Changed Azure AD Login Flow

[shabirjan]

Added Hybrid Flow for Authorization grant to reterive user id_token. Changed Redirect from Get to Post as Hybrid Flow needs form_post instead of query and returns the response as Form body.

[tpatel]

hello @shabirjan, I think there was a misunderstanding, in your code in backend/chainlit/server.py, you are changing the behavior for folks who are doing GET /auth/oauth/{provider_id}/callback, and this isn't something we can do.

Could you separate the code from GET /auth/oauth/{provider_id}/callback and POST /auth/oauth/azure-ad/callback to make sure we don't break other oauth providers?

[shabirjan]

hello @shabirjan, I think there was a misunderstanding, in your code in backend/chainlit/server.py, you are changing the behavior for folks who are doing GET /auth/oauth/{provider_id}/callback, and this isn't something we can do.

Could you separate the code from GET /auth/oauth/{provider_id}/callback and POST /auth/oauth/azure-ad/callback to make sure we don't break other oauth providers?

Hi @tpatel , Can you please explain a bit, what exactly you need me to do? What code should I separate?

[tpatel]

hi @shabirjan, I've been working on this PR so that we can merge your changes. However I tried to look for the reason behind the PR and I could gather that you're interested by getting the user role?

Would this following snippet (without the code changes from this PR) work for your needs?

@cl.oauth_callback
def oauth_callback(
  provider_id: str,
  token: str,
  raw_user_data: Dict[str, str],
  default_user: cl.User,
) -> Optional[cl.User]:
  
  import httpx
  res = httpx.get("https://graph.microsoft.com/v1.0/me/appRoleAssignments", headers={"Authorization": f"Bearer {token}"})
  print(res.json()) # This contains the user "App Roles Assignments"

  return default_user

[shabirjan]

hi @tpatel , We already discussed almost 2-3 month ago on the call, that we can't use that endpoint as it returns user roles for all the AAD Applications in the tenant for that specific user, which we are not looking for. Our use case for that implementation was check the role assigned to the currently logged in user on behalf of the Specific AAD App Registration.

[tpatel]

closing in favor of https://github.com/Chainlit/chainlit/pull/1046 (I've implemented the azure hybrid flow as needed in a separate oauth provider and route so that it doesn't brake the integration for other users).