Skip to content

Commit

Permalink
chore: change Azure AD to Azure Entra ID
Browse files Browse the repository at this point in the history
  • Loading branch information
JonasKs committed Oct 15, 2024
1 parent 97dee6c commit 2256921
Show file tree
Hide file tree
Showing 19 changed files with 52 additions and 49 deletions.
2 changes: 1 addition & 1 deletion .github/ISSUE_TEMPLATE/bug-report-question.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ Steps to reproduce the behavior:
3. See error
If this can be related to your Azure AD set up, please also provide screenshots/reproduce steps of that.
If this can be related to your Azure Entra ID set up, please also provide screenshots/reproduce steps of that.
Blur sensitive data.
-->

Expand Down
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
</h1>

<p align="center">
<em>Azure AD Authentication for FastAPI apps made easy.</em>
<em>Azure Entra ID Authentication for FastAPI apps made easy.</em>
</p>
<p align="center">
<!-- Line 1 -->
Expand Down Expand Up @@ -59,7 +59,7 @@ Also, [we're hiring!](https://intility.no/en/career/)

## 📚 Resources

The [documentation](https://intility.github.io/fastapi-azure-auth/) contains a full tutorial on how to configure Azure AD
The [documentation](https://intility.github.io/fastapi-azure-auth/) contains a full tutorial on how to configure Azure Entra ID
and FastAPI for single- and multi-tenant applications as well as B2C apps. It includes examples on how to lock down
your APIs to certain scopes, tenants, roles etc. For first time users it's strongly advised to set up your
application exactly how it's described there, and then alter it to your needs later.
Expand Down
10 changes: 5 additions & 5 deletions docs/docs/b2c/azure_setup.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Azure configuration
sidebar_position: 1
---

We'll need to create two application registrations for Azure AD B2C authentication to cover both direct API
We'll need to create two application registrations for Azure Entra ID B2C authentication to cover both direct API
use and usage from the OpenAPI (swagger) documentation.

:::info
Expand All @@ -15,7 +15,7 @@ This guide assumes that an Azure B2C tenant was already created and linked to an

### Step 1 - Create app registration
Head over to
[Azure -> Azure AD B2C -> App registrations](https://portal.azure.com/#view/Microsoft_AAD_B2CAdmin/TenantManagementMenuBlade/~/registeredApps),
[Azure -> Azure Entra ID B2C -> App registrations](https://portal.azure.com/#view/Microsoft_AAD_B2CAdmin/TenantManagementMenuBlade/~/registeredApps),
and create a new registration.

Select a fitting name for your project; Azure will present the name to the user during consent.
Expand Down Expand Up @@ -56,7 +56,7 @@ OPENAPI_CLIENT_ID=
AUTH_POLICY_NAME=
```

Also, in the Azure AD B2C overview get the tenant name from the domain name (without the `.onmicrosoft.com` part)
Also, in the Azure Entra ID B2C overview get the tenant name from the domain name (without the `.onmicrosoft.com` part)
and add it to the `.env` file as well:

```bash title=".env" {1}
Expand Down Expand Up @@ -97,7 +97,7 @@ So, let's set it up!
Just like in the previous chapter, we have to create an application registration for our OpenAPI.

Head over to
[Azure -> Azure AD B2C -> App registrations](https://portal.azure.com/#view/Microsoft_AAD_B2CAdmin/TenantManagementMenuBlade/~/registeredApps),
[Azure -> Azure Entra ID B2C -> App registrations](https://portal.azure.com/#view/Microsoft_AAD_B2CAdmin/TenantManagementMenuBlade/~/registeredApps),
and create a new registration.

Use the same name, but with `- OpenAPI` appended to it.
Expand Down Expand Up @@ -157,7 +157,7 @@ That's it! Next step is to configure the FastAPI application.
### Step 1 - Create a user flow
Head over to
[Azure -> Azure AD B2C -> Users flows](https://portal.azure.com/#view/Microsoft_AAD_B2CAdmin/TenantManagementMenuBlade/~/userJourneys),
[Azure -> Azure Entra ID B2C -> Users flows](https://portal.azure.com/#view/Microsoft_AAD_B2CAdmin/TenantManagementMenuBlade/~/userJourneys),
and create a new user flow.
Select a user flow type of `Sign up and sign in` with the Version `Recommended`, then press **Create**.
Expand Down
6 changes: 3 additions & 3 deletions docs/docs/b2c/fastapi_configuration.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,8 @@ if __name__ == '__main__':
Run your application and ensure that everything works on [http://localhost:8000/docs](http://localhost:8000/docs)

:::info
You need to run the application on the configured port in Azure AD B2C for the next steps to work! If you are unsure,
revisit the previous chapter or review the Azure AD B2C configuration under `App Registrations` -> `Authentication`.
You need to run the application on the configured port in Azure Entra ID B2C for the next steps to work! If you are unsure,
revisit the previous chapter or review the Azure Entra ID B2C configuration under `App Registrations` -> `Authentication`.
:::

## Add your settings
Expand Down Expand Up @@ -188,7 +188,7 @@ if __name__ == '__main__':
uvicorn.run('main:app', reload=True)
```

The `swagger_ui_oauth2_redirect_url` setting for redirect should be as configured in Azure AD.
The `swagger_ui_oauth2_redirect_url` setting for redirect should be as configured in Azure Entra ID.
The `swagger_ui_init_oauth` are standard mapped OpenAPI properties. You can find documentation about them [here](https://swagger.io/docs/open-source-tools/swagger-ui/usage/oauth2/)

We've used two flags: `usePkceWithAuthorizationCodeGrant`, which is the authentication flow.
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/introduction.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,13 @@ import GitHubButton from 'react-github-btn';
<h1>FastAPI-Azure-Auth</h1>
</p>
<p>
<em>Azure AD Authentication for FastAPI apps made easy.</em>
<em>Azure Entra ID Authentication for FastAPI apps made easy.</em>
</p>
</div>



**FastAPI-Azure-Auth** implements Azure AD and Azure AD B2C authentication and authorization
**FastAPI-Azure-Auth** implements Azure Entra ID and Azure Entra ID B2C authentication and authorization
for your FastAPI APIs and OpenAPI documentation.

In the sidebar to the left you'll be able to find information on how to configure both Azure and your FastAPI application.
Expand Down
2 changes: 1 addition & 1 deletion docs/docs/multi-tenant/azure_setup.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Azure configuration
sidebar_position: 1
---

We'll need to create two application registrations for Azure AD authentication to cover both direct API
We'll need to create two application registrations for Azure Entra ID authentication to cover both direct API
use and usage from the OpenAPI (swagger) documentation.

We'll start with the API.
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/multi-tenant/fastapi_configuration.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ if __name__ == '__main__':
Run your application and ensure that everything works on [http://localhost:8000/docs](http://localhost:8000/docs)

:::info
You need to run the application on the configured port in Azure AD for the next steps to work!
You need to run the application on the configured port in Azure Entra ID for the next steps to work!
:::

## Add your settings
Expand Down Expand Up @@ -177,7 +177,7 @@ if __name__ == '__main__':
uvicorn.run('main:app', host='localhost', port=8000, reload=True)
```

The `swagger_ui_oauth2_redirect_url` setting for redirect should be as configured in Azure AD.
The `swagger_ui_oauth2_redirect_url` setting for redirect should be as configured in Azure Entra ID.
The `swagger_ui_init_oauth` are standard mapped OpenAPI properties. You can find documentation about them [here](https://swagger.io/docs/open-source-tools/swagger-ui/usage/oauth2/)

We've used two flags: `usePkceWithAuthorizationCodeGrant`, which is the authentication flow.
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/settings/b2c.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ sidebar_position: 3
### app_client_id: `str`
**Default**: `None`

Your applications client ID. This will be the `Web app` in Azure AD
Your applications client ID. This will be the `Web app` in Azure Entra ID

-----------------

Expand All @@ -20,7 +20,7 @@ Override OpenID config URL (used for B2C tenants)
### scopes: `Optional[dict[str, str]]`
**Default:** `None`

Scopes, these are the ones you've configured in Azure AD B2C. Key is scope, value is a description.
Scopes, these are the ones you've configured in Azure Entra ID B2C. Key is scope, value is a description.

```python
{
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/settings/multi_tenant.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ sidebar_position: 2
### app_client_id: `str`
**Default**: `None`

Your applications client ID. This will be the `Web app` in Azure AD
Your applications client ID. This will be the `Web app` in Azure Entra ID

-----------------

Expand All @@ -22,7 +22,7 @@ for more details
### scopes: `Optional[dict[str, str]]`
**Default:** `None`

Scopes, these are the ones you've configured in Azure AD. Key is scope, value is a description.
Scopes, these are the ones you've configured in Azure Entra ID. Key is scope, value is a description.

```python
{
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/settings/single_tenant.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ sidebar_position: 1
### app_client_id: `str`
**Default**: `None`

Your applications client ID. This will be the `Web app` in Azure AD
Your applications client ID. This will be the `Web app` in Azure Entra ID

-----------------

Expand All @@ -29,7 +29,7 @@ for more details
### scopes: `Optional[dict[str, str]]`
**Default:** `None`

Scopes, these are the ones you've configured in Azure AD. Key is scope, value is a description.
Scopes, these are the ones you've configured in Azure Entra ID. Key is scope, value is a description.

```python
{
Expand Down
2 changes: 1 addition & 1 deletion docs/docs/single-tenant/azure_setup.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Azure configuration
sidebar_position: 1
---

We'll need to create two application registrations for Azure AD authentication to cover both direct API
We'll need to create two application registrations for Azure Entra ID authentication to cover both direct API
use and usage from the OpenAPI (swagger) documentation.

We'll start with the API.
Expand Down
4 changes: 2 additions & 2 deletions docs/docs/single-tenant/fastapi_configuration.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ if __name__ == '__main__':
Run your application and ensure that everything works on [http://localhost:8000/docs](http://localhost:8000/docs)

:::info
You need to run the application on the configured port in Azure AD for the next steps to work!
You need to run the application on the configured port in Azure Entra ID for the next steps to work!
:::

## Add your settings
Expand Down Expand Up @@ -175,7 +175,7 @@ if __name__ == '__main__':
uvicorn.run('main:app', reload=True)
```

The `swagger_ui_oauth2_redirect_url` setting for redirect should be as configured in Azure AD.
The `swagger_ui_oauth2_redirect_url` setting for redirect should be as configured in Azure Entra ID.
The `swagger_ui_init_oauth` are standard mapped OpenAPI properties. You can find documentation about them [here](https://swagger.io/docs/open-source-tools/swagger-ui/usage/oauth2/)

We've used two flags: `usePkceWithAuthorizationCodeGrant`, which is the authentication flow.
Expand Down
2 changes: 1 addition & 1 deletion docs/docusaurus.config.js
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ const darkCodeTheme = require('prism-react-renderer').themes.dracula
/** @type {import('@docusaurus/types').DocusaurusConfig} */
module.exports = {
title: 'FastAPI-Azure-Auth',
tagline: 'Easy and secure implementation of Azure AD for your FastAPI APIs 🔒',
tagline: 'Easy and secure implementation of Azure Entra ID for your FastAPI APIs 🔒',
url: 'https://your-docusaurus-test-site.com',
baseUrl: '/fastapi-azure-auth/',
onBrokenLinks: 'throw',
Expand Down
18 changes: 9 additions & 9 deletions fastapi_azure_auth/auth.py
Original file line number Diff line number Diff line change
Expand Up @@ -50,13 +50,13 @@ def __init__(
Initialize settings.
:param app_client_id: str
Your application client ID. This will be the `Web app` in Azure AD
Your application client ID. This will be the `Web app` in Azure Entra ID
:param auto_error: bool
Whether to throw exceptions or return None on __call__.
:param tenant_id: str
Your Azure tenant ID, only needed for single tenant apps
:param scopes: Optional[dict[str, str]
Scopes, these are the ones you've configured in Azure AD. Key is scope, value is a description.
Scopes, these are the ones you've configured in Azure Entra ID. Key is scope, value is a description.
Example:
{
f'api://{settings.APP_CLIENT_ID}/user_impersonation': 'user impersonation'
Expand Down Expand Up @@ -181,7 +181,7 @@ async def __call__(self, request: HTTPConnection, security_scopes: SecurityScope
# Use the `kid` from the header to find a matching signing key to use
try:
if key := self.openid_config.signing_keys.get(header.get('kid', '')):
# We require and validate all fields in an Azure AD token
# We require and validate all fields in an Azure Entra ID token
required_claims = ['exp', 'aud', 'iat', 'nbf', 'sub']
if self.validate_iss:
required_claims.append('iss')
Expand Down Expand Up @@ -277,13 +277,13 @@ def __init__(
Initialize settings for a single tenant application.
:param app_client_id: str
Your application client ID. This will be the `Web app` in Azure AD
Your application client ID. This will be the `Web app` in Azure Entra ID
:param tenant_id: str
Your Azure tenant ID, only needed for single tenant apps
:param auto_error: bool
Whether to throw exceptions or return None on __call__.
:param scopes: Optional[dict[str, str]
Scopes, these are the ones you've configured in Azure AD. Key is scope, value is a description.
Scopes, these are the ones you've configured in Azure Entra ID. Key is scope, value is a description.
Example:
{
f'api://{settings.APP_CLIENT_ID}/user_impersonation': 'user impersonation'
Expand Down Expand Up @@ -342,11 +342,11 @@ def __init__(
Initialize settings for a multi-tenant application.
:param app_client_id: str
Your application client ID. This will be the `Web app` in Azure AD
Your application client ID. This will be the `Web app` in Azure Entra ID
:param auto_error: bool
Whether to throw exceptions or return None on __call__.
:param scopes: Optional[dict[str, str]
Scopes, these are the ones you've configured in Azure AD. Key is scope, value is a description.
Scopes, these are the ones you've configured in Azure Entra ID. Key is scope, value is a description.
Example:
{
f'api://{settings.APP_CLIENT_ID}/user_impersonation': 'user impersonation'
Expand Down Expand Up @@ -413,13 +413,13 @@ def __init__(
"""
Initialize settings for a B2C multi-tenant application.
:param app_client_id: str
Your application client ID. This will be the `Web app` in Azure AD
Your application client ID. This will be the `Web app` in Azure Entra ID
:param openid_config_url: str
Override OpenID config URL (used for B2C tenants)
:param auto_error: bool
Whether to throw exceptions or return None on __call__.
:param scopes: Optional[dict[str, str]
Scopes, these are the ones you've configured in Azure AD. Key is scope, value is a description.
Scopes, these are the ones you've configured in Azure Entra ID. Key is scope, value is a description.
Example:
{
f'api://{settings.APP_CLIENT_ID}/user_impersonation': 'user impersonation'
Expand Down
8 changes: 4 additions & 4 deletions fastapi_azure_auth/openid_config.py
Original file line number Diff line number Diff line change
Expand Up @@ -38,23 +38,23 @@ async def load_config(self) -> None:
refresh_time = datetime.now() - timedelta(hours=24)
if not self._config_timestamp or self._config_timestamp < refresh_time:
try:
log.debug('Loading Azure AD OpenID configuration.')
log.debug('Loading Azure Entra ID OpenID configuration.')
await self._load_openid_config()
self._config_timestamp = datetime.now()
except Exception as error:
log.exception('Unable to fetch OpenID configuration from Azure AD. Error: %s', error)
log.exception('Unable to fetch OpenID configuration from Azure Entra ID. Error: %s', error)
# We can't fetch an up to date openid-config, so authentication will not work.
if self._config_timestamp:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail='Connection to Azure AD is down. Unable to fetch provider configuration',
detail='Connection to Azure Entra ID is down. Unable to fetch provider configuration',
headers={'WWW-Authenticate': 'Bearer'},
) from error

else:
raise RuntimeError(f'Unable to fetch provider information. {error}') from error

log.info('fastapi-azure-auth loaded settings from Azure AD.')
log.info('fastapi-azure-auth loaded settings from Azure Entra ID.')
log.info('authorization endpoint: %s', self.authorization_endpoint)
log.info('token endpoint: %s', self.token_endpoint)
log.info('issuer: %s', self.issuer)
Expand Down
8 changes: 4 additions & 4 deletions fastapi_azure_auth/user.py
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ class Claims(BaseModel):
)
iss: str = Field(
...,
description='Identifies the STS that constructs and returns the token, and the Azure AD tenant of the'
description='Identifies the STS that constructs and returns the token, and the Azure Entra ID tenant of the'
' authenticated user. If the token issued is a v2.0 token (see the ver claim), the URI ends in /v2.0.',
)
idp: Optional[str] = Field(
Expand All @@ -39,7 +39,7 @@ class Claims(BaseModel):
)
aio: Optional[str] = Field(
default=None,
description='An internal claim used by Azure AD to record data for token reuse. Resources should not use this claim.',
description='An internal claim used by Azure Entra ID to record data for token reuse. Resources should not use this claim.',
)
name: Optional[str] = Field(
default=None,
Expand All @@ -55,7 +55,7 @@ class Claims(BaseModel):
)
wids: List[str] = Field(
default=[],
description='Denotes the tenant-wide roles assigned to this user, from the section of roles present in Azure AD built-in roles.',
description='Denotes the tenant-wide roles assigned to this user, from the section of roles present in Azure Entra ID built-in roles.',
)
groups: List[str] = Field(
default=[],
Expand Down Expand Up @@ -86,7 +86,7 @@ class Claims(BaseModel):
description='Indicates the version of the access token.',
)

# Optional claims, configured in Azure AD
# Optional claims, configured in Azure Entra ID
acct: Optional[int] = Field(
default=None,
description="User's account status in tenant",
Expand Down
5 changes: 4 additions & 1 deletion pyproject.toml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[tool.poetry]
name = "fastapi-azure-auth"
version = "5.0.1" # Remember to change in __init__.py as well
description = "Easy and secure implementation of Azure AD for your FastAPI APIs"
description = "Easy and secure implementation of Azure Entra ID for your FastAPI APIs"
authors = ["Jonas Krüger Svensson <[email protected]>"]
readme = "README.md"
homepage = "https://github.com/intility/fastapi-azure-auth"
Expand All @@ -14,6 +14,9 @@ keywords = [
'authentication',
'azure',
'azure ad',
'azure entra id',
'azure entra',
'entra id',
'azuread',
'fastapi',
'multi tenant',
Expand Down
Loading

0 comments on commit 2256921

Please sign in to comment.