eoy-pdf-sortandmerge/AZURE_AD_SETUP.md

Microsoft Entra Authentication Setup Guide

This application uses Microsoft Entra (Azure Active Directory) for authentication. Follow these steps to configure it:

1. Create an Azure AD App Registration

1. Go to the Azure Portal
2. Navigate to Azure Active Directory > App registrations
3. Click New registration
4. Enter a name for your app (e.g., "PDF Processor")
5. For Supported account types, select "Accounts in this organizational directory only"
6. For Redirect URI, select "Web" and enter: http://localhost:5000/auth/callback
7. Click Register

2. Configure Authentication

1. In your app registration, go to Authentication
2. Under Redirect URIs, ensure http://localhost:5000/auth/callback is listed
3. Under Implicit grant and hybrid flows, check:
   • Access tokens
   • ID tokens
4. Click Save

3. Get Application Credentials

1. Go to Overview in your app registration
2. Copy the Application (client) ID - this is your AZURE_CLIENT_ID
3. Copy the Directory (tenant) ID - this is your AZURE_TENANT_ID

4. Create a Client Secret

1. Go to Certificates & secrets
2. Click New client secret
3. Enter a description and select an expiration
4. Click Add
5. Important: Copy the secret value immediately - this is your AZURE_CLIENT_SECRET

5. Configure API Permissions

1. Go to API permissions
2. Click Add a permission
3. Select Microsoft Graph
4. Select Delegated permissions
5. Add these permissions:
   • openid
   • profile
   • email
6. Click Add permissions
7. Click Grant admin consent for your organization

6. Configure Environment Variables

Create a .env file in the project root with your Azure AD settings:

# Azure AD Configuration
AZURE_TENANT_ID=your-tenant-id-here
AZURE_CLIENT_ID=your-client-id-here
AZURE_CLIENT_SECRET=your-client-secret-here
AZURE_AUTHORITY=https://login.microsoftonline.com/your-tenant-id-here
AZURE_REDIRECT_URI=http://localhost:5000/auth/callback
AZURE_SCOPES=openid profile email

7. Update Redirect URI for Production

When deploying to production, update the redirect URI in both:

• Azure AD app registration
• Your .env file (change localhost to your production domain)

Note: For local development, the app runs on port 5000, so use http://localhost:5000/auth/callback as the redirect URI.

8. Test the Authentication

1. Start the application: python app.py
2. Visit http://localhost:5000
3. Click "Login with Microsoft"
4. You should be redirected to Microsoft login
5. After authentication, you'll be redirected back to the app

Troubleshooting

• "invalid_client" error: Check your client ID and secret
• "invalid_request" error: Verify the redirect URI matches exactly
• Permission denied: Ensure you've granted admin consent for the API permissions
• Token errors: Check that your tenant ID is correct

Security Notes

• Never commit the .env file to version control
• Use strong client secrets and rotate them regularly
• In production, use HTTPS for all authentication flows
• Consider implementing token refresh logic for long-running sessions