feat: Azure AD single-tenant support + system requirements

- Add Azure AD Tenant provider for organizations that want to restrict
  login to a specific Entra ID tenant (vs allowing any Microsoft account)
- Add system requirements documentation (RAM, CPU, disk) for Docker builds
- Addresses issue where frontend build fails on memory-constrained systems

Closes #120, closes #132

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

README.md

@@ -16,10 +16,27 @@ Tabby Web serves the [Tabby Terminal](https://github.com/Eugeny/tabby) as a web
 
 # Requirements
 
+## Runtime Requirements
+
 * Python 3.7+
 * A database server supported by Django (MariaDB, Postgres, SQLite, etc.)
 * Storage for distribution files - local, S3, GCS or others supported by `fsspec`
 
+## Docker Build Requirements
+
+Building the Docker image requires significant resources due to the frontend compilation:
+
+| Resource | Minimum | Recommended |
+|----------|---------|-------------|
+| RAM | 2 GB | 4 GB |
+| CPU | 2 cores | 4 cores |
+| Disk | 5 GB | 10 GB |
+
+**Note:** The frontend build (webpack/Angular) is memory-intensive. If building on constrained systems (like Oracle Cloud Always Free tier with 1GB RAM), consider:
+- Using pre-built images from a CI/CD pipeline
+- Building on a larger machine and pushing to a registry
+- Adding swap space (not recommended for production)
+
 # Quickstart (using `docker-compose`)
 
 You'll need:
@@ -50,7 +67,8 @@ Only providers with credentials configured will appear as login options. Set the
 | GitHub | `SOCIAL_AUTH_GITHUB_KEY`, `SOCIAL_AUTH_GITHUB_SECRET` |
 | GitLab | `SOCIAL_AUTH_GITLAB_KEY`, `SOCIAL_AUTH_GITLAB_SECRET` |
 | Google | `SOCIAL_AUTH_GOOGLE_OAUTH2_KEY`, `SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET` |
-| Microsoft | `SOCIAL_AUTH_MICROSOFT_GRAPH_KEY`, `SOCIAL_AUTH_MICROSOFT_GRAPH_SECRET` |
+| Microsoft (multi-tenant) | `SOCIAL_AUTH_MICROSOFT_GRAPH_KEY`, `SOCIAL_AUTH_MICROSOFT_GRAPH_SECRET` |
+| Azure AD (single-tenant) | `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY`, `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET`, `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID` |
 | Auth0 | `SOCIAL_AUTH_AUTH0_DOMAIN`, `SOCIAL_AUTH_AUTH0_KEY`, `SOCIAL_AUTH_AUTH0_SECRET` |
 | Generic OIDC | `SOCIAL_AUTH_OIDC_OIDC_ENDPOINT`, `SOCIAL_AUTH_OIDC_KEY`, `SOCIAL_AUTH_OIDC_SECRET` |
 
@@ -75,6 +93,18 @@ Set the callback URL to: `https://your-domain/api/1/auth/social/complete/oidc/`
 
 **Note on MFA:** Multi-factor authentication is handled by your identity provider. Enable MFA in Authentik, Authelia, or your chosen provider to require 2FA for Tabby Web logins.
 
+### Azure AD Single-Tenant
+
+For organizations that want to restrict login to a specific Azure AD/Entra ID tenant (instead of allowing any Microsoft account), use the Azure AD single-tenant provider:
+
+- `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY`: Application (client) ID from Azure portal
+- `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET`: Client secret
+- `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID`: Directory (tenant) ID
+
+Set the callback URL to: `https://your-domain/api/1/auth/social/complete/azuread-tenant-oauth2/`
+
+When registering your app in Azure portal, select "Accounts in this organizational directory only" for supported account types.
+
 ## Adding Tabby app versions
 
 * `docker-compose run tabby /manage.sh add_version 1.0.163`

backend/tabby/app/api/auth.py

@@ -31,6 +31,12 @@ PROVIDER_CONFIG = {
         'cls': 'btn-light',
         'env_prefix': 'SOCIAL_AUTH_MICROSOFT_GRAPH',
     },
+    'azuread-tenant-oauth2': {
+        'name': 'Azure AD',
+        'icon': 'microsoft',
+        'cls': 'btn-light',
+        'env_prefix': 'SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2',
+    },
     'auth0': {
         'name': 'Auth0',
         'icon': 'key',  # Using key icon as Auth0 doesn't have a FA brand icon
@@ -58,6 +64,10 @@ def is_provider_configured(env_prefix: str) -> bool:
     if env_prefix == 'SOCIAL_AUTH_OIDC':
         endpoint = getattr(settings, f'{env_prefix}_OIDC_ENDPOINT', None)
         return bool(key and secret and endpoint)
+    # For Azure AD Tenant (single-tenant), also need TENANT_ID
+    if env_prefix == 'SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2':
+        tenant_id = getattr(settings, f'{env_prefix}_TENANT_ID', None)
+        return bool(key and secret and tenant_id)
     return bool(key and secret)
 
 

backend/tabby/settings.py

@@ -138,6 +138,7 @@ AUTHENTICATION_BACKENDS = (
     "social_core.backends.github.GithubOAuth2",
     "social_core.backends.gitlab.GitLabOAuth2",
     "social_core.backends.azuread.AzureADOAuth2",
+    "social_core.backends.azuread_tenant.AzureADTenantOAuth2",
     "social_core.backends.microsoft.MicrosoftOAuth2",
     "social_core.backends.google.GoogleOAuth2",
     "social_core.backends.auth0.Auth0OAuth2",
@@ -193,6 +194,9 @@ for key in [
     "SOCIAL_AUTH_OIDC_KEY",
     "SOCIAL_AUTH_OIDC_SECRET",
     "SOCIAL_AUTH_OIDC_NAME",
+    "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY",
+    "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET",
+    "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID",
     "CONNECTION_GATEWAY_AUTH_CA",
     "CONNECTION_GATEWAY_AUTH_CERTIFICATE",
     "CONNECTION_GATEWAY_AUTH_KEY",