Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
@outlinewiki/passport-azure-ad-oauth2
Advanced tools
Readme
Passport strategy for authenticating with Azure AD using the OAuth 2.0 protocol.
$ npm install @outlinewiki/passport-azure-ad-oauth2
The Azure AD OAuth 2.0 authentication strategy authenticates requests by delegating to Azure AD using the OAuth 2.0 protocol.
Applications must supply a verify
callback which accepts an accessToken
, refresh_token
, params
and service-specific profile
, and then calls the done
callback supplying a user
, which should be set to false
if the credentials are not valid. If an exception occured, err
should be set.
clientID
: specifies the client id of the application that is registered in Azure Active Directory.clientSecret
: secret used to establish ownership of the client Id.callbackURL
: URL to which Azure AD will redirect the user after obtaining authorization.resource
: [optional] the App ID URI of the web API (secured resource).tenant
: [optional] tenant domain (e.g.: contoso.onmicrosoft.com).useCommonEndpoint
: [optional] use "https://login.microsoftonline.com/common" instead of default endpoint (https://login.microsoftonline.com/{tenant}). This is typically enabled if you're using this for a Multi-tenant application in Azure AD (Default: false
).passport.use(new AzureAdOAuth2Strategy({
clientID: '{YOUR_CLIENT_ID}',
clientSecret: '{YOUR_CLIENT_SECRET}',
callbackURL: 'https://www.example.net/auth/azureadoauth2/callback',
resource: '00000002-0000-0000-c000-000000000000',
tenant: 'contoso.onmicrosoft.com'
},
function (accessToken, refresh_token, params, profile, done) {
// currently we can't find a way to exchange access token by user info (see userProfile implementation), so
// you will need a jwt-package like https://github.com/auth0/node-jsonwebtoken to decode id_token and get waad profile
var waadProfile = profile || jwt.decode(params.id_token);
// this is just an example: here you would provide a model *User* with the function *findOrCreate*
User.findOrCreate({ id: waadProfile.upn }, function (err, user) {
done(err, user);
});
}));
Use passport.authenticate()
, specifying the 'azure'
strategy, to authenticate requests.
For example, as route middleware in an Express application:
app.get('/auth/azureadoauth2',
passport.authenticate('azure'));
app.get('/auth/azureadoauth2/callback',
passport.authenticate('azure', { failureRedirect: '/login' }),
function (req, res) {
// Successful authentication, redirect home.
res.redirect('/');
});
$ npm install
$ npm test
If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
This project is licensed under the MIT license. See the LICENSE file for more info.
FAQs
Passport strategy for authenticating with Azure AD using the OAuth 2.0 protocol.
The npm package @outlinewiki/passport-azure-ad-oauth2 receives a total of 533 weekly downloads. As such, @outlinewiki/passport-azure-ad-oauth2 popularity was classified as not popular.
We found that @outlinewiki/passport-azure-ad-oauth2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.