You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
105 lines
4.2 KiB
Markdown
105 lines
4.2 KiB
Markdown
---
|
|
title: Configuration of Microsoft Entra ID Authentication Service for LobeChat
|
|
description: >-
|
|
Learn how to configure Microsoft Entra ID Authentication Service for LobeChat,
|
|
create applications, add users, and set up environment variables for seamless
|
|
integration.
|
|
tags:
|
|
- Microsoft Entra ID
|
|
- Authentication Service
|
|
- Azure Portal
|
|
- SSO
|
|
- Environment Variables
|
|
- LobeChat
|
|
---
|
|
|
|
# Configuration of Microsoft Entra ID Authentication Service
|
|
|
|
<Steps>
|
|
### Create a Microsoft Entra ID Application
|
|
|
|
In your [Microsoft Azure Portal][microsoft-azure-portal], go to Microsoft Entra ID -> App registrations -> New registration to create a new application.
|
|
|
|
Fill in the desired application name to be displayed to organizational users, choose the account types you wish to support, and if only internal users are supported, select `Accounts in this organizational directory only (Default Directory only - Single tenant)`.
|
|
|
|
In the `Redirect URI (optional)` section, for the application type, select `Web`, and in the Callback URL, enter:
|
|
|
|
```bash
|
|
https://your-domain/api/auth/callback/azure-ad
|
|
```
|
|
|
|
<Callout type={'info'}>
|
|
- You can fill in or modify the Redirect URIs after registering, but make sure the URL you enter
|
|
matches the deployed URL. - Please replace "your-domain" with your own domain.
|
|
</Callout>
|
|
|
|
<Image
|
|
alt="App Register"
|
|
inStep
|
|
src="https://github.com/lobehub/lobe-chat/assets/13883964/4f9d83bd-b3fc-4abc-bcf4-ccbad65c219d"
|
|
/>
|
|
|
|
Click on "Register".
|
|
|
|
After successfully creating the application, click on the corresponding application to enter the application details page, and switch to the "Overview" tab to view the corresponding configuration information.
|
|
|
|
<Image
|
|
alt="App Overview"
|
|
inStep
|
|
src="https://github.com/lobehub/lobe-chat/assets/13883964/48a0b702-05bd-4ce4-a007-a8ad00a36e5a"
|
|
/>
|
|
|
|
Go to "Certificates & secrets", select the "Client secrets" tab, click on "New client secret", fill in the description, select the expiration time, and click on "Add" to create a new client secret.
|
|
|
|
<Image
|
|
alt="Create App Client Secret"
|
|
inStep
|
|
src="https://github.com/lobehub/lobe-chat/assets/13883964/c9d66fa0-158c-4bd3-a1fa-969e638259d2"
|
|
/>
|
|
|
|
<Callout type={'important'}>
|
|
Please make sure to save your client secret as this is your only chance to view it.
|
|
</Callout>
|
|
|
|
### Add Users
|
|
|
|
Go back to the "Microsoft Entra ID" interface, enter "Users", click on "New user", fill in the user information, and click on "Create" to create a user for using LobeChat.
|
|
|
|
### Configure Environment Variables
|
|
|
|
When deploying LobeChat, you need to configure the following environment variables:
|
|
|
|
| Environment Variable | Type | Description |
|
|
| --- | --- | --- |
|
|
| `NEXT_AUTH_SECRET` | Required | Key used to encrypt Auth.js session tokens. You can generate the key using the following command: `openssl rand -base64 32` |
|
|
| `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LoboChat. Use `azure-ad` for Microsoft Entra ID. |
|
|
| `AUTH_AZURE_AD_ID` | Required | Client ID of the Microsoft Entra ID application. |
|
|
| `AUTH_AZURE_AD_SECRET` | Required | Client Secret of the Microsoft Entra ID application. |
|
|
| `AUTH_AZURE_AD_TENANT_ID` | Required | Tenant ID of the Microsoft Entra ID application. |
|
|
| `NEXTAUTH_URL` | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. It is only necessary to set it when the default generated redirect address is incorrect. `https://example.com/api/auth` |
|
|
|
|
<Callout type={'tip'}>
|
|
You can refer to [📘 environment
|
|
variables](/docs/self-hosting/environment-variable#microsoft-entra-id) for details on related
|
|
variables.
|
|
</Callout>
|
|
|
|
</Steps>
|
|
|
|
<Callout>
|
|
After successful deployment, users will be able to authenticate and use LobeChat using the users
|
|
configured in Microsoft Entra ID.
|
|
</Callout>
|
|
|
|
## Advanced Configuration
|
|
|
|
Please explore further in the [Microsoft Entra ID Learning Center][microsoft-learn-entra].
|
|
|
|
## Related Resources
|
|
|
|
- [Quickstart: Register an app][microsoft-entra-register-app]
|
|
|
|
[microsoft-azure-portal]: https://portal.azure.com/
|
|
[microsoft-entra-register-app]: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app
|
|
[microsoft-learn-entra]: https://learn.microsoft.com/en-us/entra/identity/
|