From 9544e363c9eb32fe1c87dbeb0f384d2f3de6832e Mon Sep 17 00:00:00 2001 From: Brian Olson Date: Wed, 31 Dec 2025 20:46:53 -0500 Subject: [PATCH] feat: add Azure AD single-tenant authentication support Add support for AzureADTenantOAuth2 backend which allows restricting authentication to a specific Azure AD tenant (organization). Configuration: - SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY: Azure app client ID - SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET: Azure app client secret - SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID: Azure AD Directory ID This enables organizations to restrict Tabby Web access to only users from their Azure AD tenant, preventing personal Microsoft accounts or users from other organizations from logging in. Fixes #120 --- README.md | 15 ++++++++++++++- backend/tabby/settings.py | 5 +++++ docker-compose.yml | 18 ++++++++++++++++++ 3 files changed, 37 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 68afa4d..8c629b6 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,20 @@ For SSH and Telnet, once logged in, enter your connection gateway address and au * `DATABASE_URL` (required). * `APP_DIST_STORAGE`: a `file://`, `s3://`, or `gcs://` URL to store app distros in. -* `SOCIAL_AUTH_*_KEY` & `SOCIAL_AUTH_*_SECRET`: social login credentials, supported providers are `GITHUB`, `GITLAB`, `MICROSOFT_GRAPH` and `GOOGLE_OAUTH2`. + +### OAuth Providers + +Configure one or more OAuth providers for authentication: + +| Provider | Variables | +|----------|-----------| +| GitHub | `SOCIAL_AUTH_GITHUB_KEY`, `SOCIAL_AUTH_GITHUB_SECRET` | +| GitLab | `SOCIAL_AUTH_GITLAB_KEY`, `SOCIAL_AUTH_GITLAB_SECRET` | +| Google | `SOCIAL_AUTH_GOOGLE_OAUTH2_KEY`, `SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET` | +| Microsoft (multi-tenant) | `SOCIAL_AUTH_MICROSOFT_GRAPH_KEY`, `SOCIAL_AUTH_MICROSOFT_GRAPH_SECRET` | +| Azure AD (single-tenant) | `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY`, `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET`, `SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID` | + +**Azure AD Single-Tenant:** Use this instead of Microsoft Graph if you want to restrict login to users from a specific Azure AD tenant (organization). Set `TENANT_ID` to your Azure AD Directory (tenant) ID. ## Adding Tabby app versions diff --git a/backend/tabby/settings.py b/backend/tabby/settings.py index 0714461..22b3b50 100644 --- a/backend/tabby/settings.py +++ b/backend/tabby/settings.py @@ -138,6 +138,7 @@ AUTHENTICATION_BACKENDS = ( "social_core.backends.github.GithubOAuth2", "social_core.backends.gitlab.GitLabOAuth2", "social_core.backends.azuread.AzureADOAuth2", + "social_core.backends.azuread_tenant.AzureADTenantOAuth2", # Single-tenant Azure AD "social_core.backends.microsoft.MicrosoftOAuth2", "social_core.backends.google.GoogleOAuth2", "django.contrib.auth.backends.ModelBackend", @@ -180,6 +181,10 @@ for key in [ "SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET", "SOCIAL_AUTH_MICROSOFT_GRAPH_KEY", "SOCIAL_AUTH_MICROSOFT_GRAPH_SECRET", + # Azure AD single-tenant (use instead of multi-tenant for org-only access) + "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY", + "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET", + "SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID", "CONNECTION_GATEWAY_AUTH_CA", "CONNECTION_GATEWAY_AUTH_CERTIFICATE", "CONNECTION_GATEWAY_AUTH_KEY", diff --git a/docker-compose.yml b/docker-compose.yml index 6202d8e..cf91cc2 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -11,6 +11,24 @@ services: - PORT=80 - DEBUG=False - DOCKERIZE_ARGS="-wait tcp://db:3306 -timeout 60s" + # + # OAuth Providers - uncomment and configure: + # - SOCIAL_AUTH_GITHUB_KEY=your_github_client_id + # - SOCIAL_AUTH_GITHUB_SECRET=your_github_client_secret + # - SOCIAL_AUTH_GITLAB_KEY=your_gitlab_client_id + # - SOCIAL_AUTH_GITLAB_SECRET=your_gitlab_client_secret + # - SOCIAL_AUTH_GOOGLE_OAUTH2_KEY=your_google_client_id + # - SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET=your_google_client_secret + # + # Microsoft/Azure AD (multi-tenant - allows any Microsoft account): + # - SOCIAL_AUTH_MICROSOFT_GRAPH_KEY=your_microsoft_client_id + # - SOCIAL_AUTH_MICROSOFT_GRAPH_SECRET=your_microsoft_client_secret + # + # Azure AD Single-Tenant (restricts to specific organization): + # - SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY=your_azure_client_id + # - SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET=your_azure_client_secret + # - SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID=your_tenant_id + # # - APP_DIST_STORAGE="file:///app-dist" db: