search

microsoft / AzureBot

This is the source code which runs the Microsoft AzureBot.
http://aka.ms/AzureBot
MIT License
170 stars 106 forks source link

Support MSA Auth #108

Open dtzar opened 8 years ago

dtzar commented 8 years ago

Currently AzureBoth only supports authentication using Azure Active Directory accounts, not Microsoft accounts (i.e. Outlook, Hotmail, etc). We depend on the AuthBot https://github.com/matvelloso/AuthBot, so this functionality enhancement should happen there. Enhancement would be making auth work with MSA.

Bugs would be not graceful handling of when you authenticate with MSA account to let people know we don't support MSA. 1) MSA is global admin of tenant - you get: "message": "An error has occurred.", "exceptionMessage": "AADSTS65001: The user or administrator has not consented to use the application with ID '88443132-9b52-485d-90ed-49f37efd1c2b'. Send an interactive authorization request for this user and resource.” 2) MSA is just a user in the directory - you get an infinite spinning wheel like this: image

aloneguid commented 8 years ago

I have the same problem, and it doesn't work on some AAD accounts also, specifically ones replicated from on premises.

dtzar commented 8 years ago

@aloneguid are the AAD accounts replicated from on-premises which don't work global admins by chance?

aloneguid commented 8 years ago

@dtzar no, they aren't definitely. It works randomly on some subscriptions. I can't put my finger on what's special about accounts which do and don't unfortunately.

Bennoo commented 8 years ago

Hello here, is there a workaround to use the bot with a Hotmail account? I really would like to try it.. Thanks

nzthiago commented 8 years ago

At the moment with the current code there's no workaround, you'd have to create a user in your AAD domain and use that to sign in.

One flow you can implement is to ask the user for their subscription ID, then use the subscription ID to determine what tenant the user is in, then finally, sign the user in to that tenant using the / endpoint instead of /common. See: https://azure.microsoft.com/en-us/documentation/articles/resource-manager-api-authentication/ This would work for @hotmail.com and other consumer Microsoft accounts, but would have to be a version of the bot that's not hosted by Microsoft.