Added short guide for connecting kratos to AzureAD #433
Conversation
| { | ||
| identity: { | ||
| traits: { | ||
| email: claims.email |
There was a problem hiding this comment.
Does AzureAD include email_verified? If so, we should probably add a warning here as we did for Google/GitHub: https://github.com/ory/kratos/pull/433/files#diff-2a62fee703dc56d70e23792e010a5a01L67-L73
There was a problem hiding this comment.
I guess a warning should be in place. There is an optional claim, verified_primary_email that can be queried. https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims. If using a one tenant solution (the setup I have in place) the mails are assigned by the administrator so they are "safe" to use.
There was a problem hiding this comment.
@aeneasr - I read up on the issue on the Microsoft documentation, it seems like the same issue with unverified e-mails applies for Microsoft accounts as for GitHub, however, if you are using a corporate AzureAD (one you have control over), this does not apply and the email is to be considered as "verified". I did try to extract the verified_primary_email token that should theoretically work for this, however I did not have success at the moment (and it is not needed for my use-case). I think the documentation I submitted should be good to go with the warning / links attached.
|
|
| email: claims.email | ||
| }, | ||
| }, | ||
| } | ||
| ``` | ||
|
|
||
| See https://docs.microsoft.com/en-us/azure/active-directory-b2c/user-flow-disable-email-verification for warnings. |
There was a problem hiding this comment.
| See https://docs.microsoft.com/en-us/azure/active-directory-b2c/user-flow-disable-email-verification for warnings. | |
| Also see ["Disable email verification during customer sign-up in Azure Active Directory B2C"] for warnings. |
Related issue
Proposed changes
Checklist
vulnerability. If this pull request addresses a security. vulnerability, I
confirm that I got green light (please contact
security@ory.sh) from the maintainers to push
the changes.
works.
Further comments