Azure AD B2C Connect #3753

modules/boonex/azure_b2c_con/classes/BxAzrB2CModule.php

@@ -19,6 +19,7 @@ use Alancting\Microsoft\JWT\AzureAd\AzureAdIdTokenJWT;
 /**
  * This Azude AD connect code was created with instructions from:
  * https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-b2c-overview#supported-app-types-and-scenarios
+ * 
  * https://www.sipponen.com/archives/4024
  * And official docs:
  * https://docs.microsoft.com/en-us/azure/active-directory-b2c/add-web-api-application?tabs=app-reg-ga
@@ -28,6 +29,8 @@ use Alancting\Microsoft\JWT\AzureAd\AzureAdIdTokenJWT;
  * https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent?tabs=azure-portal
  * https://docs.microsoft.com/en-us/azure/active-directory-b2c/openid-connect
  * https://docs.microsoft.com/en-us/azure/active-directory-b2c/tokens-overview
+ *
+ * https://docs.microsoft.com/en-us/azure/active-directory-b2c/microsoft-graph-get-started?tabs=app-reg-ga
  */
 class BxAzrB2CModule extends BxBaseModConnectModule
 {
@@ -70,7 +73,7 @@ class BxAzrB2CModule extends BxBaseModConnectModule
 
             $sBaseUrl = "https://" . $this->_oConfig->sDomain . "/" . $this->_oConfig->sTenant . "/" . $this->_oConfig->sPolicy;//B2C_1_login_una";
             $sUrl = bx_append_url_params($sBaseUrl . "/oauth2/v2.0/authorize", [
-                // 'state' => $this->_genToken(), // This at least semi-random string is likely good enough as state identifier
+                //'state' => $this->_genToken(), // This at least semi-random string is likely good enough as state identifier
                 'scope' => $this->_oConfig->sScope, 
                 'response_type' => 'code',
                 'response_mode' => 'query',
@@ -121,7 +124,6 @@ class BxAzrB2CModule extends BxBaseModConnectModule
 
         $sIdToken = $aAuthData['id_token'];
 
-
         // parse token to get the data
         // 
         // to make library to with B2C correctly please comment out the following lines in 
@@ -145,11 +147,45 @@ class BxAzrB2CModule extends BxBaseModConnectModule
             'id' => $oIdTokenJWT->get('oid'),
             'name' => $oIdTokenJWT->get('given_name'),
             'last_name' => $oIdTokenJWT->get('family_name'),
-            'email' => reset($oIdTokenJWT->get('emails')),
+            'email' => @reset($oIdTokenJWT->get('emails')),
         ];
 
         $aRemoteProfileInfo = $aUserData;
 
+
+        if (getParam('bx_azrb2c_group')) {
+            // get access token to call MS Graph API
+            $s = bx_file_get_contents("https://login.microsoftonline.com/" . $this->_oConfig->sTenantID . "/oauth2/v2.0/token", [
+                'grant_type'    => 'client_credentials',//'authorization_code',
+                'client_id'     => $this->_oConfig->sClientID,
+                'scope'         => "https://graph.microsoft.com/.default",
+                'client_secret' => $this->_oConfig->sSecret,
+            ], 'post', array ('Content-Type: application/x-www-form-urlencoded'));
+            $aAuthData2 = $this->_decodeResponseAndHandleError($s);
+
+            // call MS Graph API
+            $bMemberOfGroup = false;
+            if (isset($aAuthData2['access_token'])) {
+                $sBaseUrl = "https://graph.microsoft.com/v1.0/users/" . $oIdTokenJWT->get('oid') . "/memberOf";
+                $s = bx_file_get_contents($sBaseUrl, [], 'GET', array ('Authorization: Bearer ' . $aAuthData2['access_token']));
+                $aUserGroups = $this->_decodeResponseAndHandleError($s);
+                if (isset($aUserGroups['value'])) {
+                    foreach ($aUserGroups['value'] as $r) {
+                        if (getParam('bx_azrb2c_group') == $r['displayName']) {
+                            $bMemberOfGroup = true;
+                            break;
+                        }
+                    }
+                }
+            }
+
+            if (!$bMemberOfGroup) {
+                $this->_oTemplate->getPage(_t('_Error'), MsgBox(_t("_bx_azrb2c_error_not_member_of_group")));
+                exit;
+            }
+        }
+
+
         if ($aRemoteProfileInfo) {
 
             // check if user logged in before

modules/boonex/azure_b2c_con/install/langs/en.xml

@@ -17,6 +17,7 @@
         
         </p>]]></string>
 	<string name="_bx_azrb2c_profile_error_api_keys"><![CDATA[Please configure the module in admin panel (can't define Client ID & Secret)]]></string>
+	<string name="_bx_azrb2c_error_not_member_of_group"><![CDATA[Sorry, you aren't allowed to join]]></string>
 	<string name="_bx_azrb2c_auth_title"><![CDATA[Login with Azure AD B2C]]></string>
 
     <string name="_bx_azrb2c_adm_stg_cpt_type"><![CDATA[Azure AD B2C Connect]]></string>
@@ -26,6 +27,7 @@
     <string name="_bx_azrb2c_option_tenant_id"><![CDATA[Directory (Tenant) ID]]></string>
     <string name="_bx_azrb2c_option_client_id"><![CDATA[Application (Client) ID]]></string>
     <string name="_bx_azrb2c_option_secret"><![CDATA[Client Secret Value]]></string>
+    <string name="_bx_azrb2c_option_group"><![CDATA[Allow to join/login only for members of this group]]></string>
 
 	<string name="_bx_azrb2c_et_password_generated"><![CDATA[Azure AD B2C connect temporary password]]></string>
 	<string name="_bx_azrb2c_et_password_generated_subject"><![CDATA[Temporary password]]></string>
@@ -34,3 +36,4 @@
 <p>Change it after logging-in.</p>
 {email_footer}]]></string>
 </resources>
+

modules/boonex/azure_b2c_con/install/sql/enable.sql

@@ -42,7 +42,8 @@ INSERT INTO `sys_options` (`name`, `value`, `category_id`, `caption`, `type`, `c
 ('bx_azrb2c_module', 'bx_persons', @iCategId, '_sys_connect_option_module', 'select', '', '', 50, 'a:2:{s:6:"module";s:9:"bx_azrb2c";s:6:"method";s:20:"get_profiles_modules";}'),
 ('bx_azrb2c_privacy', '3', @iCategId, '_sys_connect_option_privacy', 'select', '', '', 54, 'a:2:{s:6:"module";s:12:"bx_azrb2c";s:6:"method";s:18:"get_privacy_groups";}'),
 ('bx_azrb2c_confirm_email', 'on', @iCategId, '_sys_connect_option_confirm_email', 'checkbox', '', '', 70, ''),
-('bx_azrb2c_approve', '', @iCategId, '_sys_connect_option_approve', 'checkbox', '', '', 80, '');
+('bx_azrb2c_approve', '', @iCategId, '_sys_connect_option_approve', 'checkbox', '', '', 80, ''),
+('bx_azrb2c_group', '', @iCategId, 'bx_azrb2c_option_group', 'digit', '', '', 90, '');
 
 -- Pages