Problem/Motivation
When evaluating this module for use on a project requiring authorisation via Azure AD, I followed
the documentation →
but had to add additional Drupal configuration and change code in the module to make it work.
I'm not sure if the module is wrong, the documentation is wrong, I've misunderstood how it says to set up Azure AD, or some mixture of it all, but I'm happy to try to patch or improve documentation if someone can clarify what's going on.
Using PHP 7.3, Drupal 9.1.0 minimal install profile, OpenID Connect 8.x-1.0, and OpenID Connect Windows Azure Active Directory.
The first issue was that without setting the Alternate UserInfo endpoint on /admin/config/services/openid-connect, I would always get the error
The e-mail address is not valid:
after clicking the Log in with Windows Azure AD for an AD user that does not exist yet in the Drupal database.
Looking in the debugger, it appears that Drupal\openid_connect_windows_aad\Plugin\OpenIDConnectClient\WindowsAad::retrieveUserInfo() will return an empty array unless the Alternate UserInfo endpoint is set. This in turn causes Drupal\openid_connect\OpenIDConnect::buildContext() to trigger the error visible in the UI, and fail to create the user.
Setting the Alternate UserInfo endpoint is not mentioned in the documentation, but I don't know how user creation from Azure AD could work without it (if you're not using Azure AD Graph API or Windows Graph API (v1.0).
Setting the Alternate UserInfo endpoint to https://graph.microsoft.com/oidc/userinfo (found by Googling!) did return userinfo, but there is some juggling in Drupal\openid_connect_windows_aad\Plugin\OpenIDConnectClient\WindowsAad::retrieveUserInfo() but it's subtly different to the data in the response
// Azure provides 'mail' for userinfo vs email.
if (!isset($profile_data['mail'])) {
Azure's response actually has the email address in the $profile_data['email'] field. If the module is patched to look for $profile_data['email'], then user creation and log in/out via SSO and Azure AD works!
So either my set up is wrong or the documentation is wrong, or the code is wrong (or outdated if Azure changed behaviour?) but I'm not sure why. Happy to improve code or documentation if someone can clarify why these steps are necessary.