Microsoft Entra ID Integration
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. This guide walks you through setting up Microsoft Entra ID as your Identity Provider with the Tailor Platform Auth service using OIDC.
Prerequisites
- An active Microsoft Entra ID tenant with admin privileges
- A Tailor Platform workspace with Auth service enabled
- Basic understanding of OIDC protocols
Setting up Microsoft Entra ID for OIDC
Step 1: Register an Application in Entra ID
- Sign in to the Microsoft Entra admin center
- Navigate to App registrations
- Click New registration
- Configure your application:
- Name: Your application name (e.g., "Tailor Platform App")
- Supported account types: Choose based on your requirements
- Accounts in this organizational directory only (Single tenant)
- Accounts in any organizational directory (Multi-tenant)
- Redirect URI: Select Web and add:
https://{your-app-domain}/oauth2/callback
- Click Register
Step 2: Configure Application Settings
After registration, configure the following settings:
Authentication:
- Go to Authentication in the left menu
- Under Redirect URIs, ensure your callback URL is correctly configured
- Select Settings tab, for Implicit grant and hybrid flows, enable:
- ID tokens (used for sign-in)
- Click Save
Certificates & secrets:
- Go to Certificates & secrets in the left menu
- Click New client secret
- Add a description and choose expiration period
- Click Add and copy the secret value immediately
Step 3: Get Application Information
Note down the following information from the Overview page:
- Application (client) ID: Your client ID
- Directory (tenant) ID: Your tenant ID
- Client secret: The secret value you created
Step 4: Configure API Permissions (Optional)
If you need additional user information:
- Go to API permissions
- Click Add a permission
- Select Microsoft Graph
- Choose Delegated permissions
- Add permissions like:
User.Read(to read user profile)email(to access email address)profile(to access basic profile information)
- Click Grant admin consent if required
Configuring Auth Service
Once your Entra ID application is set up, configure the Auth service in your Tailor Platform application:
<span><span style="color: var(--shiki-token-function)">resource</span><span style="color: var(--shiki-color-text)"> "tailor_auth" "main_auth" {</span></span>
<span><span style="color: var(--shiki-color-text)"> workspace_id </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> var.workspace_id</span></span>
<span><span style="color: var(--shiki-color-text)"> namespace </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> </span><span style="color: var(--shiki-token-string-expression)">"main-auth"</span></span>
<span><span style="color: var(--shiki-color-text)">}</span></span>
<span></span>
<span><span style="color: var(--shiki-token-comment)"># OIDC Configuration for Microsoft Entra ID</span></span>
<span><span style="color: var(--shiki-token-function)">resource</span><span style="color: var(--shiki-color-text)"> "tailor_auth_idp_config" "entra_id_oidc" {</span></span>
<span><span style="color: var(--shiki-color-text)"> workspace_id </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> var.workspace_id</span></span>
<span><span style="color: var(--shiki-color-text)"> namespace </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> tailor_auth.main_auth.namespace</span></span>
<span><span style="color: var(--shiki-color-text)"> name </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> </span><span style="color: var(--shiki-token-string-expression)">"entra-id-oidc"</span></span>
<span><span style="color: var(--shiki-color-text)"> </span></span>
<span><span style="color: var(--shiki-color-text)"> oidc_config </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> {</span></span>
<span><span style="color: var(--shiki-color-text)"> client_id </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> var.entra_id_client_id</span></span>
<span><span style="color: var(--shiki-color-text)"> client_secret </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> {</span></span>
<span><span style="color: var(--shiki-color-text)"> vault_name </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> tailor_secretmanager_vault.default.name</span></span>
<span><span style="color: var(--shiki-color-text)"> secret_name </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> tailor_secretmanager_secret.entra_id_client_secret.secret_name</span></span>
<span><span style="color: var(--shiki-color-text)"> }</span></span>
<span><span style="color: var(--shiki-color-text)"> provider_url </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> </span><span style="color: var(--shiki-token-string-expression)">"https://login.microsoftonline.com/{tenant-id}/v2.0"</span></span>
<span><span style="color: var(--shiki-color-text)"> }</span></span>
<span><span style="color: var(--shiki-color-text)">}</span></span>
<span></span>
<span><span style="color: var(--shiki-token-comment)"># Secret for storing Entra ID client secret</span></span>
<span><span style="color: var(--shiki-token-function)">resource</span><span style="color: var(--shiki-color-text)"> "tailor_secretmanager_secret" "entra_id_client_secret" {</span></span>
<span><span style="color: var(--shiki-color-text)"> workspace_id </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> var.workspace_id</span></span>
<span><span style="color: var(--shiki-color-text)"> vault_name </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> tailor_secretmanager_vault.default.name</span></span>
<span><span style="color: var(--shiki-color-text)"> name </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> </span><span style="color: var(--shiki-token-string-expression)">"entra-id-client-secret"</span></span>
<span><span style="color: var(--shiki-color-text)"> value_wo </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> var.entra_id_client_secret</span></span>
<span><span style="color: var(--shiki-color-text)"> value_wo_version </span><span style="color: var(--shiki-token-keyword)">=</span><span style="color: var(--shiki-color-text)"> </span><span style="color: var(--shiki-token-constant)">1</span><span style="color: var(--shiki-color-text)"> </span></span>
<span><span style="color: var(--shiki-color-text)">}</span></span>
<span></span>Testing the Integration
After configuring both Entra ID and the Auth service:
- Deploy your Tailor Platform application
- Create users in Entra ID and add them to the Tailor platform following these steps
- Login to your application using the Tailor CLI
- You should be redirected to Microsoft Entra ID for authentication
- After successful authentication, you'll be redirected back to your application
Troubleshooting
Common Issues
Invalid Redirect URI
- Ensure the redirect URI in Entra ID matches exactly what's configured in your Auth service
- Check for trailing slashes and protocol mismatches (http vs https)
Invalid Client Credentials
- Verify your client ID and client secret are correct
- Ensure the client secret hasn't expired
- Check that the secret is properly stored in your secret manager
Tenant Configuration Issues
- Verify the tenant ID in your provider URL is correct
- For multi-tenant apps, ensure you're using the correct tenant endpoint
- Check that the application is properly registered in the correct tenant
User Profile Not Created
- Check that your TailorDB User type has the correct username field configured
- Verify that the email claim is being passed from Entra ID
- Ensure the user has the necessary permissions in Entra ID
Token Validation Errors
- Verify the audience claim in the token matches your application
- Check that the issuer claim matches the expected Entra ID issuer
- Ensure your application's clock is synchronized
For production deployments, ensure you're using HTTPS URLs and have proper SSL certificates configured. Also, consider implementing proper token caching and refresh mechanisms.