Azure AD OAuth2 authentication

Last modified: April 6, 2021

For Enterprise customers, the Azure AD authentication provides the possibility to use an Azure Active Directory tenant as an identity provider for TestFreaks.

By using Azure AD Application Roles it is also possible to assign Users and Groups to TestFreaks roles from the Azure Portal.

Create the Azure AD application

To enable the Azure AD OAuth2 you must register your application with Azure AD.

  1. Log in to Azure Portal and click Azure Active Directory in the side menu. If you have access to more than one tenant, select your account in the upper right. Set your session to the Azure AD tenant you wish to use.

  2. Under Manage in the side menu, click App Registrations and then New Registration. Provide a fitting name.

  3. Under Redirect URI, select Web as the app type.

  4. Add the redirect URL https://reviews.testfreaks.com/auth/azuread/callback, then click Register.

  5. The app’s Overview page is displayed.
    Note the Application ID, this is the OAuth Client ID.
    Note the Object ID, this is the Application Object ID.

  6. Click Endpoints from the top menu.
    Note the OAuth 2.0 authorization endpoint (v2), this is the Auth URL.
    Note the OAuth 2.0 token endpoint (v2), this is the Token URL.

  7. Click Certificates & secrets and add a new entry under Client secrets.
    Description: TestFreaks OAuth
    Expires: Never

  8. Click Add, then copy the key value. This is the OAuth Client Secret.

  9. Click Manifest.
    Add definitions for the required Application Roles for TestFreaks. Without this configuration, all users will be assigned the Portal role.
    Every role requires a unique id. On Linux, this can be created with uuidgen. 
     "appRoles": [
     {
         "allowedMemberTypes": [
             "User"
         ],
         "description": "TestFreaks Portal Users",
         "displayName": "TestFreaks Portal Users",
         "id": "SOME-UNIQUE-UUID-1",
         "isEnabled": true,
         "lang": null,
         "origin": "Application",
         "value": "portal"
     },
     {
         "allowedMemberTypes": [
             "User"
         ],
         "description": "TestFreaks Portal Managers",
         "displayName": "TestFreaks Portal Managers",
         "id": "SOME-UNIQUE-UUID-2",
         "isEnabled": true,
         "lang": null,
         "origin": "Application",
         "value": "manager"
     }
 ]

  10. Go to Azure Active Directory and then to Enterprise Applications. Search for your application and click on it.

  11. Click on Users and Groups and add Users/Groups to the TestFreaks roles by using Add User.

Application Roles for automatic provisioning

The value field in the manifest for each appRole can be a comma-separated list of roles or client-id:role tuples. Space is not allowed in the value and the maximum length of the value field is 120 characters.

If you don’t specify a client-id, the role will be used for all client-ids associated with your account.

A user will get roles according to the union of all roles in all appRoles.

For example, you could create two separate appRoles, one with value portal and one with manager. They will apply to all your clients. Or if you have multiple sites, for example client-us, client-ca, client-uk, client-se, you can create one appRole for Europe with value client-uk:portal,client-se:portal and one for North America with value client-us:portal,client-ca:portal.

Enable Azure AD OAuth in TestFreaks

Send this information to your TestFreaks contact for setup:

  • OAuth Client ID
  • OAuth Client Secret
  • Application Object ID
  • Auth URL
  • Token URL