From 1baf5d5e7f897e796d4474a54ae7237c7691332f Mon Sep 17 00:00:00 2001 From: Jamie Klassen Date: Wed, 26 Oct 2022 15:37:47 -0400 Subject: [PATCH] complete azure outbound access Adds the other host that must be reachable and puts all this advice in its own section. Signed-off-by: Jamie Klassen --- docs/auth/microsoft/provider.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/docs/auth/microsoft/provider.md b/docs/auth/microsoft/provider.md index cbd24867b7..787b95f2f3 100644 --- a/docs/auth/microsoft/provider.md +++ b/docs/auth/microsoft/provider.md @@ -46,11 +46,19 @@ The Microsoft provider is a structure with three configuration keys: - `clientSecret`: Secret, found on App Registration > Certificates & secrets - `tenantId`: Directory (tenant) ID, found on App Registration > Overview -In order to finish signing a user in from Azure, the Backstage backend must -fetch their information from graph.microsoft.com (as seen in [this source -code](https://github.com/seanfisher/passport-microsoft/blob/0456aa9bce05579c18e77f51330176eb26373658/lib/strategy.js#L93-L95)), -so ensure that your Backstage backend has connectivity to this host. -Otherwise users may see an `Authentication failed, failed to fetch user profile` error when they attempt to log in. +## Outbound Network Access + +If your environment has restrictions on outgoing access (e.g. through +firewall rules), make sure your Backstage backend has access to the following +hosts: + +- `login.microsoftonline.com`, to get and exchange authorization codes and access + tokens +- `graph.microsoft.com`, to fetch user profile information (as seen + in [this source + code](https://github.com/seanfisher/passport-microsoft/blob/0456aa9bce05579c18e77f51330176eb26373658/lib/strategy.js#L93-L95)). + If this host is unreachable, users may see an `Authentication failed, failed to fetch user profile` error when they attempt to log in. + ## Adding the provider to the Backstage frontend