salesagility / SuiteCRM

SuiteCRM - Open source CRM for the world
https://www.suitecrm.com
GNU Affero General Public License v3.0
4.29k stars 2.04k forks source link

Fix #10345 Microsoft Azure OAuth Redirect URL doesn't allow the query string. #10346

Open chris001 opened 5 months ago

chris001 commented 5 months ago

Description

Setting up MS Azure OAuth for email accounts was failing because Suite docs say use a Redirect URL containing a query string, and Azure forbids Redirect URLs with query strings. My fix involves adding a line to the .htaccess to rewrite the incoming Redirect URL compatible with Microsoft Azure OAuth, to the query-string type of Redirect URL expected by Suite.

Motivation and Context

Microsoft Azure OAuth does not allow Redirect URL to have query strings, which is the exact type of URL Suite uses.

How To Test This

Try creating an application in Azure according to the documentation. At one point, it will have you paste the Suite Redirect URL into Microsoft Azure application. Paste the URL with query strings from the docs.
Azure will refuse to save it because query strings are not allowed. Azure OAuth Redirect URL may not coontain a query string Try again with the URL like this instead: https://suite.mysite.tld/entryPoint/setExternalOAuthToken Azure will save this Redirect URL. And Suite will accept the Redirect URL during the OAuth email account login, because Suite will internally rewrite the incoming Redirect URL from Azure, to the expected URL https://suite.mysite.tld/index.php?entryPoint=setExternalOAuthToken, Suite will receive the token back from Azure OAuth, making OAuth login to the MS Azure email account work.

Types of changes

Final checklist

SuiteBot commented 5 months ago

This pull request has been mentioned on SuiteCRM. There might be relevant details there:

https://community.suitecrm.com/t/oauth-redirect-url-breaking-change/91715/5