microsoftgraph / microsoftgraph/msgraph-sdk-powershell

Add AD FS support

Open
#2,231 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Request: Feature
Dominant language
C#
Stars
898
Forks
230
Avg merge
2d 5h
Merged PRs (30d)
31

Description

Is your feature request related to a problem? Please describe.
AD FS support.

Describe the solution you'd like
The SDK should add support for AD FS via prompt=login as stated at https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/ad-fs-prompt-login.

Describe alternatives you've considered
The prompt query parameter on the /authorize call is something that the SDK does not set. The prompt value is set by Azure.Identity/MSAL library, which defaults to prompt=select_account when no login hint is provided and prompt=none when a login hint is provided. As per the guidance at Microsoft identity platform and OAuth 2.0 authorization code flow - Microsoft Entra | Microsoft Learn, MSAL's default of prompt=select_account should be sufficient to allow the customer to use a different account to sign-in rather than automatically using single sign. However, it does appear that this is not the case for certain AD FS scenarios.

Additional context
This feature depends on having configuration of prompt value in Azure.Identity which is currently not supported - https://github.com/Azure/azure-sdk-for-net/issues/38099.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing how the PowerShell SDK builds its /authorize call and the linked Azure.Identity InteractiveBrowserCredential.cs reference. Check the dependency on Azure.Identity issue 38099 before making changes. Done means AD FS scenarios can use prompt=login through the SDK, with the behavior verified against the referenced authentication guidance.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, powershell
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.