one thing I’ve noticed with the other ueberauth library is it seems to have far fewer validations in the callback for the token than mine. Has me wondering whether the extra validations were necessary.
whossname
danschultzer
Pow Core Team
Yeah, I’ve been working on an Azure AD integration for PowAssent here: Azure OAuth2 strategy by danschultzer · Pull Request #3 · pow-auth/pow_assent · GitHub
But I got no experience with Azure so I’ve only been able to test it very lightly 
1
leifericf
Unfortunately, I don’t know enough about authentication in general and Azure AD in particular to be able to help with that (yet). I’m still in the early stages of learning Elixir.
0
whossname
I created an issue on their repo. Check out the issue:
https://github.com/swelham/ueberauth_microsoft/issues/4
and my code for solving the same problem (the code could probably be nicer):
https://github.com/whossname/ueberauth_azure_ad/blob/master/lib/ueberauth/azure_ad/verify.ex
1
leifericf
Cool! @danschultzer and I spent last week testing and fixing the Azure AD strategy for PowAssent as well. It is working now and has been merged into the main alpha branch (v0.1.0-alpha.12)
Check out this GitHub issue for more details:
0
danschultzer
Pow Core Team
I think most libraries (including my PowAssent integration) are just build with the standard OAuth 2.0 auth code flow in mind. If it’s possible, then validating the token is definitely preferable.
1
whossname
@danschultzer @leifericf do you guys want me to refactor out my validation stuff into a separate repo that everyone can use? I think it should be possible to write it in a way that is usable for anyone using openid, not just Azure Active Directory.
1
danschultzer
Pow Core Team
It may make more sense to have that in an OpenID Connect integration that does the validations, and then build the Azure AD OpenID integration on top of that.
1
whossname
You’ve lost me a bit there. I was talking about a general library for the openid callback validations. Not specific to your authentication library and only handling the validation part, not the rest.
I’m thinking of doing this anyway because I think this might be a common problem. I think alot of people don’t realise the client side validations are necessary.
0