EasyAuth broken – Cannot add "loginParameters" (except for provider "aad")
- Dominant language
- PowerShell
- Stars
- 1.1k
- Forks
- 215
- Avg merge
- 4h 2m
- Merged PRs (30d)
- 1
Description
The current implementation of EasyAuth on Azure Functions is broken. It is not possible to add `loginParameters` to the configuration for identity providers (except for Microsoft / "azureActiveDirectory").
Controlling the additional query parameters for the OAuth authentication flows is extremely important when creating great user experiences. In our case we need to add `prompt=select_account` such that the user is always prompted to select the correct Microsoft or Google account (when the user has multiple Microsoft/Google accounts, e.g. work and personal).
This can be done for Microsoft ("azureActiveDirectory") by adding the query parameters under `loginParameters` in Resource Explorer: `https://resources.azure.com/subscriptions/{{subscription}}/resourceGroups/{{resource-group}}/providers/Microsoft.Web/sites/{{func-name}}/config/authsettingsV2/list`
```
"identityProviders": {
"azureActiveDirectory": {
"enabled": true,
"registration": {
"openIdIssuer": "...",
"clientId": "...",
"clientSecretSettingName": "..."
},
"login": {
"loginParameters": [
"prompt=select_account"
]
}
},
...
}
```
This works as expected. However it does not work for "google" (or the other built-in providers). Trying to add `loginParameters` under "google" is rejected by Resource Explorer:
```
"identityProviders": {
...
"google": {
"enabled": true,
"registration": {
"clientId": "...",
"clientSecretSettingName": "..."
},
"login": {
"loginParameters": [
"prompt=select_account"
]
}
},
...
}
```
The Resource Explorer simply strips the parameter and the result is:
```
"identityProviders": {
...
"google": {
"enabled": true,
"registration": {
"clientId": "...",
"clientSecretSettingName": "..."
},
"login": {}
},
...
}
```
I have even tried to add Google as a custom OpenID provider and then tried to set "loginParameters":
```
"identityProviders": {
...
"customOpenIdConnectProviders": {
"google2": {
"registration": {
"clientId": "...",
"clientCredential": {
"clientSecretSettingName": "..."
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://accounts.google.com/.well-known/openid-configuration"
}
},
"login": {
"loginParameters": [
"prompt=select_account"
]
}
}
},
...
}
```
But this is also rejected by Resource Explorer.
I have even tried the badly named `loginParameterNames` parameter that is used when configuring custom authentication for Static Web Apps (https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-authentication-in-azure-static-app#31-add-an-openid-connect-identity-provider). This works for SWA (when configured by `staticwebapp.config.json`). But this badly named parameter (`loginParameterNames`) is also rejected by the Resource Explorer for Azure Functions.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.