class),
         LINKEDIN("linkedin-openid-connect", LinkedInLoginPage.class),
         MICROSOFT("microsoft", MicrosoftLoginPage.class),
+        MICROSOFT_SINGLE_TENANT("microsoft", "microsoft-single-tenant", MicrosoftLoginPage.class),
         PAYPAL("paypal", PayPalLoginPage.class),
         STACKOVERFLOW("stackoverflow", StackOverflowLoginPage.class),
         OPENSHIFT("openshift-v3", OpenShiftLoginPage.class),
@@ -408,6 +410,15 @@ public void microsoftLogin() {
         appPage.assertCurrent();
     }
 
+    @Test
+    public void microsoftSingleTenantLogin() {
+        setTestProvider(MICROSOFT_SINGLE_TENANT);
+        navigateToLoginPage();
+        assertTrue(driver.getCurrentUrl().contains("/" + getConfig(MICROSOFT_SINGLE_TENANT, "tenantId") + "/"));
+        doLogin();
+        appPage.assertCurrent();
+    }
+
     @Test
     public void paypalLogin() {
         setTestProvider(PAYPAL);
@@ -449,6 +460,13 @@ public IdentityProviderRepresentation buildIdp(Provider provider) {
         if (provider == OPENSHIFT || provider == OPENSHIFT4 || provider == OPENSHIFT4_KUBE_ADMIN) {
             idp.getConfig().put("baseUrl", getConfig(provider, "baseUrl"));
         }
+        if (provider == MICROSOFT_SINGLE_TENANT) {
+            final String tenantId = getConfig(provider, "tenantId");
+            if (tenantId == null) {
+                throw new IllegalArgumentException("'tenantId' for Microsoft IdP must be specified");
+            }
+            idp.getConfig().put("tenantId", tenantId);
+        }
         if (provider == PAYPAL) {
             idp.getConfig().put("sandbox", getConfig(provider, "sandbox"));
         }