Azure / Azure/Azure-Functions

EasyAuth broken – Cannot add "loginParameters" (except for provider "aad")

Open
#2,285 8 comments 2 reactions 1 assignee Claimed by @ramya894 View on GitHub
bug Needs: Triage (functions)
Dominant language
PowerShell
Stars
1.1k
Forks
215
Avg merge
4h 2m
Merged PRs (30d)
1

Description

The current implementation of EasyAuth on Azure Functions is broken. It is not possible to add `loginParameters` to the configuration for identity providers (except for Microsoft / "azureActiveDirectory").

Controlling the additional query parameters for the OAuth authentication flows is extremely important when creating great user experiences. In our case we need to add `prompt=select_account` such that the user is always prompted to select the correct Microsoft or Google account (when the user has multiple Microsoft/Google accounts, e.g. work and personal).

This can be done for Microsoft ("azureActiveDirectory") by adding the query parameters under `loginParameters` in Resource Explorer: `https://resources.azure.com/subscriptions/{{subscription}}/resourceGroups/{{resource-group}}/providers/Microsoft.Web/sites/{{func-name}}/config/authsettingsV2/list`
```
"identityProviders": {
"azureActiveDirectory": {
"enabled": true,
"registration": {
"openIdIssuer": "...",
"clientId": "...",
"clientSecretSettingName": "..."
},
"login": {
"loginParameters": [
"prompt=select_account"
]
}
},
...
}
```
This works as expected. However it does not work for "google" (or the other built-in providers). Trying to add `loginParameters` under "google" is rejected by Resource Explorer:
```
"identityProviders": {
...
"google": {
"enabled": true,
"registration": {
"clientId": "...",
"clientSecretSettingName": "..."
},
"login": {
"loginParameters": [
"prompt=select_account"
]
}
},
...
}
```
The Resource Explorer simply strips the parameter and the result is:
```
"identityProviders": {
...
"google": {
"enabled": true,
"registration": {
"clientId": "...",
"clientSecretSettingName": "..."
},
"login": {}
},
...
}
```

I have even tried to add Google as a custom OpenID provider and then tried to set "loginParameters":
```
"identityProviders": {
...
"customOpenIdConnectProviders": {
"google2": {
"registration": {
"clientId": "...",
"clientCredential": {
"clientSecretSettingName": "..."
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://accounts.google.com/.well-known/openid-configuration"
}
},
"login": {
"loginParameters": [
"prompt=select_account"
]
}
}
},
...
}
```
But this is also rejected by Resource Explorer.

I have even tried the badly named `loginParameterNames` parameter that is used when configuring custom authentication for Static Web Apps (https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-authentication-in-azure-static-app#31-add-an-openid-connect-identity-provider). This works for SWA (when configured by `staticwebapp.config.json`). But this badly named parameter (`loginParameterNames`) is also rejected by the Resource Explorer for Azure Functions.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.