search

BookStackApp / BookStack

A platform to create documentation/wiki content built with PHP & Laravel
https://www.bookstackapp.com/
MIT License
14.88k stars 1.87k forks source link

User authentification with Azure AD (social login) #3769

Closed LbqpdL closed 1 year ago

LbqpdL commented 1 year ago

Attempted Debugging

Searched GitHub Issues

Describe the Scenario

First of all many thanks to the Devs for this tool.

My end goal is to manage my bookstack users from Azure AD. I'm using the Azure AD "free tier" (provided through an Office365 account) which does not come with Azure AD DS (Azure Active Directory Domain Services).

I followed https://www.bookstackapp.com/docs/admin/third-party-auth/ and added the following to my .env file:

AZURE_AUTO_REGISTER=true AZURE_AUTO_CONFIRM_EMAIL=true AZURE_APP_ID=redacted AZURE_APP_SECRET=redacted AZURE_TENANT=redacted

I can now see the "Connect with Azure" option on the login page.

I'm facing two different behaviours, based on whether a user exists already.

Existing user

The connection fails with error message "A user with the address name@domain.tld already exists". Using the standard login for the existing user, I can then in Config > Users > User detail select in "Social networks" > "Link account" After this step, it is possible to connect either through standard login, or through Azure AD.

Questions:

  1. Is it possible to "merge" the standard and Azure AD account in Bookstack, or do I need to keep both accounts ?
  2. Is there a way to "link" all existing users (as presented in the SAML video mentionned below), or is it something that each user as to do themselves ? I tried to link accounts as in the video but it did not work.
  3. If I delete an existing account and recreate it through Azure AD (with same email address), will the existing contributions be recognised automatically ? Is there a way to reconciliate the previous contributions with the new user ?

Non-existing user

I have attributed an existing role to all new accounts (Editor). At first login, a confirmation message says that the account has been created. I can see the account with Editor rights (the option to link the account to Azure is no longer present on this user, which makes sense). However the user is thrown back to "login page" everytime he tries to access any wiki pages. The only page that seems to be available is the welcome page (even though all other users with Editor rights have access to everything).

Questions:

  1. What am I missing ?

Other approach ?

As stated in another issue (https://github.com/BookStackApp/BookStack/issues/3601) "If you're looking to use AzureAD as your main/only auth option, and you want to provide a seamless experience, our SAML2 and OIDC options can both work with AzureAD I believe, with SAML2 having group/role sync support with BookStack (OIDC will gain this in the future). There are a bit more complex to set-up, but may work better (depending on environment and requirements)."

I watched the video on SAML2 configuration (https://www.youtube.com/watch?v=szweYsAow88).

Would there be any ressource / tutorial / pointers to get it working with Azure AD ?

Many thanks for you help.

Exact BookStack Version

BookStack v22.09.1

Log Content

No response

PHP Version

No response

Hosting Environment

Proxmox --> Debian VM / Docker LinuxServer.io SWAG reverse proxy --> Debian VM / Docker LinuxServer.io Bookstack image (docker compose)

ssddanbrown commented 1 year ago

Is it possible to "merge" the standard and Azure AD account in Bookstack, or do I need to keep both accounts ?

I'm not sure what this means in your provided context, The detail above this question mentioned you linked the social account to the existing user, what exactly is being referenced by "both accounts"?

Is there a way to "link" all existing users (as presented in the SAML video mentionned below), or is it something that each user as to do themselves ? I tried to link accounts as in the video but it did not work.

You could kind of pre-link social accounts for users, but this could only be done via the database. I think it's a social_accounts table. The only built-on way is via users to connect themselves.

If I delete an existing account and recreate it through Azure AD (with same email address), will the existing contributions be recognised automatically ? Is there a way to reconciliate the previous contributions with the new user ?

No and not really.

What am I missing ?

I'm not really sure what's happening here to be honest. Does this happen even when just visiting the "Edit Profile" link in the top-right user dropdown? Does refreshing on the homepage also log them out.

Would there be any ressource / tutorial / pointers to get it working with Azure AD ?

I don't provide any AzureAD specific guides for the additional auth methods. I'd probably advise OIDC over SAML now, especially since most of the setup done so far for the social provider will likely be much the same. This VMware guide looks handy in setting this up on the AzureAD side. I'm working on a video at the moment to walk through OIDC for further assistance there.

ssddanbrown commented 1 year ago

If it helps, I've uploaded an OIDC video here: https://www.youtube.com/watch?v=TJQ4NJrMvkw Does not use AzureAD though.

ssddanbrown commented 1 year ago

Since there's been no follow-up I'm going to close this. If needed you can respond to my previous comment and this can then be re-opened.

LbqpdL commented 1 year ago

Hi, sorry for the late reply.

Is it possible to "merge" the standard and Azure AD account in Bookstack, or do I need to keep both accounts ?

I'm not sure what this means in your provided context, The detail above this question mentioned you linked the social account to the existing user, what exactly is being referenced by "both accounts"?

After enabling the "social account" in .env file, I can see two different "types" of account in the backend: those created in Bookstack back-end, and those created directly through the Social Login feature (they have a gravatar type of icon). For an account created in the backend, once I have linked the social account, I can still log in two different ways: through the "classic" login and through the social login (Azure AD) login.

My aim was to delete any kind of "backend" accounts, and only use "Azure AD" accounts (apart from the initial "admin" account), but I understand that this is not possible.

I'm not really sure what's happening here to be honest. Does this happen even when just visiting the "Edit Profile" link in the top-right user dropdown? Does refreshing on the homepage also log them out.

It happens on any link clicked once the login is complete. Also, trying to log from the original "backend" account (linked to socail login) results in a "419 | Page expired" error. This behaviour only happens in Firefox, not in Chrome, it could be linked to my configuration (I use many "privacy" extensions on my Firefox profile).

Which logs could be helpful to debug this issue ?

Would there be any ressource / tutorial / pointers to get it working with Azure AD ?

I don't provide any AzureAD specific guides for the additional auth methods. I'd probably advise OIDC over SAML now, especially since most of the setup done so far for the social provider will likely be much the same. This VMware guide looks handy in setting this up on the AzureAD side. I'm working on a video at the moment to walk through OIDC for further assistance there.

Thank you for the video and the link. I'll have a look at it.