Support for Azure AD authentication about passport

[kamilmysliwiec]

https://github.com/AzureAD/passport-azure-ad

[aramalipoor]

@kamilmysliwiec looks like because of this block and they way NestJS Passport wrapper works passport-azure-ad cannot populate proper arguments to the "verify" (aka "validate") method. Because "arity" or number of verify function arguments will be calculated as 0 :( in here: https://github.com/AzureAD/passport-azure-ad/blob/96c7a193737f03a270b4eb0d99ce2d59256da9a9/lib/oidcstrategy.js#L109

import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { OIDCStrategy } from 'passport-azure-ad';

import { configService } from '../config/config.service';
import { ProfileProvider } from '../user/user.types';
import { AuthService } from './auth.service';

@Injectable()
export class AzureAdStrategy extends PassportStrategy(
  OIDCStrategy,
  'azure-ad',
) {
  constructor(private readonly authService: AuthService) {
    super(configService.getAzureAdConfig());
  }

  async validate(iss, sub, profile, accessToken, refreshToken, done: Function) {
    try {
      const jwt: string = await this.authService.handleOAuthLogin(
        accessToken,
        refreshToken,
        profile.id,
        ProfileProvider.AZURE_AD,
      );

      done(null, {
        jwt,
      });
    } catch (err) {
      console.log('Azure AD Strategy failure', err);
      done(err, false);
    }
  }
}

Using above class first argument is either request (if passReqToCallback: true) or profile object and last argument is "done" function.

Not "profile" nor "request" contain the accessToken or refreshToken 🤔

Is it possible to work-around this somehow? Like directly registering Azure-AD with passport as a quick fix for now?

[aramalipoor]

Thanks @llhupp, I ended up directly providing the callback function instead of using NestJs strategy:

import passport from 'passport';
import { Injectable, OnModuleInit } from '@nestjs/common';
import { OIDCStrategy } from 'passport-azure-ad';

import { configService } from '../config/config.service';
import { ProfileProvider } from '../user/user.types';
import { AuthService } from './auth.service';

@Injectable()
export class AzureadStrategy extends OIDCStrategy implements OnModuleInit {
  onModuleInit() {
    passport.use('azuread', this);
  }

  constructor(private readonly authService: AuthService) {
    super(
      configService.getAzureadConfig(),
      (iss, sub, profile, accessToken, refreshToken, done) => {
        try {
          return this.authService
            .handleOAuthLogin(
              accessToken,
              refreshToken,
              profile.oid,
              ProfileProvider.AZUREAD,
            )
            .then(jwt => {
              done(null, {
                jwt,
              });
            })
            .catch(err => {
              console.log('Azure AD Strategy failure 1', err);
              done(err, false);
            });
        } catch (err) {
          console.log('Azure AD Strategy failure 2', err);
          done(err, false);
          return err;
        }
      },
    );
  }
}

[LyricL-Gitster]

@aramalipoor In case you're still stuck around this, I'm following a solution where you can hack a custom callback function based on this issue:
https://github.com/AzureAD/passport-azure-ad/issues/424#issue-447820817

[0x0ece]

FYI, I made a proposal to passport-azure-ad to explicitly set the verify callback signature.

With that PR, setting verifyArity: 8 in the options lets you retrieve the tokens.

@Injectable()
export class AzureAdStrategy extends PassportStrategy(OIDCStrategy) {
  constructor (private readonly moduleRef: ModuleRef) {
    super({
      ...
      passReqToCallback: true,
      verifyArity: 8,
    })
  }

  async validate (
    request, iss, sub, profile, jwtClaims, access_token, refresh_token, params
  ): Promise<RequestUser | null> {
     ...
  }
}