Multitenant setup with multiplexer "common" for authentication

[eosseylecko]

I developed a Tab Teams application in Typescript with the architecture provided by the Microsoft Teams Toolkit.

I used the backend service "Simple Auth" for user authentication and I converted the azure application and changed the app service configuration to multi-tenant so that the issuer "http://login.microsoftonline.com/common/v2.0" is valid but after several tests, the issuer that I test during the validation "/auth/token" always remains the same "https:/login.microsoftonline.com/{aad-tenant-id}" and I get the error :

Bearer error="invalid_token", error_description="The issuer 'https://login.microsoftonline.com/d5d99b8a-61b5-40bd-975a-923eca104608/v2.0' is invalid"

I don't know how to modify the "TeamsFxSimpleAuth" service to validate the issuer of different tenants with the service so that it uses the "common" multiplexer rather than the tenant's {aad-tenant-id}.

Is there a doc or solution to configure authentication with Microsoft.TeamsFx.SimpleAuth in muti-tenant so that the issuer returned during the validation of token ?

OAUTH_AUTHORITY

https://login.microsoftonline.com/{aad-tenant-id} -> https://login.microsoftonline.com/common

AAD_METADATA_ADDRESS

https://login.microsoftonline.com/{aad-tenant-id}/v2.0/.well-known/openid-configuration -> https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration

[ghost]

Thank you for contacting us! Any issue or feedback from you is quite important to us. We will do our best to fully respond to your issue as soon as possible. Sometimes additional investigations may be needed, we will usually get back to you within 2 days by adding comments to this issue. Please stay tuned.

[KennethBWSong]

Hi @eosseylecko, thank you for your feedback! Our toolkit does not support multi-tenant Azure AD apps, but there is workaround by using CDN. Please follow the steps below:

1. Update line 46-48 in "tabs/public/auth-start.html" by replacing "${context.tid}" to "common" 2.Using CDN in TeamsFx according to this document

Please have a try to see whether the following steps can help you. Thanks a lot!

[eosseylecko]

Hi @KennethBWSong, thank you for your reactivity !

I followed the instructions on a new application to use the workaround with CDN but I still couldn't use the toolkit for multi-tenant use.

1. Update line 46-48 in "tabs/public/auth-start.html" by replacing "${context.tid}" to "common"
2. Create an enpoint on Azure CDN for static website
3. Redeployed application with teams toolkit (provision in the cloud/deploy to the cloud) and change the types of supported account/
4. Update a env.default.json with CDN endpoint and domain

But I always get the same authentication error, I don't know what I did wrong.

[timClyburn]

@KennethBWSong any further info on this? I am also experiencing the same problem (although using the organizations auth url: https://login.microsoftonline.com/organizations/). I have changed the line as advised in the auth-start.html file and have also set the fx-resource-aad-app-for-teams.tenantId value to be 'organizations' for the simple-auth service. Looking at the code for the auth service I can't see a way to disable issuer validation, or to configure valid issuers.

[KennethBWSong]

Hi @eosseylecko and @timClyburn, sorry for late reply. As motioned above, multi-tenant Azure AD app is not officially supported. As for the workaround, we found that the Simple Auth Service also need to be updated. Please follow the steps below.

1. Follow the reply here.
2. Open states/state.${env}.json file and find "endpoint" under "fx-resource-simple-auth", you can get the endpoint of your simple auth server. Note: If you are working on a previous project, you need to open env.default.json file.
3. Clone the Simple Auth from here.
4. Update (this line)[https://github.com/OfficeDev/TeamsFx/blob/6953e053701a65a7545c9496188aaecb9e776266/packages/simpleauth/src/TeamsFxSimpleAuth/SimpleAuthWebApiExtension.cs#L46] from true to false.
5. Publish the code to your simple auth server according to the (tutorial)[https://docs.microsoft.com/en-us/aspnet/core/tutorials/publish-to-azure-webapp-using-vscode?view=aspnetcore-6.0#publish-to-azure-app-service]
6. Go to azure portal and find your simple auth server, open configuration. Replace your tenant id with common in "AAD_METADATA_ADDRESS", and maker sure the tab endpoint is replaced with your cdn endpoint. Save the changes.

Please have a try to see whether the following steps can help you. Thanks a lot!

[timClyburn]

@KennethBWSong, excellent, thank you. This works as expected now.

[StefanSchulzeITP]

Hi @KennethBWSong, hopefully you can help me, too.

We are in the developing an multi tenant app by using TeamsFX Toolkit. We know that this is currently not offical support...

We also get an 401 error while trying to authenticate.

1. We created the app "HELLO-WORLD-TAB" in Visual Studio Code with the current TeamsFX Toolkit and TypeScript
2. Deployed the App to Azure
3. Created an CDN with and Endpoint "example.azureedge.net" pointing to static Website in Blob Storage
4. Changed the Endpoint URL in ".fx/states/state.{env}.json" "fx-resource-frontend-hosting" in "example.azureedge.net"
5. Changed the URL tabs/public/auth-start.html from tenantID to common

After deplyoment we checked and updated the following Settings:

1. Authentication in App Registration a. Checked Redirect-URI is : example.azureedge.net/auth-end.html b. Activated: Accounts in any organizational directory c. Activated "Acces tokes" & "Id tokens"
2. Expose an API in App Registration a. Checked the api is "api//example.azureedge.net/[unique_clientId] b. Checked Scope is "access_as_user"
3. Configration in App Service a. AAD_METADATA_ADDRESS is https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration b. IDENTIFIER_URI is "api//example.azureedge.net/[unique_clientId]" c. OAUTH_AUTHORITY is "https://login.microsoftonline.com/common" | Also test it with "https://login.microsoftonline.com/[hosting_tenantID] d. TAB_APP_ENDPOINT is https:////example.azureedge.net

When we try to login by varius tenant, the Company Application got installed but while authentication we get 401 error.

The single Tenant solution works as expected but the multitenant solution doesn´t. We currently stucked in the publishing process to Teams store till we can fix this issue.

Thank you for support :-)

[KennethBWSong]

Hi @StefanSchulzeITP sorry for late reply and thank you for your feedback! Seems you have not updated the simple auth service. Can you check whether you have followed step 4-5 in this reply?

[StefanSchulzeITP]

Hi @KennethBWSong thanks for your reply. Yes we didn´t updated the Auth Service yet. The reasons is a missunderstanding on our site and hopefully you can advise us a bit more.

Our project is running in TypeScript and the Link to the Service (LINK) is in C# How and where we should update the Service? In Visual Studio Code our Project looks like:

[KennethBWSong]

Hi @StefanSchulzeITP , thank you for your feedback. We are now using simple auth as a backend service for TeamsFx Tab projects for authorization and it is designed to support only single tenant Teams apps. TeamsFx will by default create the simple auth server with "simpleauth" suffix in your resource group, and TeamsFx SDK will call simple auth service to get tokens. To support multi tenant Teams apps, you need to follow the steps below:(as described here)

1. Clone the source code of simple auth server
2. Update this line from true to false.
3. You can find the endpoint of simple auth server by open states/state.${env}.json file and find "endpoint" under "fx-resource-simple-auth". Publish the code to your simple auth server according to the tutorial.

Please have a try to see whether the following steps can help you. Thanks a lot!

[ghost]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 7 days. It will be closed if no further activity occurs within 3 days of this comment. If it is closed, feel free to comment when you are able to provide the additional information and we will re-investigate.

[KonstantinAbragams]

Hi @KennethBWSong, we had the same issue regarding multi-tenant-support and we followed your instructions from this post. This worked well for us, so thank you for that. But now we have a similar problem with azure functions within the same project. We created a new azure function with Teams Toolkit and made adjustments to the configuration:

Only after making these configuration changes, we were able to call the function from the teams tab, but now we run into a error at this line:

Can you help us with this problem?

Thank you in advance, Konstantin

[KennethBWSong]

Hi @KonstantinAbragams, thank you for your feedback. I can repro this error and is investigating how to solve this and will reach you asap.

[KennethBWSong]

Hi @KonstantinAbragams Sorry for late reply. After investigation, we found that you can simply update the function config by:

1. Go to azure portal and find your function app, open configuration. Replace your tenant id with common in "M365_TENANT_ID".

After this step, the function should work well. Please have a try to see whether the following steps can help you. Thanks a lot!

[ghost]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 7 days. It will be closed if no further activity occurs within 3 days of this comment. If it is closed, feel free to comment when you are able to provide the additional information and we will re-investigate.

[K0iram]

Hi Im having a similar issue. I have followed the steps here but it doesn't seem like my Teams toolkit has the simple-auth package as a dependency. I was wondering if there is any updated instructions on how to allow multi-tenant for a teams toolkit app

[KennethBWSong]

@mario7746 Thank you for using our toolkit. Since we are using auth code flow for authentication now, latest projects created by Teams toolkit will not contain simple auth service. Now you can refer to this for multi tenant apps.

[K0iram]

@KennethBWSong Thanks for pointing me to that doc! I followed the steps and now I'm getting the following

OutOfRangeInputOne of the request inputs is out of range

Have you seen this error before?

[KennethBWSong]

@mario7746 Can you share in which step you get this error and the detailed error info with us?

[ghost]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 7 days. As it is labeled with feature-request, it will be manually handled