nmemmert
144adf64c4
- Full-featured web application for PDF processing - Microsoft Entra (Azure AD) authentication with PKCE - Parallel PDF sorting and merging capabilities - Job management system with real-time progress tracking - Modern web UI with responsive design - Comprehensive error handling and logging - Ubuntu installation script for easy deployment - Environment configuration for secure credential management
93 lines
3.2 KiB
Markdown
93 lines
3.2 KiB
Markdown
# Microsoft Entra Authentication Setup Guide
|
|
|
|
This application uses Microsoft Entra (Azure Active Directory) for authentication. Follow these steps to configure it:
|
|
|
|
## 1. Create an Azure AD App Registration
|
|
|
|
1. Go to the [Azure Portal](https://portal.azure.com)
|
|
2. Navigate to **Azure Active Directory** > **App registrations**
|
|
3. Click **New registration**
|
|
4. Enter a name for your app (e.g., "PDF Processor")
|
|
5. For **Supported account types**, select "Accounts in this organizational directory only"
|
|
6. For **Redirect URI**, select "Web" and enter: `http://localhost:5000/auth/callback`
|
|
7. Click **Register**
|
|
|
|
## 2. Configure Authentication
|
|
|
|
1. In your app registration, go to **Authentication**
|
|
2. Under **Redirect URIs**, ensure `http://localhost:5000/auth/callback` is listed
|
|
3. Under **Implicit grant and hybrid flows**, check:
|
|
- [x] Access tokens
|
|
- [x] ID tokens
|
|
4. Click **Save**
|
|
|
|
## 3. Get Application Credentials
|
|
|
|
1. Go to **Overview** in your app registration
|
|
2. Copy the **Application (client) ID** - this is your `AZURE_CLIENT_ID`
|
|
3. Copy the **Directory (tenant) ID** - this is your `AZURE_TENANT_ID`
|
|
|
|
## 4. Create a Client Secret
|
|
|
|
1. Go to **Certificates & secrets**
|
|
2. Click **New client secret**
|
|
3. Enter a description and select an expiration
|
|
4. Click **Add**
|
|
5. **Important**: Copy the secret value immediately - this is your `AZURE_CLIENT_SECRET`
|
|
|
|
## 5. Configure API Permissions
|
|
|
|
1. Go to **API permissions**
|
|
2. Click **Add a permission**
|
|
3. Select **Microsoft Graph**
|
|
4. Select **Delegated permissions**
|
|
5. Add these permissions:
|
|
- `openid`
|
|
- `profile`
|
|
- `email`
|
|
6. Click **Add permissions**
|
|
7. Click **Grant admin consent** for your organization
|
|
|
|
## 6. Configure Environment Variables
|
|
|
|
Create a `.env` file in the project root with your Azure AD settings:
|
|
|
|
```env
|
|
# Azure AD Configuration
|
|
AZURE_TENANT_ID=your-tenant-id-here
|
|
AZURE_CLIENT_ID=your-client-id-here
|
|
AZURE_CLIENT_SECRET=your-client-secret-here
|
|
AZURE_AUTHORITY=https://login.microsoftonline.com/your-tenant-id-here
|
|
AZURE_REDIRECT_URI=http://localhost:5000/auth/callback
|
|
AZURE_SCOPES=openid profile email
|
|
```
|
|
|
|
## 7. Update Redirect URI for Production
|
|
|
|
When deploying to production, update the redirect URI in both:
|
|
- Azure AD app registration
|
|
- Your `.env` file (change localhost to your production domain)
|
|
|
|
**Note**: For local development, the app runs on port 5000, so use `http://localhost:5000/auth/callback` as the redirect URI.
|
|
|
|
## 8. Test the Authentication
|
|
|
|
1. Start the application: `python app.py`
|
|
2. Visit `http://localhost:5000`
|
|
3. Click "Login with Microsoft"
|
|
4. You should be redirected to Microsoft login
|
|
5. After authentication, you'll be redirected back to the app
|
|
|
|
## Troubleshooting
|
|
|
|
- **"invalid_client" error**: Check your client ID and secret
|
|
- **"invalid_request" error**: Verify the redirect URI matches exactly
|
|
- **Permission denied**: Ensure you've granted admin consent for the API permissions
|
|
- **Token errors**: Check that your tenant ID is correct
|
|
|
|
## Security Notes
|
|
|
|
- Never commit the `.env` file to version control
|
|
- Use strong client secrets and rotate them regularly
|
|
- In production, use HTTPS for all authentication flows
|
|
- Consider implementing token refresh logic for long-running sessions |