You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
### Motivation and Context
This PR addresses
microsoft/semantic-kernel#1639. It is a
combination of PRs #92 and #110
### Description
#### Backend changes
- Remove API key authorization
- Use "AzureAD" as default authentication configuration for deployments,
"None" for running locally (Note: UI changes to disable sign in flow for
the latter case are still forthcoming)
- Enable auth policy on controllers that checks if the user is part of
the conversation they are trying to access
This PR changes the contract between the frontend and backend around how
user IDs are communicated. Users who have been signing into the frontend
with AAD will now only see their chats if the backend is also gated by
AAD authentication, which was not the case previously.
#### Frontend changes
- adds `REACT_APP_AUTH_TYPE` and changes AAD variables in `.env` to be
optional
- adds `AuthHelper.IsAuthAAD` to conditionally render different elements
throughout the app
- changes user settings menu popup to instead just show as a settings
button:
Existing users will need to uncomment `REACT_APP_AUTH_TYPE=AzureAd` in
`webapp/.env` to continue using AAD as their authorization type.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [Contribution
Guidelines](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Desmond Howard <[email protected]>
-[Azure AD Tenant](https://learn.microsoft.com/azure/active-directory/develop/quickstart-create-new-tenant)
22
20
- AI Service
23
21
24
22
| AI Service | Requirement |
@@ -28,13 +26,6 @@ You will need the following items to run the sample:
28
26
29
27
# Instructions
30
28
31
-
## Register an application
32
-
33
-
1. Follow [these instructions](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app) and use the values below:
34
-
-`Supported account types`: "_Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)_"
35
-
-`Redirect URI (optional)`: _Single-page application (SPA)_ and use _http://localhost:3000_.
36
-
2. Take note of the `Application (client) ID`. Chat Copilot will use this ID for authentication.
37
-
38
29
## Windows
39
30
40
31
1. Open PowerShell as an administrator.
@@ -52,19 +43,12 @@ You will need the following items to run the sample:
-`API_KEY`: The `API key` for Azure OpenAI or for OpenAI.
60
51
-`AZURE_OPENAI_ENDPOINT`: The Azure OpenAI resource `Endpoint` address. Omit `-Endpoint` if using OpenAI.
61
-
-`AZURE_APPLICATION_ID`: The `Application (client) ID` associated with the registered application.
62
-
63
-
- (Optional): To set a specific Tenant Id, use the parameter:
64
-
65
-
```powershell
66
-
-TenantId {TENANT_ID}
67
-
```
68
52
69
53
-> **IMPORTANT:** For `AzureOpenAI`, if you deployed models `gpt-35-turbo` and `text-embedding-ada-002` with custom names (instead of each own's given name), also use the parameters:
70
54
@@ -111,19 +95,13 @@ You will need the following items to run the sample:
-`API_KEY`: The `API key` for Azure OpenAI or for OpenAI.
119
103
-`AZURE_OPENAI_ENDPOINT`: The Azure OpenAI resource `Endpoint` address. Omit `--endpoint` if using OpenAI.
120
-
-`AZURE_APPLICATION_ID`: The `Application (client) ID` associated with the registered application.
121
104
122
-
- (Optional): To set a specific Tenant Id, use the parameter:
123
-
124
-
```bash
125
-
--tenantid {TENANT_ID}
126
-
```
127
105
128
106
-> **IMPORTANT:** For `AzureOpenAI`, if you deployed models `gpt-35-turbo` and `text-embedding-ada-002` with custom names (instead of each own's given name), also use the parameters:
129
107
@@ -141,27 +119,36 @@ You will need the following items to run the sample:
141
119
142
120
> NOTE: Confirm pop-ups are not blocked and you are logged in with the same account used to register the application.
143
121
144
-
## (Optional) Enable backend authorization via Azure AD
122
+
## (Optional) Enable backend authentication via Azure AD
123
+
124
+
By default, Chat Copilot runs locally without authentication, using a guest user profile. If you want to enable authentication with Azure Active Directory, follow the steps below.
125
+
126
+
### Requirements
145
127
146
-
1. Ensure you created the required application registration mentioned in [Register an application](#register-an-application)
- [Azure AD Tenant](https://learn.microsoft.com/azure/active-directory/develop/quickstart-create-new-tenant)
147
130
148
-
2. Create a second application registration to represent the web api
131
+
### Instructions
149
132
150
-
> For more details on creating an application registration, go [here](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).
133
+
1. Create an [application registration](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app) for the frontend web app, using the values below
134
+
- `Supported account types`: "_Accounts in this organizational directory only ({YOUR TENANT} only - Single tenant)_"
135
+
- `Redirect URI (optional)`: _Single-page application (SPA)_ and use _http://localhost:3000_.
151
136
152
-
1. Give the app registration a name
137
+
2. Create a second [application registration](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app) for the backend web api, using the values below:
138
+
- `Supported account types`: "_Accounts in this organizational directory only ({YOUR TENANT} only - Single tenant)_"
139
+
- Do **not** configure a `Redirect URI (optional)`
153
140
154
-
2. As _Supported account type_ choose `Accounts in any organizational directory and personal Microsoft Accounts`
141
+
> NOTE: Other account types can be used to allow multitenant and personal Microsoft accounts to use your application if you desire. Doing so may result in more users and therefore higher costs.
155
142
156
-
3. Do not configure a _Redirect Uri_
143
+
> Take note of the `Application (client) ID`forboth app registrations as you will need themin future steps.
157
144
158
145
3. Expose an API within the second app registration
159
146
160
147
1. Select _Expose an API_ from the menu
161
148
162
149
2. Add an _Application ID URI_
163
150
164
-
1. This will generate an `api://` URI with a generated for you
151
+
1. This will generate an `api://` URI
165
152
166
153
2. Click _Save_ to store the generated URI
167
154
@@ -193,17 +180,40 @@ You will need the following items to run the sample:
193
180
194
181
7. Click _Add permissions_
195
182
196
-
5. Update frontend web app configuration
183
+
5. Run the Configure script with additional parameters to set up authentication.
197
184
198
-
1. Open _.env_ file
185
+
**Powershell**
199
186
200
-
2. Set the value of `REACT_APP_AAD_API_SCOPE` to your application ID URI followed by the scope `access_as_user`, e.g. `api://12341234-1234-1234-1234-123412341234/access_as_user`
0 commit comments