feat: added EntraID in favor of AzureAD and restored old behavior for AzureAD (#668)

### **PR Type**
Enhancement


___

### **Description**
- Add EntraID OAuth provider as replacement for deprecated AzureAD

- Deprecate AzureAD provider with warning message

- Fix OAuth profile validation for empty provider user IDs

- Update API types and OpenAPI specification


___

### Diagram Walkthrough


```mermaid
flowchart LR
  AzureAD["AzureAD Provider (deprecated)"] -- "replaced by" --> EntraID["EntraID Provider"]
  EntraID --> API["API Types Updated"]
  EntraID --> Migration["Database Migration"]
  EntraID --> Validation["Profile Validation"]
```



<details> <summary><h3> File Walkthrough</h3></summary>

<table><thead><tr><th></th><th align="left">Relevant
files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><details><summary>9
files</summary><table>
<tr>
<td><strong>server.gen.go</strong><dd><code>Update generated API server
with EntraID support</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-ebca0209f464067ebb38f8fad9dd352058e15702563f575d649434a1e7722b3d">+159/-159</a></td>

</tr>

<tr>
<td><strong>types.gen.go</strong><dd><code>Add EntraID constants to
generated types</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
</dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-086764bd76c1416b0d0ddedcc804c3e6983907886215f9bb51162df91e823254">+4/-0</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>

<tr>
<td><strong>oauth.go</strong><dd><code>Add EntraID provider
configuration and deprecation warning</code></dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-82367f3f24a804b47ced852a588881c0846894bc0edf1ca3bdc6aa5aef7c37b2">+18/-0</a>&nbsp;
&nbsp; </td>

</tr>

<tr>
<td><strong>serve.go</strong><dd><code>Add EntraID CLI flags and
configuration</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-a900f3187c126bacf5c9c5b1745b5d14bc583c01ab8f1ca84ae449751c224b68">+41/-1</a>&nbsp;
&nbsp; </td>

</tr>

<tr>
<td><strong>azuread.go</strong><dd><code>Simplify AzureAD provider
implementation</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
</dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-206160b7cc0b284900057e9804c7ff57e757be1c4cb9d2b10fefbcafb4a2175f">+8/-10</a>&nbsp;
&nbsp; </td>

</tr>

<tr>
<td><strong>entraid.go</strong><dd><code>Implement new EntraID OAuth
provider</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-c0398837d3ac23ce780549e0c991cee331b013048d5b86d1c66b359f3a735e51">+70/-0</a>&nbsp;
&nbsp; </td>

</tr>

<tr>
<td><strong>scopes.go</strong><dd><code>Add default scopes for EntraID
provider</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
</dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-9007412d3f446ebcafd71f4c653bae37b99757ed41a2c08a5bacd78f2f644df2">+4/-1</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>

<tr>
<td><strong>00018_entraid-provider.down.sql</strong><dd><code>Add
EntraID provider migration rollback</code>&nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-4f4dcec8d023a9e6a961dd636b84c80b79264116e9971db83596edd40e6624a2">+4/-0</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>

<tr>
<td><strong>00018_entraid-provider.up.sql</strong><dd><code>Add EntraID
provider database migration</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-793c1d93860ab26c9c19a0f16d812753861db914456881a758907952f3db8ac1">+8/-0</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>

</table></details></td></tr><tr><td><strong>Formatting</strong></td><td><details><summary>2
files</summary><table>
<tr>
<td><strong>elevate_webauthn_test.go</strong><dd><code>Fix linter
comment for credential ID constant</code>&nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-47ef225c96c0aa63c67e926b18c922a14e7ccbd71145ffe646da196d3cc13880">+1/-1</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>

<tr>
<td><strong>sign_in_webauthn_test.go</strong><dd><code>Fix linter
comment for credential ID constant</code>&nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-a920a6aad3937fe5b208622b01177a4b04a182240e113b6fd1a231b12e7ed20f">+1/-1</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>
</table></details></td></tr><tr><td><strong>Bug
fix</strong></td><td><details><summary>2 files</summary><table>
<tr>
<td><strong>sign_in_provider_callback_get.go</strong><dd><code>Add
validation for empty provider user ID</code>&nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-3ce523d5652c343d2bdb3dc0f4e3ec54888b43c7e348d4b7c59a9139c1aecefe">+5/-0</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>

<tr>
<td><strong>workflows.go</strong><dd><code>Add validation for empty
provider user ID</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
</dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-6aaacc47584f1edde5a01051611a7baffc583fc32b48df6d7fee39afa16a65cb">+5/-0</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>
</table></details></td></tr><tr><td><strong>Configuration
changes</strong></td><td><details><summary>1 files</summary><table>
<tr>
<td><strong>.golangci.yaml</strong><dd><code>Update linter configuration
for issue limits</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5">+3/-0</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>

</table></details></td></tr><tr><td><strong>Documentation</strong></td><td><details><summary>1
files</summary><table>
<tr>
<td><strong>openapi.yaml</strong><dd><code>Add EntraID to OpenAPI
specification</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; </dd></td>
<td><a
href="https://github.com/nhost/hasura-auth/pull/668/files#diff-6e0796423f18517e4c44819722b39c2c5ab9999f9dfb37598288ea041d1db2b0">+1/-0</a>&nbsp;
&nbsp; &nbsp; </td>

</tr>
</table></details></td></tr></tr></tbody></table>

</details>

___

Author: dbarrosop

.golangci.yaml

@@ -1,4 +1,7 @@
 version: "2"
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
 linters:
   default: all
   settings:

docs/openapi.yaml

@@ -2507,6 +2507,7 @@ components:
           - bitbucket
           - workos
           - azuread
+          - entraid
           - strava
           - facebook
           - windowslive

flake.lock

@@ -1,3 +1,3 @@
 package api
 
-const IdTokenProviderFake = IdTokenProvider("fake") //nolint:revive,stylecheck
+const IdTokenProviderFake = IdTokenProvider("fake") //nolint:revive

go/api/api.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"fmt"
+	"log/slog"
 
 	"github.com/nhost/hasura-auth/go/api"
 	"github.com/nhost/hasura-auth/go/providers"
@@ -33,6 +34,8 @@ func getDefaultScopes(providerName api.SignInProvider) []string {
 		return providers.DefaultWorkOSScopes
 	case api.SignInProviderAzuread:
 		return providers.DefaultAzureadScopes
+	case api.SignInProviderEntraid:
+		return providers.DefaultEntraIDScopes
 	case api.SignInProviderFacebook:
 		return providers.DefaultFacebookScopes
 	case api.SignInProviderWindowslive:
@@ -66,6 +69,7 @@ func getScopes(provider api.SignInProvider, scopes []string) []string {
 //nolint:funlen,cyclop
 func getOauth2Providers(
 	cCtx *cli.Context,
+	logger *slog.Logger,
 ) (providers.Map, error) {
 	providersMap := make(providers.Map)
 
@@ -180,6 +184,10 @@ func getOauth2Providers(
 	}
 
 	if cCtx.Bool(flagAzureadEnabled) {
+		logger.WarnContext(
+			cCtx.Context, "AzureAD provider is deprecated, use EntraID provider instead",
+		)
+
 		providersMap["azuread"] = providers.NewAzureadProvider(
 			cCtx.String(flagAzureadClientID),
 			cCtx.String(flagAzureadClientSecret),
@@ -189,6 +197,16 @@ func getOauth2Providers(
 		)
 	}
 
+	if cCtx.Bool(flagEntraIDEnabled) {
+		providersMap["entraid"] = providers.NewEntraIDProvider(
+			cCtx.String(flagEntraIDClientID),
+			cCtx.String(flagEntraIDClientSecret),
+			cCtx.String(flagServerURL),
+			cCtx.String(flagEntraIDTenant),
+			getScopes(api.SignInProviderEntraid, cCtx.StringSlice(flagEntraIDScope)),
+		)
+	}
+
 	if cCtx.Bool(flagFacebookEnabled) {
 		providersMap["facebook"] = providers.NewFacebookProvider(
 			cCtx.String(flagFacebookClientID),

go/api/server.gen.go

@@ -154,6 +154,11 @@ const (
 	flagAzureadClientSecret              = "azuread-client-secret" //nolint:gosec
 	flagAzureadTenant                    = "azuread-tenant"
 	flagAzureadScope                     = "azuread-scope"
+	flagEntraIDEnabled                   = "entraid-enabled"
+	flagEntraIDClientID                  = "entraid-client-id"
+	flagEntraIDClientSecret              = "entraid-client-secret" //nolint:gosec
+	flagEntraIDTenant                    = "entraid-tenant"
+	flagEntraIDScope                     = "entraid-scope"
 	flagFacebookEnabled                  = "facebook-enabled"
 	flagFacebookClientID                 = "facebook-client-id"
 	flagFacebookClientSecret             = "facebook-client-secret"
@@ -1042,6 +1047,7 @@ func CommandServe() *cli.Command { //nolint:funlen,maintidx
 				Name:     flagAzureadTenant,
 				Usage:    "Azuread Tenant",
 				Category: "oauth-azuread",
+				Value:    "common",
 				EnvVars:  []string{"AUTH_PROVIDER_AZUREAD_TENANT"},
 			},
 			&cli.StringSliceFlag{ //nolint: exhaustruct
@@ -1051,6 +1057,40 @@ func CommandServe() *cli.Command { //nolint:funlen,maintidx
 				Value:    cli.NewStringSlice(providers.DefaultAzureadScopes...),
 				EnvVars:  []string{"AUTH_PROVIDER_AZUREAD_SCOPE"},
 			},
+			// Microsoft EntraID flags
+			&cli.BoolFlag{ //nolint: exhaustruct
+				Name:     flagEntraIDEnabled,
+				Usage:    "Enable EntraID OAuth provider",
+				Category: "oauth-entraid",
+				Value:    false,
+				EnvVars:  []string{"AUTH_PROVIDER_ENTRAID_ENABLED"},
+			},
+			&cli.StringFlag{ //nolint: exhaustruct
+				Name:     flagEntraIDClientID,
+				Usage:    "EntraID OAuth client ID",
+				Category: "oauth-entraid",
+				EnvVars:  []string{"AUTH_PROVIDER_ENTRAID_CLIENT_ID"},
+			},
+			&cli.StringFlag{ //nolint: exhaustruct
+				Name:     flagEntraIDClientSecret,
+				Usage:    "EntraID OAuth client secret",
+				Category: "oauth-entraid",
+				EnvVars:  []string{"AUTH_PROVIDER_ENTRAID_CLIENT_SECRET"},
+			},
+			&cli.StringFlag{ //nolint:exhaustruct
+				Name:     flagEntraIDTenant,
+				Usage:    "EntraID Tenant",
+				Category: "oauth-entraid",
+				Value:    "common",
+				EnvVars:  []string{"AUTH_PROVIDER_ENTRAID_TENANT"},
+			},
+			&cli.StringSliceFlag{ //nolint: exhaustruct
+				Name:     flagEntraIDScope,
+				Usage:    "EntraID OAuth scope",
+				Category: "oauth-entraid",
+				Value:    cli.NewStringSlice(providers.DefaultEntraIDScopes...),
+				EnvVars:  []string{"AUTH_PROVIDER_ENTRAID_SCOPE"},
+			},
 			// Facebook provider flags
 			&cli.BoolFlag{ //nolint: exhaustruct
 				Name:     flagFacebookEnabled,
@@ -1271,7 +1311,7 @@ func getGoServer( //nolint:funlen
 		return nil, err
 	}
 
-	oauthProviders, err := getOauth2Providers(cCtx)
+	oauthProviders, err := getOauth2Providers(cCtx, logger)
 	if err != nil {
 		return nil, fmt.Errorf("problem creating oauth providers: %w", err)
 	}

go/api/types.gen.go

@@ -168,13 +168,13 @@ func (response ErrorResponse) VisitRefreshTokenResponse(w http.ResponseWriter) e
 	return response.visit(w)
 }
 
-func (response ErrorResponse) VisitSignInIdTokenResponse( //nolint:revive,stylecheck
+func (response ErrorResponse) VisitSignInIdTokenResponse( //nolint:revive
 	w http.ResponseWriter,
 ) error {
 	return response.visit(w)
 }
 
-func (response ErrorResponse) VisitLinkIdTokenResponse( //nolint:revive,stylecheck
+func (response ErrorResponse) VisitLinkIdTokenResponse( //nolint:revive
 	w http.ResponseWriter,
 ) error {
 	return response.visit(w)

go/cmd/oauth.go

@@ -7,7 +7,7 @@ import (
 	"github.com/nhost/hasura-auth/go/middleware"
 )
 
-func (ctrl *Controller) LinkIdToken( //nolint:ireturn,revive,stylecheck
+func (ctrl *Controller) LinkIdToken( //nolint:ireturn,revive
 	ctx context.Context, req api.LinkIdTokenRequestObject,
 ) (api.LinkIdTokenResponseObject, error) {
 	logger := middleware.LoggerFromContext(ctx)