Azure AD B2C

[snowsky]

Azure AD B2C

[snowsky]

Here you go 👍

  - name: OAUTH2_B2C_ENABLED
    value: true
  - name: OAUTH2_ENABLED
    value: true
  - name: OAUTH2_REQUEST_PERMISSIONS
    value: "openid email profile"
  - name: OAUTH2_CLIENT_ID
    value: xxxxxxxxx
  - name: OAUTH2_SECRET
    value: xxxxxxxxx
  - name: OAUTH2_SERVER_URL
    value: "https://B2C_TENANT_NAME.b2clogin.com/B2C_TENANT_NAME.onmicrosoft.com/B2C_POLICY_NAME"
  - name: OAUTH2_AUTH_ENDPOINT
    value: /oauth2/v2.0/authorize
  - name: OAUTH2_TOKEN_ENDPOINT
    value: /oauth2/v2.0/token
  - name: OAUTH2_USERNAME_MAP
    value: sub
  - name: OAUTH2_EMAIL_MAP 
    value: email
  - name: OAUTH2_FULLNAME_MAP 
    value: name
  - name: OAUTH2_ID_MAP
    value: sub

[xet7]

@snowsky

Thanks! I added those settings to wiki:

https://github.com/wekan/wekan/wiki/B2C

[xet7]

@snowsky

Do you mean some custom endpoint like at Auth0 ?

https://github.com/wekan/wekan/wiki/OAuth2#auth0

Or ADFS ?

https://github.com/wekan/wekan/wiki/ADFS

Or something even more custom, where OIDC/OAuth2 was modifies to support ORACLE OIM ? Look at related commits at this wiki page:

https://github.com/wekan/wekan/wiki/Oracle-OIM

[xet7]

@snowsky

Code is here at directories wekan-accounts-oidc and wekan-oidc:

https://github.com/wekan/wekan/tree/main/packages

Here is how to build wekan and submit pull request:

https://github.com/wekan/wekan/wiki/Emoji

[snowsky]

@xet7 thanks for the prompt response 👍 I think I found something may help for the case. Will keep you posted.

[snowsky]

From

wekan/packages/wekan-oidc/oidc_server.js

Line 32 in 5a9a5df

if(claimsInAccessToken)

, if OAUTH2_ADFS_ENABLED is set to true, the user info endpoint of B2C is not required.

The issue now is the user info returned from Azure B2C has emails (array) instead of email (string):

XXX: userinfo: {
...
  name: 'a a',
  given_name: 'a',
  family_name: 'a',
  emails: [ '<EMAIL_1>' ],
  ...
}

Probably is it possible to work with both emails and email?

Thanks!

[xet7]

@snowsky

Please try WeKan v7.24 , settings are at https://github.com/wekan/wekan/wiki/B2C

[snowsky]

Thanks @xet7. It works 👍 by setting OAUTH2_USERNAME_MAP to sub, but didn't work if set to email.

[xet7]

@snowsky

Do you use any other OAUTH2 settings, than those listed at https://github.com/wekan/wekan/wiki/B2C ? Please list all those remaining settings, anonymized, so that I can add them to that wiki page. Thanks!