OpenID Connect Windows AAD

OpenID Connect plugin for Windows Azure AD authentication

This small module is a plugin for the great module OpenID Connect and focuses on integration with Windows Azure AD.

Basically, Windows Azure AD connection can be achieved by using the Generic client in OpenID Connect. Unfortunately, Windows Azure does not support the use of the regular JWT access tokens. When we want to retrieve the UserInfo (email address, name), we need to do a separate request and map the results on existing fields for the user. This module uses the access token to do this second request to Windows Azure AD, resulting in the UserInfo data.

See also:

• Cannot access OpenID UserInfo endpoint on Azure
• UserInfo endpoint doesn't work with Microsoft Azure Graph API

** Update ** JWT seems to be supported as of 2017.

'No e-mail address provided'

This module will also check if an email address is part of the UserInfo data. In case no email is there, it will still create the user, but use the username instead, providing a notice to prompt the user to change it in his/her user settings. This message to the user is optional.

Graph API to enrich the user data

Latest version adds an option to the settings page that enables the use of the Graph API instead of the Open ID Connect userinfo endpoint. It brings more fields of the user profile. There is also an option to use another property for email address (when using Graph). Finally, it is optional to to update existing user's email address in case another email address property is used.

Roadmap

• Latest information shows that JWT seems to be supported by Windows Azure, so a Drupal 7 update will follow as well: this module will then be mainly interesting because of the 'No e-mail address provided'-issue and Graph API usage.