Add Code or publish instruction for authenticating to Microsoft Azure

[brentgroves]

Add code or write a procedure to show OAuth authentication working for a Microsoft Azure account.

I tried to change the default.json file to use an app I registered in a free Microsoft developer account without success. I believe it would be possible to use the following articles:
https://learn.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/aad/app-aad-token
https://learn.microsoft.com/en-us/azure/active-directory/develop/tutorial-v2-javascript-auth-code
https://stackoverflow.com/questions/54868974/getting-security-groups-in-jwt-access-token

[brentgroves]

Wrote 2 custom routes to get this to work but if it could be added to the Microsoft OAuth code in feathers it would be a lot nicer.
module.exports = function (app) {

app.get('/auth', (req, res) => {
res.status(301).redirect(
https://login.microsoftonline.com/5269b021-533e-4702-b9d9-72acbc852c97/oauth2/v2.0/authorize?client_id=29fa39d4-de57-4009-a46a-c561fa048562&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3030%2Fauth-callback&response_mode=query&scope=api%3A%2F%2F29fa39d4-de57-4009-a46a-c561fa048562%2FUser.Info&state=${state},
);

app.get('/auth-callback', async (req, res) => {
//Extracting code and state
const { state, code } = req.query;
g_state = state;

var res2 = axios.post('https://login.microsoftonline.com/5269b021-533e-4702-b9d9-72acbc852c97/oauth2/v2.0/token',
  qs.stringify({
    client_id:'29fa39d4-de57-4009-a46a-c561fa048562',
    scope:'api://29fa39d4-de57-4009-a46a-c561fa048562/User.Info',
    code:code,
    redirect_uri:'http://localhost:3030/auth-callback',
    grant_type:'authorization_code',
    state:state
  }),{
    // timeout:10, // in ms the default is 0 which is no timeout limit.
    headers: { 
      "Content-Type": "application/x-www-form-urlencoded"
    },
  }).then(function(response) {

      // console.log(response.data.access_token);
      const decoded = jwt_decode(response.data.access_token);
      // logger.info('jwt:%s', JSON.stringify(decoded))
      logger.info('jwt: %o', decoded);
      const email = decoded.email;
      const upn = decoded.upn;
      const name = decoded.name;
      const family_name = decoded.family_name;
      const given_name = decoded.given_name;
      const groups = decoded.groups;
      const password = 'passwordless';
  
      logger.info('jwt: %o', {email,upn,name,family_name,given_name,groups});
      app
      .service('users')
      .create({ email, name, family_name,given_name,groups, password })
      .then(() => {
        logger.info('now try to authenticate from the browser client.authenticate function with this email and a dummy password using the local strategy');
        res.redirect(`http://localhost:3000/?email=${email}`);
      }) 
      .then(() => {

// for testing purposes;
}).catch((err) => {
if(err.code == 409)
{
logger.info('%o', err);
logger.info('now try to login');
res.redirect(http://localhost:3000/?email=${email});
// USED this redirect so the web app could call the client.authenticate() function with a local strategy with a password always set to 'passwordless'
}
else
{
logger.info('%o', err);
}
});

    }).catch((err) => { 
      logger.info('%o', err);
  });

});
};

[Arteria-SebastianD]

I'm also in the process of trying to get Azure AD Auth (now Entra) to work.
I have a default.json config that should work but currently get an error after receiving the response from Entra.

"authentication": {
    "oauth": {
      "redirect": "http://localhost:3033/",
      "entra": {
        "scope_delimiter": " ",
        "oauth":2, 
        "key": "<app-id>",
        "secret": "<secret>",
        "scope": ["openid", "email", "profile"],
        "redirectUrl": "https://localhost:3033/oauth/entra/callback",
        "authorize_url": "https://login.microsoftonline.com/<id>/oauth2/v2.0/authorize",
        "access_url": "https://login.microsoftonline.com/<id>/oauth2/v2.0/token"
      }
    },
[other auth ...]

And the error I'm getting is a validation error because it seems that somewhere in "#/additionalproperties" entraId is added and that messes up the validation. I'll try to get in touch with the devs about that one and update my comment here when I have a working solution.

[ericuldall]

Have you guys tried looking at the OauthStrategy?

feathers/packages/authentication-oauth/src/strategy.ts

Lines 1 to 176 in 82d30fd

	import {
	AuthenticationRequest,
	AuthenticationBaseStrategy,
	AuthenticationResult,
	AuthenticationParams
	} from '@feathersjs/authentication'
	import { Params } from '@feathersjs/feathers'
	import { NotAuthenticated } from '@feathersjs/errors'
	import { createDebug, _ } from '@feathersjs/commons'
	import qs from 'qs'
	const debug = createDebug('@feathersjs/authentication-oauth/strategy')
	export interface OAuthProfile {
	id?: string | number
	[key: string]: any
	}
	export class OAuthStrategy extends AuthenticationBaseStrategy {
	get configuration() {
	const { entity, service, entityId, oauth } = this.authentication.configuration
	const config = oauth[this.name] as any
	return {
	entity,
	service,
	entityId,
	...config
	}
	}
	get entityId(): string {
	const { entityService } = this
	return this.configuration.entityId || (entityService && (entityService as any).id)
	}
	async getEntityQuery(profile: OAuthProfile, _params: Params) {
	return {
	[`${this.name}Id`]: profile.sub || profile.id
	}
	}
	async getEntityData(profile: OAuthProfile, _existingEntity: any, _params: Params) {
	return {
	[`${this.name}Id`]: profile.sub || profile.id
	}
	}
	async getProfile(data: AuthenticationRequest, _params: Params) {
	return data.profile
	}
	async getCurrentEntity(params: Params) {
	const { authentication } = params
	const { entity } = this.configuration
	if (authentication && authentication.strategy) {
	debug('getCurrentEntity with authentication', authentication)
	const { strategy } = authentication
	const authResult = await this.authentication.authenticate(authentication, params, strategy)
	return authResult[entity]
	}
	return null
	}
	async getAllowedOrigin(params?: Params) {
	const { redirect, origins = this.app.get('origins') } = this.authentication.configuration.oauth
	if (Array.isArray(origins)) {
	const referer = params?.headers?.referer || origins[0]
	const allowedOrigin = origins.find((current) => referer.toLowerCase().startsWith(current.toLowerCase()))
	if (!allowedOrigin) {
	throw new NotAuthenticated(`Referer "${referer}" is not allowed.`)
	}
	return allowedOrigin
	}
	return redirect
	}
	async getRedirect(
	data: AuthenticationResult | Error,
	params?: AuthenticationParams
	): Promise<string | null> {
	const queryRedirect = (params && params.redirect) || ''
	const redirect = await this.getAllowedOrigin(params)
	if (!redirect) {
	return null
	}
	const redirectUrl = `${redirect}${queryRedirect}`
	const separator = redirectUrl.endsWith('?') ? '' : redirect.indexOf('#') !== -1 ? '?' : '#'
	const authResult: AuthenticationResult = data
	const query = authResult.accessToken
	? { access_token: authResult.accessToken }
	: { error: data.message || 'OAuth Authentication not successful' }
	return `${redirectUrl}${separator}${qs.stringify(query)}`
	}
	async findEntity(profile: OAuthProfile, params: Params) {
	const query = await this.getEntityQuery(profile, params)
	debug('findEntity with query', query)
	const result = await this.entityService.find({
	...params,
	query
	})
	const [entity = null] = result.data ? result.data : result
	debug('findEntity returning', entity)
	return entity
	}
	async createEntity(profile: OAuthProfile, params: Params) {
	const data = await this.getEntityData(profile, null, params)
	debug('createEntity with data', data)
	return this.entityService.create(data, _.omit(params, 'query'))
	}
	async updateEntity(entity: any, profile: OAuthProfile, params: Params) {
	const id = entity[this.entityId]
	const data = await this.getEntityData(profile, entity, params)
	debug(`updateEntity with id ${id} and data`, data)
	return this.entityService.patch(id, data, _.omit(params, 'query'))
	}
	async getEntity(result: any, params: Params) {
	const { entityService } = this
	const { entityId = (entityService as any).id, entity } = this.configuration
	if (!entityId || result[entityId] === undefined) {
	throw new NotAuthenticated('Could not get oAuth entity')
	}
	if (!params.provider) {
	return result
	}
	return entityService.get(result[entityId], {
	..._.omit(params, 'query'),
	[entity]: result
	})
	}
	async authenticate(authentication: AuthenticationRequest, originalParams: AuthenticationParams) {
	const entity: string = this.configuration.entity
	const { provider, ...params } = originalParams
	const profile = await this.getProfile(authentication, params)
	const existingEntity = (await this.findEntity(profile, params)) || (await this.getCurrentEntity(params))
	debug('authenticate with (existing) entity', existingEntity)
	const authEntity = !existingEntity
	? await this.createEntity(profile, params)
	: await this.updateEntity(existingEntity, profile, params)
	return {
	authentication: { strategy: this.name },
	[entity]: await this.getEntity(authEntity, originalParams)
	}
	}
	}

[Arteria-SebastianD]

I have found a way to use Azure Entra Id Auth with v5.0.11 and minimal changes, but took quite some debugging and research for that.
first of all here is the authentication section in default.json:

      "microsoft": {
        "authorize_url": "https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/authorize",
        "access_url": "https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/token",
        "callback": "http://localhost:3033/auth/redirect",
        "key": "<AppId>",
        "secret": "<secret>",
        "nonce": true,
        "oauth":2, 
        "scope": ["openid", "email", "profile", "user.read"],
        "scope_delimiter": " ",
        "response":["jwt","profile","tokens"]
      }

I'm not 100% sure if response is needed or if callback is totally correct. Also the name "microsoft" might add certain attributes since there is a config for microsoft somewhere in the feathers code. I did not try another name for now.

There is also the need to add "microsoftId" in the auth schema (default user, in my case it's called auth) in the authentication service:

[...]
// Main data model schema
export const authSchema = {
  $id: 'Auth',
  type: 'object',
  additionalProperties: false,
  required: ['id', 'email'],
  properties: {
    id: { type: 'number' },
    email: { type: 'string' },
    password: { type: 'string' },
    microsoftId: {type:'string'},
  }
} as const;
[...]

otherwise validation will fail.
And finally the authentication.ts has to be adapted, so the actual fields are returned, I also use the actual Microsoft Oid instead of the sub property because I'll call the MS Graph at some later stage and will need it anyway:

class MicrosoftStrategy extends OAuthStrategy {

  async getEntityQuery(profile: OAuthProfile, _params: Params) {
    const micosoftOid = (_params as any)?.state?.grant?.response?.jwt?.id_token?.payload?.oid;
    return {
      [`${this.name}Id`]: micosoftOid || profile.sub || profile.id
    };
  }

  async getEntityData(profile: OAuthProfile, existingEntity: any, params: Params<Query>) {
    const baseData = await super.getEntityData(profile, existingEntity, params);
    const { email, sub } = profile;
    //TODO change that line or at least do a try-catch?
    const micosoftOid = (params as any)?.state?.grant?.response?.jwt?.id_token?.payload?.oid;
    //password is mandatory, could just use empty or random string
    const user = {
      email: email,
      password: sub,
      microsoftId: micosoftOid //sub would be the default here
    };
    return user;
  }
}

export const authentication = (app: Application) => {
  // const authentication = new EntraAuthenticationService(app);
  const authentication = new AuthenticationService(app);

  authentication.register('jwt', new JWTStrategy());
  authentication.register('local', new LocalStrategy());
  authentication.register('microsoft', new MicrosoftStrategy());

  app.use('authentication', authentication);
  app.configure(oauth());
};

Mind you, that the the authentication that you want on your services is still all: [authenticate('jwt')] as feathers creates a jwt token for you.
Hope that helps!