authlib / authlib/loginpass

Azure AD B2C Provider

Open
#34 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
319
Forks
66
PR merge metrics
No merged PRs in 30d

Description

[Azure AD B2C supports OpenID Connect](https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-reference-oidc) and would be a good enterprise quality service to add to Authlib loginpass.

I don't understand this library enough to add this, but I can help with some of the base information and I'm vry happy to help with live testing.

Here's a example from a **live tenant configuration URL**
```python
f'https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/v2.0/.well-known/openid-configuration?p={policy}'
```
**Response**
```python
{
f"issuer": "https://{tenant}.b2clogin.com/{SOME_GUIDE}/v2.0/",
f"authorization_endpoint": "https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/oauth2/v2.0/authorize?p={policy}",
f"token_endpoint": "https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/oauth2/v2.0/token?p={policy}",
f"end_session_endpoint": "https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/oauth2/v2.0/logout?p={policy}",
f"jwks_uri": "https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/discovery/v2.0/keys?p={policy}",
"response_modes_supported": [
"query",
"fragment",
"form_post"
],
"response_types_supported": [
"code",
"code id_token",
"code token",
"code id_token token",
"id_token",
"id_token token",
"token",
"token id_token"
],
"scopes_supported": [
"openid"
],
"subject_types_supported": [
"pairwise"
],
"id_token_signing_alg_values_supported": [
"RS256"
],
"token_endpoint_auth_methods_supported": [
"client_secret_post",
"client_secret_basic"
],
"claims_supported": [
"emails",
"newUser",
"oid",
"sub",
"idp",
"extension_customUserAttribute",
"tfp",
"iss",
"iat",
"exp",
"aud",
"acr",
"nonce",
"auth_time"
]
}
```

Some notes:

The host URL uses tenant more than once:

```python
host = 'https://{}.b2clogin.com/{}.onmicrosoft.com/'.format(tenant, tenant)
authorize_url = '{}oauth2/v2.0/authorize'.format(host)
token_url = '{}oauth2/v2.0/token'.format(host)
jwk_set__url = '{}discovery/v2.0/keys'.format(host)
iss _url = https://{}.b2clogin.com/__SOME_GUID__/v2.0/'.format(tenant) <-- Note the GUID, not sure where that value originates from
```

Sign In, Sign Up, etc require more kwargs:
```python
client_kwargs': {
'client_id': client_id,
'nonce': '??',
'p': policy,
'response_type': 'id_token',
'scope': 'openid offline_access',
},
```
I show nonce as required, but its unclear to me if the blueprints are handling that.

If I can help in any other way, please ask.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.