Azure / Azure/static-web-apps-cli

AzureActiveDirectory (AAD) custom auth provider is broken in 2.0.3

Open
#947 12 comments 8 reactions 1 assignee Claimed by @LongOddCode View on GitHub
Dominant language
TypeScript
Stars
668
Forks
156
PR merge metrics
No merged PRs in 30d

Description

Before filing this issue, please ensure you're using the latest CLI by running `swa --version` and comparing to the latest version on [npm](https://www.npmjs.com/package/@azure/static-web-apps-cli).

**Are you accessing the CLI from the default port `:4280` ?**

- [ ] No, I am using a different port number (`--port`) and accessing the CLI from that port
- [x] Yes, I am accessing the CLI from port `:4280`

> Make sure you are accessing the URL printed in the console when running `swa start`!

**ℹ️ NOTE: Make sure to enable debug logs when running any `swa` commands using `--verbose=silly`**

**Describe the bug**
AAD sign-in either works locally or remotely, depending on the format of the `openIdIssuer` url in the `staticwebapp.config.json`, but never in both environments.

In `staticwebapp.config.json`
This works locally
```json
{
"openIdIssuer": "https://login.microsoftonline.com//oauth2/v2.0",
}
```
But when deployment, I get ERR_TOO_MANY_REDIRECTS in the browser.

This works when deployed
```json
{
"openIdIssuer": "https://login.microsoftonline.com//v2.0",
}
```
But in local emulator, I get 404 - This login.microsoftonline.com page can't be found

**To Reproduce**
Steps to reproduce the behavior:

To reproduce this, you would have to set up an Azure tenant with an AAD app in it. Here is my full `staticwebapp.config.json` for reference

```json
{
"platform": {
"apiRuntime": "node:20"
},
"auth": {
"identityProviders": {
"azureActiveDirectory": {
"registration": {
"openIdIssuer": "https://login.microsoftonline.com/***********************************/v2.0",
"clientIdSettingName": "AAD_CLIENT_ID",
"clientSecretSettingName": "AZURE_CLIENT_SECRET_APP_SETTING_NAME"
}
}
}
},
"routes": [
{
"route": "/*",
"allowedRoles": [
"authenticated"
]
}
],
"responseOverrides": {
"401": {
"statusCode": 302,
"redirect": "/.auth/login/aad"
}
}
}
```

**Expected behavior**
Clear guidance on whether to include `oauth2` in the URL and a consistent behavior between local and deployed environments.

**Screenshots**

**Desktop (please complete the following information):**

- OS: Windows 11
- Edge: Version 134.0.3124.72 (Official build) (64-bit)

**Additional context**
The documentation site says we should not use `oauth2` in the url, but I have consulted with a library maintainer who said the documentation site is outdated.

For Microsoft internal contact, please use alias chusun

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.