This change re-adds the loading of the logged-in user's profile picture
as well as the "skip profile" logic for foreign scopes
which got lost while migrating the Microsoft auth provider to the new module.
Additionally, it uses the 96x96 size instead of 48x48.
The image is used on the profile card on the settings page (`/settings`)
rendered as 96x96 and was blurry due to the upscaling.
Replaces the `types.d.ts` file with type declarations with the use of
`@types/passport-microsoft`.
Closes: #20677Closes: #20699
Signed-off-by: Patrick Jungermann <Patrick.Jungermann@gmail.com>
* Tidy up passing of domain hint from initalisation to later methods
* Tidy up change set
Signed-off-by: Alex Crome <afscrome@users.noreply.github.com>
When a user is logged in to multiple microsoft accounts, there can be be a little bit of friction in the Entra login process as users will be asked to select the account to login with.
Scenarios in which a user may have multiple microsoft accounts
1. Someone logged in to your work Entra ID account, and a personal microsoft account
2. A consultant who has an Entra ID account at both their employer, as well as the company they're contracted out to.
3. A user has a regular account, as well as one or more high priviliged accounts.
When a domain hint is provided, Entra will filter out all the accounts which don't belong to the tenant specified on the `domain_hint`.
In many cases, this will filter to a single account, avoiding the need to select an account at all (e.g. scenario 1 & 2).
This won't always happen (e.g. scenario 3).
Additionally in the case a tenant has been configured to federate authentication elsewhere (e.g. to an on premise AD FS), setting the domain hint means entra can send the user straight to the federated authentication soruce, removing further steps
If backstage is allowign authentication from multiple tenants, this field should be left blank.
For more details, see https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/home-realm-discovery-policy
99% of the time, this value should be the same as the tenantId, so we could get rid of hte domain hint, and set it to the same value as the tenant id automatically.
We'd need to provide a config option (e.g. `isMultiTenant: true`) to opt out of this.
For those edge cases, this would be a breaking change.
I decided to go with specifying the `domain_hint` seperatly for now just in case my assumptions are wrong and there are more cases wher ehte `domain_hint` will get in the way.
We can always make this the default behaviour later on.
Signed-off-by: Alex Crome <afscrome@users.noreply.github.com>
Fix links at the `README.md` files
of the gitlab auth provider and microsoft auth provider.
Additionally, the wrong provider name was used at auth-backend
within code documentation related to the microsoft provider.
Signed-off-by: Patrick Jungermann <Patrick.Jungermann@gmail.com>
Daniel Doberenz