[EDFI-2780] Enable Entra machine user - #243
Open
adiaz-msdf wants to merge 9 commits into
Open
Conversation
adiaz-msdf
marked this pull request as ready for review
July 28, 2026 15:50
adiaz-msdf
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Admin App API’s AuthenticatedGuard to recognize Microsoft Entra ID–issued machine-to-machine JWTs in addition to the Keycloak/Auth0 formats already supported, and adds Jest unit tests for the new token shapes.
Changes:
- Expand bearer-token claim parsing to support Entra conventions (
audarray, client id viaazp/appid, permissions viaroles). - Preserve existing Keycloak/Auth0 behavior by keeping the original “explicit
client_idimplies machine token” signal. - Add a new unit test suite covering Entra machine tokens,
audas an array, Keycloak regression, and missing-permission rejection.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| packages/api/src/auth/login/authenticated.guard.ts | Extends bearer JWT parsing/authorization to support Entra machine-token claim formats while keeping existing provider behavior. |
| packages/api/src/auth/login/authenticated.guard.spec.ts | Adds unit tests validating Entra + Keycloak machine token authorization behavior and expected rejections. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Exclude Entra delegated scp from machine login:app grant sources - Add unit test for Entra v1.0 appid-shaped machine token - Rename Auth0Payload to AccessTokenPayload Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR makes the Admin App API accept machine-to-machine (service) tokens issued by Microsoft Entra ID, alongside the Keycloak/Auth0 tokens it already supported.
Previously, the API's authentication guard only understood the JWT claim format that Keycloak and Auth0 produce, so a service authenticating through Entra ID was always rejected. The guard now recognizes Entra's token format as well it knows where each identity provider puts the client identifier and the permission grants, and treats them equivalently. The security rules themselves are unchanged: a machine token still must be issued for the expected audience and carry the
login:apppermission, and existing Keycloak logins (both human and machine) behave exactly as before.The change is contained to a single file the API's authentication guard plus a new unit test suite covering Entra tokens, the Keycloak regression case, and rejection of tokens lacking the required permission.