Add support for SPA based application clients using PKCE flow

[autom8ter]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Add support for SPA based clients using PKCE flow. PKCE flow is available if "Single-page Application" is selected on the "Authentication" tab of an App Registration in the Azure portal. Here is a screen shot showing a PKCE configuration:

The terraform provider is not useable for SPA based clients in its current form.

New or Affected Resource(s)

• azuread_application

Potential Terraform Configuration

resource "azuread_application" "example" {
  name                       = "example"
  homepage                   = "https://homepage"
  reply_urls                 = ["http://localhost:3000/", "http://localhost:3000/callback"]
  available_to_other_tenants = false
  oauth2_allow_implicit_flow = false
  type                       = "spa"
}

References

• #0000

[manicminer]

Hi @autom8ter, thanks for requesting this! It doesn't look like we're able to support SPA reply/redirect URLs at present but we'll revisit this as soon as we are able.

Long explanation: I originally thought this might be an easy implementation with MS Graph, but it looks like support hasn't been added there yet. Tracing the portal, this makes use of AAD Graph to patch the application with the replyUrlsWithType property - this isn't documented nor is supported by the SDK, but that's how the portal does it. We'd need to compose a request manually, or wait for SDK support. I've raised an upstream issue Azure/azure-sdk-for-go#10830

[SvenHamers]

@manicminer I think it should be possible to implement it.

when i send the following patch request it works

https://graph.microsoft.com/v1.0/applications/(appObjId)

{
"spa":{"redirectUris":[https://test.com]}
}

[manicminer]

@SvenHamers That's great, thanks for reporting a working request with MS Graph 👍

[patst]

highly interested in this as well.

As workaround we added this in an azuread_application resource:

 provisioner "local-exec" {
    command = "az rest --method PATCH --uri 'https://graph.microsoft.com/v1.0/applications/${azuread_application.icp-terraform.object_id}' --headers 'Content-Type=application/json' --body '{\"spa\":{\"redirectUris\":[\"http://localhost:4200/index.html\"]}}'"
  }

[Clem-]

Hi,
I assume that you need to use lifecycle{ignore_changes} if you use this workaround as terraform will want to delete the uris added with az CLI?
Thanks

[simaotwx]

It looks like this will be supported in #474 so I'm looking forward to a new version. Currently have to change this manually in Azure Portal otherwise the app I deploy doesn't work. Kind of surprised that "web" exists but "spa" did not.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.