add support for single tenant microsoft login

backend/windmill-api/src/oauth2.rs

@@ -934,6 +934,15 @@ async fn slack_command(
     ));
 }
 
+fn transform_name_to_email(x: String) -> String {
+    let r = x.replace(' ', "_");
+    if r.contains('@') {
+        return r;
+    } else {
+        return format!("{r}@windmill.dev");
+    }
+}
+
 #[allow(non_snake_case)]
 async fn login_callback(
     Path(client_name): Path<String>,
@@ -955,11 +964,11 @@ async fn login_callback(
 
     if let Ok(token) = token_res {
         let token = &token.access_token.to_string();
+
         let userinfo_url = client_w_config.userinfo_url.as_ref().ok_or_else(|| {
             Error::BadConfig(format!("Missing userinfo_url in client {client_name}"))
         })?;
         let user = http_get_user_info::<LoginUserInfo>(&HTTP_CLIENT, userinfo_url, token).await?;
-
         let email = match client_name.as_str() {
             "github" => http_get_user_info::<Vec<GHEmailInfo>>(
                 &HTTP_CLIENT,
@@ -974,9 +983,15 @@ async fn login_callback(
             )))?
             .email
             .to_string(),
-            _ => user.email.clone().ok_or_else(|| {
-                error::Error::BadRequest("email address not fetchable from user info".to_string())
-            })?,
+            _ => user
+                .email
+                .clone()
+                .or(user.name.clone().map(transform_name_to_email))
+                .ok_or_else(|| {
+                    error::Error::BadRequest(
+                        "email address not fetchable from user info".to_string(),
+                    )
+                })?,
         }
         .to_lowercase();
 

frontend/src/lib/components/OAuthSetting.svelte

@@ -10,6 +10,29 @@
 	$: enabled = value != undefined
 
 	let allowed_domains = value?.['allowed_domains'] ?? ''
+
+	let tenant: string = ''
+	$: name == 'microsoft' && changeTenantId(tenant)
+
+	function changeTenantId(tenant: string) {
+		if (value && tenant) {
+			if (tenant != '') {
+				value = {
+					...value,
+					login_config: {
+						auth_url: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
+						token_url: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+						userinfo_url: `https://graph.microsoft.com/oidc/userinfo`,
+						scopes: ['openid', 'profile', 'email']
+					}
+				}
+			} else {
+				if (value['login_config']) {
+					delete value['login_config']
+				}
+			}
+		}
+	}
 </script>
 
 <div class="flex flex-col gap-1">
@@ -35,7 +58,12 @@
 				<span class="text-primary font-semibold text-sm">Client Secret</span>
 				<input type="text" placeholder="Client Secret" bind:value={value['secret']} />
 			</label>
-			{#if login}
+			{#if name == 'microsoft'}
+				<label class="block pb-2">
+					<span class="text-primary font-semibold text-sm">Tenant Id</span>
+					<input type="text" placeholder="Tenant Id" bind:value={tenant} />
+				</label>
+			{:else if login}
 				<label class="block pb-2">
 					<span class="text-primary font-semibold text-sm">Allowed domain</span>
 					<input
@@ -74,12 +102,13 @@
 							href="https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade"
 							target="_blank">in microsoft portal</a
 						>
-						and in the "Authentication" tab, set the redirect URI to
-						<code>BASE_URL/user/login_callback/microsoft</code>, the logout channel to
-						<code>BASE_URL/auth/logout</code>where BASE_URL is what you configured as core BASE_URL.
-						Also set "Accounts in any organizational directory (Any Microsoft Entra ID tenant -
-						Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)", you can restrict the
-						emails directly in windmill using the "allowed_domains" setting.
+						"Add" {'->'} "App Registration" -> "Accounts in this organizational directory only (Default
+						Directory only - Single tenant)", and in the "Authentication" tab, set the redirect URI to
+						Web and
+						<code>BASE_URL/user/login_callback/microsoft</code>. Then copy the "Directory (tenant
+						ID)" in the tenant ID field. Then copy the Client ID from "Application (client) ID" and
+						create a secret in "Client credentials". Last, include "Sign in" and "read user profile"
+						under "Delegated Permissions".
 					</div>
 				</CollapseLink>
 			{/if}

frontend/src/lib/components/common/seconds/SecondsInput.svelte

@@ -41,7 +41,7 @@
 	}
 </script>
 
-<div>
+<div class="flex flex-wrap gap-x-4">
 	{#if !hideDisplay}
 		<input
 			value={seconds == null || seconds == undefined
@@ -52,7 +52,7 @@
 			{disabled}
 			readonly
 			type="text"
-			class="max-w-[248px] bg-gray-50 mb-2"
+			class="max-w-[248px] bg-gray-50 mb-2 mt-6"
 		/>
 	{/if}
 	<div class="flex flex-wrap items-center gap-2 text-xs font-medium">