Using OAuth for authorization on Azure / Entra ID

Prerequisites

Please refer to the following documentation for setup Azure AD

To register an Application within Azure Portal, please follow this Tutorial

General Settings

Mechanism settings

The following settings are needed for oAuth Authorization against Azure.

simplifier_settings_azure_oauth_parameters_70

Display Name	The display name is shown on the login button.
Client ID	The client ID identifies the application and is defined by the configuration on the OAuth server.
Client Secret	The client secret authenticates the application and is defined by the configuration on the OAuth server.
Scope	The scope determines which rights are gained with the access token. E.g. ‘profile’, ’email’, etc. for gaining rights to access the user profile/user email. For full Azure Access use the following example scopes: https://graph.microsoft.com/email https://graph.microsoft.com/profile https://graph.microsoft.com/Calendars.Read https://graph.microsoft.com/People.Read https://graph.microsoft.com/User.ReadBasic.All https://graph.microsoft.com/Calendars.ReadWrite https://graph.microsoft.com/Contacts.ReadWrite https://graph.microsoft.com/Tasks.ReadWrite https://graph.microsoft.com/Mail.ReadWrite https://graph.microsoft.com/Mail.Send https://graph.microsoft.com/Sites.Read.All https://graph.microsoft.com/Sites.ReadWrite.All offline_access
Authorization Endpoint	The authorization endpoint is the URL to which an authorization request is sent. Default should be https://login.microsoftonline.com/<tenantid>/oauth2/v2.0/authorize
Token Endpoint	The token endpoint is the URL to which an access token request is sent. Default Value: https://login.microsoftonline.com/<tenantid>/oauth2/v2.0/token
Logout Endpoint	Logout endpoint is an URL that can be provided for external IDMs supporting a Logout Mechanism from Client to IDM
Redirect Endpoint	The redirect endpoint is the URL to which the browser is directed after successful authorization. This URL needs to be entered in the OAuth server configuration.
Additional Query Parameters	You can add additional query parameters, such as name and value.
Icon	The icon will be displayed on the login mask above the display name.
Profile URL	The URL to which a user profile request is sent.
Profile Path	The path which points to the user profile. E.g. ‘/’, ‘profile’, ‘profiles[0]’ etc. Default Value https://graph.microsoft.com/v1.0/me
Profile Verb	GET, POST, PUT

Multitenant and Personal Accounts

If you want to create a multitenant and personal accounts login you have to use common as the tenant-id within the authorization endpoint.

https://login.microsoftonline.com/common/oauth2/v2.0/authorize

You need also to activate this within your app registration in the azure portal.

User Detail

First Name	The path which points to the entry of the user profile containing the first name. E.g. ‘givenName’, ‘person/firstName’, etc.
Last Name	The path which points to the entry of the user profile containing the last name. E.g. ‘surName’, ‘person/lastName’, etc.
E-Mail Address	The path which points to the entry of the user profile containing the email address. E.g. ‘mail’, ’emails[0]/value’, etc.
Mobile Phone Number	The path which points to the entry of the user profile containing the mobile phone number. E.g. ‘phone’, ‘phones/mobile’, etc.

Test

The settings for OAuth 2.0 can be tested within the configuration. Since the test procedure includes several steps, it is necessary to save the settings first.

The assignment of an access token can be tested by pressing the ‘Test authentication’ button, while pressing the ‘Test profile extraction’ button initiates the complete OAuth 2.0 procedure, which assigns an access token and also collects a user profile with the required data.