Integration with Entra ID

1

Dear All,

Very happy with Indico for the moment at EPFL.

Does anyone have experience integrating Entra ID (formerly Azure) for account creation?

The only request I have at the moment is that people would like to use their standard EPFL account (which is now a Microsoft account) to log on.

Thanks for any information!

Best,

John

2

It supports OIDC, so it should be fairly straightforward.

See Authentication — Indico 3.3.7-dev documentation and and the example of the authlib provider here; it should be fairly easy to adapt to EntraID.

3

Great, thanks for the keyword!

Is there any documentation on OIDC and Indico?

4

Check the two links in my post :slight_smile:

1 Like
5

I got it working!

Existing accounts with the same email address are merged smoothly.

For future reference, here are the non-confidential settings that worked:

# Authentication and Authorization

_openid_oauth_config = {
    'client_id': 'XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX',
    'client_secret': 'XXXXXXXXXXXXXXXXXXXX',
    'authorize_url': 'https://login.microsoftonline.com/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/oauth2/v2.0/authorize',
    'access_token_url': 'https://login.microsoftonline.com/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/oauth2/v2.0/token',
    'api_base_url': 'https://login.microsoftonline.com/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/v2.0',
    'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo',
    'scope': ['openid', 'profile', 'email'],
    'jwks_uri': 'https://login.microsoftonline.com/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/discovery/v2.0/keys',
}

AUTH_PROVIDERS = {
    'microsoft_auth': {
        'type': 'authlib',
        'title': 'Microsoft Azure',
        'authlib_args': _openid_oauth_config
    }
}

IDENTITY_PROVIDERS = {
    'entra_id': {
        'type': 'authlib',
        'title': 'Microsoft Entra-ID',
        'mapping': {
            'first_name': 'given_name',
            'last_name': 'family_name'
        }
    }
}

PROVIDER_MAP = {
    'microsoft_auth': 'entra_id'
}

Thanks to the developers for the excellent functionality.