# Microsoft Entra Authentication Setup Guide

This application uses Microsoft Entra (Azure Active Directory) for authentication. Follow these steps to configure it:

## 1. Create an Azure AD App Registration

1. Go to the [Azure Portal](https://portal.azure.com)
2. Navigate to **Azure Active Directory** > **App registrations**
3. Click **New registration**
4. Enter a name for your app (e.g., "PDF Processor")
5. For **Supported account types**, select "Accounts in this organizational directory only"
6. For **Redirect URI**, select "Web" and enter: `http://localhost:5000/auth/callback`
7. Click **Register**

## 2. Configure Authentication

1. In your app registration, go to **Authentication**
2. Under **Redirect URIs**, ensure `http://localhost:5000/auth/callback` is listed
3. Under **Implicit grant and hybrid flows**, check:
   - [x] Access tokens
   - [x] ID tokens
4. Click **Save**

## 3. Get Application Credentials

1. Go to **Overview** in your app registration
2. Copy the **Application (client) ID** - this is your `AZURE_CLIENT_ID`
3. Copy the **Directory (tenant) ID** - this is your `AZURE_TENANT_ID`

## 4. Create a Client Secret

1. Go to **Certificates & secrets**
2. Click **New client secret**
3. Enter a description and select an expiration
4. Click **Add**
5. **Important**: Copy the secret value immediately - this is your `AZURE_CLIENT_SECRET`

## 5. Configure API Permissions

1. Go to **API permissions**
2. Click **Add a permission**
3. Select **Microsoft Graph**
4. Select **Delegated permissions**
5. Add these permissions:
   - `openid`
   - `profile`
   - `email`
6. Click **Add permissions**
7. Click **Grant admin consent** for your organization

## 6. Configure Environment Variables

Create a `.env` file in the project root with your Azure AD settings:

```env
# Azure AD Configuration
AZURE_TENANT_ID=your-tenant-id-here
AZURE_CLIENT_ID=your-client-id-here
AZURE_CLIENT_SECRET=your-client-secret-here
AZURE_AUTHORITY=https://login.microsoftonline.com/your-tenant-id-here
AZURE_REDIRECT_URI=http://localhost:5000/auth/callback
AZURE_SCOPES=openid profile email
```

## 7. Update Redirect URI for Production

When deploying to production, update the redirect URI in both:
- Azure AD app registration
- Your `.env` file (change localhost to your production domain)

**Note**: For local development, the app runs on port 5000, so use `http://localhost:5000/auth/callback` as the redirect URI.

## 8. Test the Authentication

1. Start the application: `python app.py`
2. Visit `http://localhost:5000`
3. Click "Login with Microsoft"
4. You should be redirected to Microsoft login
5. After authentication, you'll be redirected back to the app

## Troubleshooting

- **"invalid_client" error**: Check your client ID and secret
- **"invalid_request" error**: Verify the redirect URI matches exactly
- **Permission denied**: Ensure you've granted admin consent for the API permissions
- **Token errors**: Check that your tenant ID is correct

## Security Notes

- Never commit the `.env` file to version control
- Use strong client secrets and rotate them regularly
- In production, use HTTPS for all authentication flows
- Consider implementing token refresh logic for long-running sessions