Network.OAuth2.Session

MS Identity user session based on OAuth tokens

The library supports the following authentication scenarios :

• Client Credentials (server/server or automation accounts)
• Authorization Code (with human users being prompted to delegate some access rights to the app)

and provides functions to keep tokens up to date in the background.

App-only flow

type Token t = TVar (Maybe t)

App has (at most) one token at a time

newNoToken :: MonadIO m => m (Token t)

expireToken :: MonadIO m => Token t -> m ()

readToken :: MonadIO m => Token t -> m (Maybe t)

fetchUpdateToken

Arguments

:: MonadIO m

=> IdpApplication 'ClientCredentials AzureAD

-> Token OAuth2Token

token TVar

-> Manager

-> m ()

Fetch an OAuth token and keep it updated. Should be called as a first thing in the app

NB : forks a thread in the background

https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow

Auth code grant flow

OAuth endpoints

loginEndpoint

Arguments

:: MonadIO m

=> IdpApplication 'AuthorizationCode AzureAD

-> RoutePattern

e.g. "/login"

-> Scotty m ()

Login endpoint

see azureADApp

replyEndpoint

Arguments

:: MonadIO m

=> IdpApplication 'AuthorizationCode AzureAD

-> Tokens UserSub OAuth2Token

token TVar

-> Manager

-> RoutePattern

e.g. "/oauth/reply"

-> Scotty m ()

The identity provider redirects the client to the reply endpoint as part of the OAuth flow : https://learn.microsoft.com/en-us/graph/auth-v2-user?view=graph-rest-1.0&tabs=http#authorization-response

NB : forks a thread per logged in user to keep their tokens up to date

In-memory user session

type Tokens uid t = TVar (TokensData uid t)

transactional token store

newTokens :: (MonadIO m, Ord uid) => m (Tokens uid t)

Create an empty Tokens object

data UserSub

sub field

Instances

FromJSON UserSub

Defined in Network.OAuth2.JWT

Methods

parseJSON :: Value -> Parser UserSub

parseJSONList :: Value -> Parser [UserSub]

FromJSONKey UserSub

Defined in Network.OAuth2.JWT

Methods

fromJSONKey :: FromJSONKeyFunction UserSub

fromJSONKeyList :: FromJSONKeyFunction [UserSub]

ToJSON UserSub

Defined in Network.OAuth2.JWT

Methods

toJSON :: UserSub -> Value

toEncoding :: UserSub -> Encoding

toJSONList :: [UserSub] -> Value

toEncodingList :: [UserSub] -> Encoding

ToJSONKey UserSub

Defined in Network.OAuth2.JWT

Methods

toJSONKey :: ToJSONKeyFunction UserSub

toJSONKeyList :: ToJSONKeyFunction [UserSub]

IsString UserSub

Defined in Network.OAuth2.JWT

Methods

fromString :: String -> UserSub

Generic UserSub

Defined in Network.OAuth2.JWT

Associated Types

type Rep UserSub :: Type -> Type

Methods

from :: UserSub -> Rep UserSub x

to :: Rep UserSub x -> UserSub

Show UserSub

Defined in Network.OAuth2.JWT

Methods

showsPrec :: Int -> UserSub -> ShowS

show :: UserSub -> String

showList :: [UserSub] -> ShowS

Eq UserSub

Defined in Network.OAuth2.JWT

Methods

(==) :: UserSub -> UserSub -> Bool

(/=) :: UserSub -> UserSub -> Bool

Ord UserSub

Defined in Network.OAuth2.JWT

Methods

compare :: UserSub -> UserSub -> Ordering

(<) :: UserSub -> UserSub -> Bool

(<=) :: UserSub -> UserSub -> Bool

(>) :: UserSub -> UserSub -> Bool

(>=) :: UserSub -> UserSub -> Bool

max :: UserSub -> UserSub -> UserSub

min :: UserSub -> UserSub -> UserSub

type Rep UserSub

Defined in Network.OAuth2.JWT

type Rep UserSub = D1 ('MetaData "UserSub" "Network.OAuth2.JWT" "ms-auth-0.2.0.0-11f3onhyXnn9eYZnKIhkHh" 'True) (C1 ('MetaCons "UserSub" 'PrefixI 'True) (S1 ('MetaSel ('Just "userSub") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedLazy) (Rec0 Text)))

lookupUser

Arguments

:: (MonadIO m, Ord uid)

=> Tokens uid t

-> uid

user identifier e.g. sub

-> m (Maybe t)

Look up a user identifier and return their current token, if any

expireUser

Arguments

:: (MonadIO m, Ord uid)

=> Tokens uid t

-> uid

user identifier e.g. sub

-> m ()

Remove a user, i.e. they will have to authenticate once more

tokensToList :: MonadIO m => Tokens k a -> m [(k, a)]

return a list representation of the Tokens object

Scotty misc

Azure App Service

withAADUser

Arguments

:: MonadIO m

=> Tokens UserSub t

-> Text

login URI

-> (t -> Action m ())

call MSGraph APIs with token t, etc.

-> Action m ()

Decode the App Service ID token header X-MS-TOKEN-AAD-ID-TOKEN, look its user up in the local token store, supply token t to continuation. If the user sub cannot be found in the token store the browser is redirected to the login URI.

Special case of aadHeaderIdToken

type Scotty = ScottyT Text

type Action = ActionT Text