Closed arribatec-cloud-1 closed 9 months ago
I investigated this further and .... well let's just say MicrosoftSSO has no error handling what-so-ever. I might submit a PR at some point if I get it to work.
If you need a patch straight away, put this in the top of MicrosoftSSO.openid_from_response()
:
from fastapi_sso.sso.base SSOLoginError
error = response.get("error")
if error:
raise SSOLoginError(401, f"Error '{pprint.pformat(error)}' returned from Microsoft")
I believe some tenants require to ask for email
scope directly, it is now a default in 0.8.0 https://github.com/tomasvotava/fastapi-sso/releases/tag/0.8.0
Could you test if this resolves the problem for you?
I did not test your suggestion, but it is aligning well with what I found what worked for me in the end; to omit the scope parameter from MicrosoftSSO constructor altogether. I used to have it set to ["openid"] which would override the default of ["openid", "User.Read"]. It could also just be luck/timing of the 10 times I created and changed my application settings and credentials inside Azure...
I guess just providing an example/documentation would solve this issue.
Anyways, thanks for looking at my issue!
Lennart Rolland Senior Cloud Consultant @.*** +4797688353
From: Tomas Votava @.> Sent: Friday, November 24, 2023 6:36 PM To: tomasvotava/fastapi-sso @.> Cc: Lennart Rolland @.>; Author @.> Subject: Re: [tomasvotava/fastapi-sso] missing "mail" in response with Microsoft SSO (Issue #81)
You don't often get email from @.*** Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification
I believe some tenants require to ask for email scope directly, it is now a default in 0.8.0 https://github.com/tomasvotava/fastapi-sso/releases/tag/0.8.0
Could you test if this resolves the problem for you?
— Reply to this email directly, view it on GitHubhttps://github.com/tomasvotava/fastapi-sso/issues/81#issuecomment-1825949756, or unsubscribehttps://github.com/notifications/unsubscribe-auth/A5HPLK4KR2B5SQL5EGKA6DTYGDLKDAVCNFSM6AAAAAA6PLOXVKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMRVHE2DSNZVGY. You are receiving this because you authored the thread.Message ID: @.***>
That's a good idea, I've added a simple post to guide users who struggle with this as well, thanks!
https://tomasvotava.github.io/fastapi-sso/how-to-guides/key-error/
I have set up an application in Azure with credentials.
When I try to log in using said credentials as per the examples, the call fails with a missing key error:
The code looks like this: