mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-05-04 18:08:46 +03:00
Azure AD sign-in to Gov Cloud (GCC HIGH) tenant. #2684
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @smccutchen on GitHub (Feb 28, 2022).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
I am attempting to setup Azure AD authentication in Bookstack, targeting a GCC High (Gov Cloud) tenant.
There is a key difference for Azure Gov Cloud customers when accessing the API... specifically we must access ".us" endpoints instead of the commercial ".com" endpoints.
So the URL "https://login.microsoftonline.com" is really "https://login.microsoftonline.us" for GCC High customers.
In Bookstack, there appears to be no way to define which Azure cloud environment to authenticate against, and when registering a new user or attempting to login to an existing one I receive the following error:
Client error:POST https://login.microsoftonline.com/%7Bc546c644-76a8-7be7-bece-26daa0c55af9%6D/oauth2/v2.0/tokenresulted in a400 Bad Requestresponse: {"error":"invalid_request","error_description":"AADSTS900432: Confidential Client is not supported in Cross Cloud request (truncated...)It appears that Bookstack always attempts to authenticate against the public Azure cloud, and I have seen no override settings in the documentation that would allow me to redirect these requests to the Azure Gov cloud.
Exact BookStack Version
22.02.1
Log Content
Logs
PHP Version
8.1
Hosting Environment
Ubuntu 18.04 in AWS, behind SSL load balancer.
@smccutchen commented on GitHub (Feb 28, 2022):
Note that the Azure cloud tenant URLs for Graph and Base tenant are both hard-coded in the file @ /var/www/Bookstack/vendor/socialiteproviders/microsoft-azure/Provider.php.
@ssddanbrown commented on GitHub (Feb 28, 2022):
Hi @smccutchen,
Customization of the base URL is not something that's currently supported, so I guess this may be more of a feature request to add support.
To be honest I try not to expand support of our auth systems unless significant need/desire, especially to suit scenarios that I won't be able to really test myself. We do provide some methods of extension though.
First though, just to understand your requirement, are you intending to use Azure as the primary method of authentication within your instance or is it simply going to be a supporting/secondary option?
@smccutchen commented on GitHub (Feb 28, 2022):
Azure AD signup/signin will be our primary (only) method of authentication.
I was able to get a successful registration by modifying the file @ /var/www/Bookstack/vendor/socialiteproviders/microsoft-azure/Provider.php to use the appropriate .us URLs for gov cloud tenants.
I suppose that hard-coded fix is good enough for me (I should be able to template out the change through our deployment automation to survive through Bookstack version upgrades), but at least now you're aware of the issue! A better fix in the future would be to simply allow the admin to override the endpoint URLs in the .env file (like "AZURE_APP_BASE_URL" and "AZURE_APP_GRAPH_URL" or something similar).
Thanks for the quick reply.
@ssddanbrown commented on GitHub (Feb 28, 2022):
@smccutchen Cool, The reason I asked is because you may be better suited to use our OIDC integration which would act as a primary authentication system (Replace the default email/password to avoid confusion).
Since it's abstract, there's nothing in our OIDC system tied to a specific Azure endpoint so should work for your use-case without editing files.
If you did want to keep the current setup (Azure via social provider option), it should be possible to achieve your override without editing core app files (and thus potentially causing issues on upgrade) via our logical theme system:
https://github.com/BookStackApp/BookStack/blob/development/dev/docs/logical-theme-system.md#custom-socialite-service-example
@ssddanbrown commented on GitHub (Mar 7, 2022):
Since the above was answered I'll therefore close this off.