Using Azure Active Directory

This feature allows the deployment to use AAD for authenticating its users and to access one additional Azure service - as this is not an official Microsoft use-case, we only allow a singular service to be accessed this way. The webgme-engine implements the code based authentication as well as the silent flow and generally uses the official microsoft access library for nodejs from this repository.

There are two main parts of the setup, the configurations on the azure portal and finally the configuration inside the gmeConfig.

• create an application for your webgme-deployment here - description can be found here
• make sure you create a proper redirect URI in the authentication config of your app (should point to '/add' of the deployment)
• make sure to create a client secret and store the value as you are going to need it in your gmeConfig.

While the description should be sufficient, here are some additional tips to help your deployment configuration:

• While the feature technically allows users to be mixed (azure originated, webgme only), it is best if when AAD is used, you only allow users from that source. To achieve this, turn off option to register and point the login page to /aad, that way it is always going to use the AAD authentication for the users.
• You also need to make sure you pick different name for the AAD related token and the regular JWT of WebGME!

As we have not been able to find a good mockup of an azure portal, we have not yet automated the tests for the feature, but once we either find a good implementation or have time for creating a mockup ourselves, we will enhance the automated testing.