Azure DevOps Rest API - how to select Azure Active Directory Tenant for OAuth flow

0
votes

looking at "Authorize access to REST APIs with OAuth 2.0" at https://docs.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops

An Azure DevOps organization is connected to an Azure Active Directory tenant
-> let's call it 'devops-ad-tenant'.

A user has an Active Directory Home Tenant
-> let's call it 'user-ad-home-tenant'.

A user can be a guest user withing another Active Directory Tenant
-> let's call it 'user-ad-guest-tenant'.

If the 'devops-ad-tenant' is equal to the 'user-ad-home-tenant', everything works out fine.

If the 'devops-ad-tenant' is equal to the 'user-ad-guest-tenant', the OAuth flow succeeds, but the flow happens within the context of the 'user-ad-home-tenant' and this user is from a Azure DevOps perspective not the user from 'user-ad-guest-tenant'.

I am having trouble to use something like a "domain_hint" when initiating the OAuth flow.

Any thoughts?

2
azure-devopsazure-active-directoryazure-devops-rest-api

2 Answers

0
votes

This behavior of get the token is used for the home directory is by design since the customer may be as guest for multiple Azure Active Directories. And as the document you shared for the Azure DevOps OAuth authentication, currently there is no such option to choose which directory for the usage of token acquired.

If you want Azure DevOps support this feature, you can submit the feedback from Develop Community - Azure DevOps.

0
votes

I managed to get along with a work around...

My application uses an Azure AD multi-tenant appRegistration for authentication.
When the user logs in at my application, the OAuth flow for Azure DevOps is started.

To set the Azure AD tenant for the OAuth flow for the Azure DevOps organization

  • use a clean browser session, no cookies etc.
  • log into https://aex.dev.azure.com and select the Azure AD tenant 'user-ad-guest-tenant' for Azure DevOps organization
  • duplicate that tab
  • enter the url for my application
  • the OAuth flow happens within the context of 'user-ad-guest-tenant'

this is really inconvenient... but a work around... besides I am still investigating why this is working...