Improved Microsoft OAuth Flow #1818
Replies: 4 comments 8 replies
-
Good job! Maybe MCC could start a localhost web server for the duration of the login process so that the user is redirected back to MCC once logged in? Not sure if Azure would allow this. |
Beta Was this translation helpful? Give feedback.
-
There are two OAuth methods for getting Microsoft account access token, auth code grant and implicit grant. Both of them have their own pros and cons.
Client secret has a maximum lifetime of 2 years, which mean we have to change the secret when it expired. The lifetime of the refresh token is longer than access token (default is 90 days). If we could cache the refresh token, user will only have to sign-in once and will be kept signed-in for a long period of time, which is a huge advantage for the user. @ORelio Which method would you consider? |
Beta Was this translation helpful? Give feedback.
-
what about SSH tunneling in the case of a remote server |
Beta Was this translation helpful? Give feedback.
-
Hows this going, build latest today, no auth cache so far, have to keep pasting the link over and over. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
As discussed before, MSA sign-in process requires Microsoft Azure account. Without an Azure account, we will need to "steal" a client ID from other's. The redirect page was also restricted (i.e. we cannot make our own page).
To improve the sign-in process, I have registered an Azure account. This enables us to configure our own redirect URL and webpage to show after signing-in, instead of a blank page. We could add instructions on our redirect page to help user understand what to do next.
Although the example below is using my own domain for redirection, the next plan is to make use of the GitHub Page to host our webpage for redirection.
Azure oauth flow
Open link in browser and sign-in
https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_id=54473e32-df8f-42e9-a649-9419b0dab9d3&response_type=code&redirect_uri=https%3A%2F%2Fmccteam.github.io%2Fredirect.html&scope=XboxLive.signin%20offline_access%20openid%20email&prompt=select_account&response_mode=fragment
Redirect to landing page with code after successful login
Landing page can be controlled by us (e.g. a fancy webpage)
Copy code to MCC
MCC send POST request to the URL
https://login.live.com/oauth20_token.srf
Body content type must be application/x-www-form-urlencoded
client_id=54473e32-df8f-42e9-a649-9419b0dab9d3&client_secret=MbH7Q~~UPIybhpAELRKMjSXO6Ar_9A5w-uUw5&grant_type=authorization_code&redirect_uri=https%3A%2F%2Fmccteam.github.io%2Fredirect.html&code={code from step 3}
Redirect URL should be encoded
Receive access token + refresh token
Continue authenticate as before (Should be with xbox live this step)
Task to do:
Beta Was this translation helpful? Give feedback.
All reactions