Chapter 4. Authentication with Microsoft Azure

Prerequisites

• You have enabled authentication with Microsoft Azure.

Procedure

• To enable Microsoft Azure member discovery, edit your custom Developer Hub ConfigMap, such as app-config-rhdh, and add following lines to the app-config-rhdh.yaml content:

  app-config.yaml fragment with mandatory microsoftGraphOrg fields

  dangerouslyAllowSignInWithoutUserInCatalog: false
  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          target: https://graph.microsoft.com/v1.0
          tenantId: ${AUTH_AZURE_TENANT_ID}
          clientId: ${AUTH_AZURE_CLIENT_ID}
          clientSecret: ${AUTH_AZURE_CLIENT_SECRET}

  dangerouslyAllowSignInWithoutUserInCatalog: false

  Allow authentication only for users in the Developer Hub software catalog.

  target: https://graph.microsoft.com/v1.0

  Defines the MSGraph API endpoint the provider is connecting to. You might change this parameter to use a different version, such as the beta endpoint.

  tenandId, clientId and clientSecret

  Use the Developer Hub application information you created in Microsoft Azure and configured in OpenShift as secrets.

  Optional: Consider adding the following optional microsoftGraphOrg.providerId fields:

  authority: https://login.microsoftonline.com

  Defines the authority used. Change the value to use a different authority, such as Azure US government. Default value: https://login.microsoftonline.com.

  app-config.yaml fragment with optional queryMode field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          authority: https://login.microsoftonline.com/

  queryMode: basic | advanced

  By default, the Microsoft Graph API only provides the basic feature set for querying. Certain features require advanced querying capabilities. See Microsoft Azure Advanced queries.

  app-config.yaml fragment with optional queryMode field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          queryMode: advanced

  user.expand

  To include the expanded resource or collection referenced by a single relationship (navigation property) in your results. Only one relationship can be expanded in a single request. See Microsoft Graph query expand parameter. This parameter can be combined with ] or xref:userFilter[.

  app-config.yaml fragment with optional user.expand field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          user:
            expand: manager

  user.filter

  To filter users. See Microsoft Graph API and Microsoft Graph API query filter parameters syntax. This parameter and ???TITLE??? are mutually exclusive, only one can be specified.

  app-config.yaml fragment with optional user.filter field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          user:
            filter: accountEnabled eq true and userType eq 'member'

  user.loadPhotos: true | false

  Load photos by default. Set to false to not load user photos.

  app-config.yaml fragment with optional user.loadPhotos field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          user:
            loadPhotos: true

  user.select

  Define the Microsoft Graph resource types to retrieve.

  app-config.yaml fragment with optional user.select field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          user:
            select: ['id', 'displayName', 'description']

  userGroupMember.filter

  To use group membership to get users. To filter groups and fetch their members. This parameter and ???TITLE??? are mutually exclusive, only one can be specified.

  app-config.yaml fragment with optional userGroupMember.filter field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          userGroupMember:
            filter: "displayName eq 'Backstage Users'"

  userGroupMember.search

  To use group membership to get users. To search for groups and fetch their members. This parameter and ???TITLE??? are mutually exclusive, only one can be specified.

  app-config.yaml fragment with optional userGroupMember.search field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          userGroupMember:
            search: '"description:One" AND ("displayName:Video" OR "displayName:Drive")'

  group.expand

  Optional parameter to include the expanded resource or collection referenced by a single relationship (navigation property) in your results. Only one relationship can be expanded in a single request. See https://docs.microsoft.com/en-us/graph/query-parameters#expand-parameter This parameter can be combined with ] instead of xref:userFilter[.

  app-config.yaml fragment with optional group.expand field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          group:
            expand: member

  group.filter

  To filter groups. See Microsoft Graph API query group syntax.

  app-config.yaml fragment with optional group.filter field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          group:
            filter: securityEnabled eq false and mailEnabled eq true and groupTypes/any(c:c+eq+'Unified')

  group.search

  To search for groups. See Microsoft Graph API query search parameter.

  app-config.yaml fragment with optional group.search field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          group:
            search: '"description:One" AND ("displayName:Video" OR "displayName:Drive")'

  group.select

  To define the Microsoft Graph resource types to retrieve.

  app-config.yaml fragment with optional group.select field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          group:
            select: ['id', 'displayName', 'description']

  schedule.frequency

  To specify custom schedule frequency. Supports cron, ISO duration, and "human duration" as used in code.

  app-config.yaml fragment with optional schedule.frequency field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          schedule:
            frequency: { hours: 1 }

  schedule.timeout

  To specify custom timeout. Supports ISO duration and "human duration" as used in code.

  app-config.yaml fragment with optional schedule.timeout field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          schedule:
            timeout: { minutes: 50 }

  schedule.initialDelay

  To specify custom initial delay. Supports ISO duration and "human duration" as used in code.

  app-config.yaml fragment with optional schedule.initialDelay field

  catalog:
    providers:
      microsoftGraphOrg:
        providerId:
          schedule:
            initialDelay: { seconds: 15}