Skip to content
This page View Markdown Open in ChatGPT Open in Claude

Auth with Azure AD

Your app signs people in with Microsoft Entra ID (Azure AD) and sends the token to API Maker. An auth provider of type Azure checks it against your application registration, finds the person in a table of yours, and runs the call with the groups of that person.
Page API Security → Auth Providers → type Azure.
Header x-azure-authorization: <Azure token>
In code g.req.auth.authAzure : the opened token, and the columns selected from your table.
The provider
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
import * as T from 'types';

let azureTokenGenerator: T.IAuthTokenAzureAD & { name: string; testObj?: any; } = {
    name: 'azure_token_generator',
    appId: '<application (client) id>',
    tenant: '<directory (tenant) id>',
    audience: '',                        // when your tokens carry another audience
    issuer: '',                          // when your tokens carry another issuer
    maxRetries: 3,                       // fetching the signing keys
    sourceFieldOfUniqueId: 'oid',        // or 'preferred_username' for the email
    groupsDataSource: { instance: 'mongodb', database: 'shop', collection: 'users', targetFieldForUniqueId: 'azure_oid', groupsColumn: 'groups', select: { name: 1, email: 1 } },
};
module.exports = azureTokenGenerator;

The groups of the person

  • sourceFieldOfUniqueId is the claim of the token which identifies the person (an email, sub, oid).
  • groupsDataSource names the table of yours which holds that person : targetFieldForUniqueId is the column with the same value, groupsColumn the comma separated groups of the person, select the columns to put in g.req.auth.
  • Without groupsDataSource, the token is checked but the person gets no group of its own : only the API user decides.

Require it

  • authProviders: ['azure_token_generator'] in the settings of the APIs, tables or databases, or in common.authProviders of the secret.
  • The call carries the API user token in x-am-authorization and the token of the provider in x-azure-authorization.
  • testObj in the provider is the person the API testing page pretends to be.