Skip to content

Add support for an optional login and document level access control system.#624

Merged
mattgotteiner merged 84 commits intoAzure-Samples:mainfrom
mattgotteiner:mattmsft/login-manual
Sep 25, 2023
Merged

Add support for an optional login and document level access control system.#624
mattgotteiner merged 84 commits intoAzure-Samples:mainfrom
mattgotteiner:mattmsft/login-manual

Conversation

@mattgotteiner
Copy link
Copy Markdown
Collaborator

@mattgotteiner mattgotteiner commented Sep 13, 2023 •
edited
Loading

Purpose

  • Add an optional login and document level access control system
  • Support for access control based on the User Object ID and Group ID
  • Add optional login UI to the frontend components
  • Add optional authentication tokens and authentication understanding capabilities to the backend
  • Use security filters in Azure Cognitive Search to implement the access control system.

Does this introduce a breaking change?

[ ] Yes
[X] No

Pull Request Type

What kind of change does this Pull Request introduce?

[ ] Bugfix
[X] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

  • Get the code

  • Test the code

  1. Follow the manual setup instructions in LoginAndAclSetup.md.
  2. After running azd up or running locally, a login button will appear at the top right. Use this to log into your account in your Azure AD tenant.
  3. Enable the optional oids or groups security filters in the developer settings. Sample access control can be setup by setting AZURE_ADLS_GEN2_STORAGE_ACCOUNT to a valid data lake storage account prior to running azd up or running prepdocs.py. Access control values can also be manually managed using the manageacl.ps1 script.

Other Information

Matt Gotteiner added 23 commits September 4, 2023 20:40
pamelafox
pamelafox reviewed Sep 13, 2023
View reviewed changes
Comment thread app/backend/core/authentication.py
pamelafox
pamelafox reviewed Sep 13, 2023
View reviewed changes
Comment thread app/backend/requirements.txt Outdated
pamelafox
pamelafox reviewed Sep 13, 2023
View reviewed changes
Comment thread app/backend/core/authentication.py Outdated
mattgotteiner
mattgotteiner commented Sep 13, 2023
View reviewed changes
Comment thread LoginAndAclSetup.md Outdated
Comment thread LoginAndAclSetup.md Outdated
Comment thread app/backend/app.py
Comment thread app/backend/app.py
Comment thread app/backend/core/authentication.py Outdated
Comment thread README.md
Comment thread app/frontend/src/components/LoginButton/LoginButton.tsx
Comment thread LoginAndAclSetup.md
pamelafox
pamelafox reviewed Sep 13, 2023
View reviewed changes
Comment thread app/backend/core/authentication.py Outdated
pamelafox
pamelafox reviewed Sep 25, 2023
View reviewed changes
Comment thread scripts/prepdocs.ps1 Outdated
pamelafox
pamelafox reviewed Sep 25, 2023
View reviewed changes
Comment thread tests/conftest.py
pamelafox
pamelafox approved these changes Sep 25, 2023
View reviewed changes
Copy link
Copy Markdown
Collaborator

@pamelafox pamelafox left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please double check that sh/ps1 scripts work when no auth/datalake is being used, if you haven't already.
And please update the README with link to your blog post when that's written.
Thanks for all the changes!

@mattgotteiner mattgotteiner merged commit c8b8486 into Azure-Samples:main Sep 25, 2023
@KesavarajaRK KesavarajaRK mentioned this pull request Sep 27, 2023
Merged
@494206
Copy link
Copy Markdown

494206 commented Oct 4, 2023

Login is also possible using App Service "easy auth"
https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

@mattgotteiner
Copy link
Copy Markdown
Collaborator Author

mattgotteiner commented Oct 4, 2023

Login is also possible using App Service "easy auth" https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

This is true - but you can't use that for document level access control

@494206
Copy link
Copy Markdown

494206 commented Oct 4, 2023

Yes, that's true -- that's why I only suggested 'easy auth' as a possible option for "Logins".

"Easy auth" can be implemented without making changes in the web app code, but it won't go that extra mile to provide granular document access controls.

It could be an intermediate solution for some use cases, though.

@mattgotteiner
Copy link
Copy Markdown
Collaborator Author

mattgotteiner commented Oct 4, 2023

Yes, that's true -- that's why I only suggested 'easy auth' as a possible option for "Logins".

"Easy auth" can be implemented without making changes in the web app code, but it won't go that extra mile to provide granular document access controls.

It could be an intermediate solution for some use cases, though.

Agreed. We already have a PR to implement this easy-auth solution. We are planning on automating setup of the access control, and perhaps we can add a "login-only" option that uses the easy-auth you are suggesting. Thanks for your feedback!

HughRunyan pushed a commit to RMI/RMI_chatbot that referenced this pull request Mar 26, 2024
@mattgotteiner
Add support for an optional login and document level access control s…
05bef47 
…ystem. (Azure-Samples#624)

* conditional login button

* fixing conditional login button

* updating frontend

* snapshot: OBO flow works

* auth login working e2e

* cannot use env vars from frontend

* add adls gen2 setup

* more changes to prepdocs

* fix auth + streaming

* fixing up scripts

* add view action to manageacl

* Writing documentation

* doc WIP

* push auth config from server to client

* updating docs, some minor code edits to be consistent

* checkpoint

* manual setup only for now

* remove manual logging

* remove optional print

* typo

* hosting on localhost for redirect uri

* remove ms graph sdk

* run black, ruff

* dependency injection for AuthenticationHelper

* encrypted token cache

* more feedback

* more feedback, port adlsgen2 to python

* ruff, black

* ruff, black don't change files i didn't write

* fix manage acl script

* update start to support codespaces

* run black

* manual test, github codespaces localhost still works

* fixing prepdocs after manual test of azd up without auth

* adding sh files; fixing script errors

* debugging auth on codespaces

* running through setup instructions

* note about consent

* change default scope

* switch to unordered list

* missing note

* addressing feedback...

* more feedback around

* doc strings

* formatting

* feedback on group claims

* switch to transitivememberof

* readme feedback

* refactor approach to use common filtering method

* more feedback

* refactoring

* writing tests

* tests

* test adls gen2 prepdocs

* fixing tests using env vars; adding adls gen2 tests

* broken?

* fixing tests

* more tests

* fixing CI errors

* feedback

* fix script

* fix script

* fix script

* bicep deployment; add documentation for troubleshooting

* lowercase true for env comparison

* feedback

* fix sh syntax errors

* fixing syntax errors

* Script fixes

---------

Co-authored-by: Matt Gotteiner <magottei@microsoft.com>
vuculescu pushed a commit to vuculescu/azure-search-openai-demo that referenced this pull request Jan 27, 2025
@mattgotteiner
Add support for an optional login and document level access control s…
a290758 
…ystem. (Azure-Samples#624)

* conditional login button

* fixing conditional login button

* updating frontend

* snapshot: OBO flow works

* auth login working e2e

* cannot use env vars from frontend

* add adls gen2 setup

* more changes to prepdocs

* fix auth + streaming

* fixing up scripts

* add view action to manageacl

* Writing documentation

* doc WIP

* push auth config from server to client

* updating docs, some minor code edits to be consistent

* checkpoint

* manual setup only for now

* remove manual logging

* remove optional print

* typo

* hosting on localhost for redirect uri

* remove ms graph sdk

* run black, ruff

* dependency injection for AuthenticationHelper

* encrypted token cache

* more feedback

* more feedback, port adlsgen2 to python

* ruff, black

* ruff, black don't change files i didn't write

* fix manage acl script

* update start to support codespaces

* run black

* manual test, github codespaces localhost still works

* fixing prepdocs after manual test of azd up without auth

* adding sh files; fixing script errors

* debugging auth on codespaces

* running through setup instructions

* note about consent

* change default scope

* switch to unordered list

* missing note

* addressing feedback...

* more feedback around

* doc strings

* formatting

* feedback on group claims

* switch to transitivememberof

* readme feedback

* refactor approach to use common filtering method

* more feedback

* refactoring

* writing tests

* tests

* test adls gen2 prepdocs

* fixing tests using env vars; adding adls gen2 tests

* broken?

* fixing tests

* more tests

* fixing CI errors

* feedback

* fix script

* fix script

* fix script

* bicep deployment; add documentation for troubleshooting

* lowercase true for env comparison

* feedback

* fix sh syntax errors

* fixing syntax errors

* Script fixes

---------

Co-authored-by: Matt Gotteiner <magottei@microsoft.com>
hasithb pushed a commit to Adalex-AI/azure-search-openai-demo that referenced this pull request Oct 19, 2025
@mattgotteiner
Add support for an optional login and document level access control s…
ee8bee4 
…ystem. (Azure-Samples#624)

* conditional login button

* fixing conditional login button

* updating frontend

* snapshot: OBO flow works

* auth login working e2e

* cannot use env vars from frontend

* add adls gen2 setup

* more changes to prepdocs

* fix auth + streaming

* fixing up scripts

* add view action to manageacl

* Writing documentation

* doc WIP

* push auth config from server to client

* updating docs, some minor code edits to be consistent

* checkpoint

* manual setup only for now

* remove manual logging

* remove optional print

* typo

* hosting on localhost for redirect uri

* remove ms graph sdk

* run black, ruff

* dependency injection for AuthenticationHelper

* encrypted token cache

* more feedback

* more feedback, port adlsgen2 to python

* ruff, black

* ruff, black don't change files i didn't write

* fix manage acl script

* update start to support codespaces

* run black

* manual test, github codespaces localhost still works

* fixing prepdocs after manual test of azd up without auth

* adding sh files; fixing script errors

* debugging auth on codespaces

* running through setup instructions

* note about consent

* change default scope

* switch to unordered list

* missing note

* addressing feedback...

* more feedback around

* doc strings

* formatting

* feedback on group claims

* switch to transitivememberof

* readme feedback

* refactor approach to use common filtering method

* more feedback

* refactoring

* writing tests

* tests

* test adls gen2 prepdocs

* fixing tests using env vars; adding adls gen2 tests

* broken?

* fixing tests

* more tests

* fixing CI errors

* feedback

* fix script

* fix script

* fix script

* bicep deployment; add documentation for troubleshooting

* lowercase true for env comparison

* feedback

* fix sh syntax errors

* fixing syntax errors

* Script fixes

---------

Co-authored-by: Matt Gotteiner <magottei@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@srbalakr srbalakr srbalakr left review comments

@pamelafox pamelafox pamelafox approved these changes

@pablocastro pablocastro Awaiting requested review from pablocastro

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mattgotteiner @pamelafox @494206 @srbalakr
⚡