Implement third-party authentication

Authentication using Auth0

This guide will describe how to set up user authentication using the third-party authentication service provider Auth0. Be aware that this only shows how to connect Appfarm to Auth0, and you need to set up an authentication provider from Auth0 yourselves.

Step 1

Go to https://auth0.com/ and create an account. Sign into Auth0.

Step 2

Go to Applications -> Applications and click the Create Application button. Give the application an appropriate name, select the option "Regular Web Applications" and click Create.

When the application is created, make sure to copy the value of Domain, Client ID, and Client Secret to your notepad, as we will need these later. Scroll down to Allowed Callback URLs and type in https://accounts.appfarm.io/v1/callback.

Click Save Changes.

Step 3

In Appfarm Create, go to Secrets and add a new secret. Give it a name, and paste the Client Secret you copied to your notepad into the Value input field. The Secret Type should be String.

Step 4

Go to Login Configs -> Custom Auth Providers and click the plus button to add a new Auth provider. Set the following options:

• Name: Give the auth provider an appropriate name. E.g. "Auth0".

• Provider: Set this to Auth0.

• Client ID: Paste the Client ID you copied to your notepad.

• Client Secret: Select the secret you created for the Client Secret.

• Tenant ID: Paste the Domain you copied to your notepad.

Step 5

Go to Login Configs -> Login Config, and under Custom Auth add a new Auth Provider. Give it an appropriate name, and set the Provider to the Auth provider you created on Step 4.

Testing

Google login should be enabled by default, so you might test the authentication using your Google account.

Authentication using Criipto

This guide will describe how to set up user authentication using the third-party authentication service provider Criipto. Authentication with BankID will be used as an example, but a similar setup might be used to set authentication with the other authentication services Criipto offers. Please note that Criipto is totally independent of Appfarm, and has its own pricing for its services.

Step 1

Go to https://criipto.com/ and create an account. Sign into Criipto Verify.

Step 2

Inside Criipto Verify, go to Applications and create a new application. Fill in/select the following options:

• Name: Give the application an appropriate name

• Callback URLs: Type https://accounts.appfarm.io/v1/callback

• Select e-IDs: Select the provider you want, e.g. "NO BankID"

• OpenID Connect: Enable OAuth2 Code Flow, and set User info response strategy to plainJson

Make sure to copy the value of Client ID/Realm and Available on domain to your notepad, as we will need these later.

Click the Save-button. A dialog box will pop up with your client secret. Make sure to copy the secret to your clipboard, as this value only will be available once (it can only be re-generated). You should also

Step 3

In Appfarm Create, go to Secrets and add a new secret. Give it a name, and paste the Client Secret into the Value input field. The Secret Type should be String.

Step 4

Go to Login Configs -> Custom Auth Providers and click the plus button to add a new Auth provider. Set the following options:

• Name: Give the auth provider an appropriate name. E.g. "Criipto BankID".

• Provider: Set this to Custom.

• Client ID: Paste the Client ID/Realm you copied to your notepad.

• Client Secret: Select the secret you created for the Client Secret.

• OpenID Discovery Endpoint: Paste the .well-known link of the connection you want. The syntax looks like this: https://yourdomain.criipto.id/BASE64(acr_values)/.well-known/openid-configuration. The link has two variables:

  • Domain name (yourdomain.criipto.id), which points to your Criipto application. It should be the Available on domain link you copied to your notepad

  • acr_values (BASE64(acr_values)), which defines which login you'd like to setup. It should be a BASE64 encoded string based on the acr_values required by Criipto for each login. For BankID, the string is dXJuOmdybjphdXRobjpubzpiYW5raWQ=.

Step 5

Go to Login Configs -> Login Config, and under Custom Auth add a new Auth Provider. Give it an appropriate name, and set the Provider to the Auth provider you created on Step 4.

Testing

To test the login, you can create a test user by following this article from Criipto.

Authentication using Microsoft Entra ID (Azure AD)

Follow these steps to configure user authentication with Microsoft Entra ID (Azure AD).

Step 1

Sign in to the Microsoft Azure portal using an account with administrator permission.

Step 2

Register an application.

• Go to Microsoft Entra ID.

• Click Add -> App registration.

• In the Name field, enter a display name, for example appfarm-auth.

• Under Redirect URI, select Web and enter the URI https://accounts.appfarm.io/v1/callback.

• Click Register.

Step 3

Generate and record credentials.

• Go to Certificates & secrets.

• Click New client secret.

• Enter the required details and click Add.

• Note down the generated client secret Value. This secret is required later in this process.

• Go to Overview.

• Note down the Application (client) ID and Directory (tenant) ID values.

Step 4

So that Appfarm has enough information to create the user’s account, you must configure Microsoft Entra ID to provide at least one optional claim – the user's email address. You may also wish to add more.

• Go to Token configuration.

• Click Add optional claim.

• Under Token type, select ID.

• In the list that appears, select email. This claim is required for the authentication to function. We also recommended adding family_name and given_name to complete the Appfarm User object.

• Click Add.

• A dialog will appear. Select Turn on the Microsoft Graph email, profile permission, and click Add.

Screenshot from the Microsoft Azure portal showing the recommended optional claims added.

Step 5

Now, you can start configuring the authentication in Appfarm Create. First, add the client secret as a secret.

• In Appfarm Create, go to Secrets.

• Click Create Secret.

• In the Name field, enter a name for the client secret, for example Microsoft Entra ID Client Secret.

• In the Value field, enter the client secret you noted down in Step 3.

• Click Create.

Step 6

Add a new custom auth provider.

• Go to Login -> Custom Auth Providers.

• Click the + button to add a new provider.

• In the Name field, enter a name for the auth provider, for example Microsoft Entra ID.

• In the Provider field, select Microsoft Entra ID (Azure AD).

• In the Client ID field, enter the Application (client) ID you noted down in Step 3.

• In the Client Secret field, select the secret you created in Step 5.

• In the Tenant ID field, enter the Directory (tenant) ID you noted down in Step 3.

The above configuration will allow users with an existing Appfarm user to log in using Microsoft Entra ID. If you also want new users without an existing Appfarm user to be able to log in, you need to configure that under Appfarm Account Options.

• Select the Auto Create Account checkbox.

• In the Initial Roles list, select the role(s) the user should be assigned on creation.

Step 7

Add the custom auth provider to your login configuration.

• Go to Login -> Login Config.

• Select a login configuration to add the custom auth provider.

• Under Custom Auth, click the + button to add a new provider.

• In the Name field, enter a name for the auth provider, for example Microsoft Entra ID.

• In the Provider field, select the provider you created in Step 6.

Users should now be able to log in to the Appfarm client using their Microsoft Entra ID credentials.

Authentication using Azure AD B2C

Azure AD B2C is a separate service from Microsoft Entra ID (Azure AD) and requires a different setup in Appfarm Create.

Step 1 - Step 3

Follow the same steps as described in Authentication using Microsoft Entra ID (Azure AD). However, instead of using the Microsoft Entra ID service, you need to use Azure AD B2C.

Step 4

In the Azure AD B2C Directory, you need to create the user flow with custom policies. In the custom policies, it is important to include email (string) as a claim.

Step 5

Go to Login Configs -> Custom Auth Providers and click the plus button to add a new Auth provider. Set the following options:

• Name: Give the auth provider an appropriate name. E.g. "Azure AD B2C".

• Provider: Set this to Custom.

• Client ID: Paste the Client ID you copied to your notepad.

• Client Secret: Select the secret you created for the Client Secret.

• Open ID Discovery Endpoint: Paste OpenID Connect metadata endpoint ID for your B2C tenant. This can be found in your B2C tenant at the Azure Portal, and looks like this: https://fabrikamb2c.b2clogin.com/fabrikamb2c.onmicrosoft.com/b2c_1_sign_in/v2.0/.well-known/openid-configuration

Step 6

Go to Login Configs -> Login Config, and under Custom Auth add a new Auth Provider. Give it an appropriate name, and set the Provider to the Auth provider you created in Step 4.