Custom auth providers
Appfarm supports third-party authentication by integrating with authentication providers using OAuth 2.0.
Using a custom auth provider allows you to manage users in an external directory such as Microsoft Entra ID (Azure AD). To enable custom auth you must first complete any necessary setup with the provider, and then configure the provider in Appfarm Create.
For detailed walkthroughs on how to configure a number of different providers, see How to configure third-party authentication.
Checklist
Follow these steps to correctly setup and configure a custom auth provider.
In your auth provider:
Create a new application. Please refer to your provider's documentation for details.
When creating an OAuth application, it will require at least one callback URL. Use
https://accounts.appfarm.io/v1/callback
.Make note of the Client ID and Client Secret provided when you create the OAuth application.
In Appfarm Create:
Add a new custom auth provider.
Enter the provided Client ID into Client ID.
Create a secret to store the Client Secret and select it from the Client Secret list.
Depending on what kind of provider you are using, fill in the Tenant ID or OpenID Discovery Endpoint.
Add the custom auth provider in a login configuration under Custom auth.
General settings
Setting | Description |
---|---|
Name | A descriptive reference used only in Appfarm Create. |
Provider | The auth provider. The following options are available:
|
Client ID | The identifier of the application created in your auth provider. Usually this is a unique application used only to authenticate users for this Appfarm solution. |
Client Secret | The secret for the application as provided by your auth provider. This value must be stored in Appfarm as a secret. |
Tenant ID | Only for Microsoft Entra ID (Azure AD) and Auth0. The unique identifier for your tenant. Appfarm needs this value to fetch the configuration for this auth provider. The format of this value differs depending on your provider. Microsoft Entra ID (Azure AD)
The identifier can be found inside the Microsoft Azure portal. The format is typically
Auth0
The identifier used in Auth0 is the entire hostname ending with |
OpenID Discovery Endpoint | Only for Custom.
The URL holding the configuration of your OpenID Connect Server. For example: |
Custom Scope | By default, the following scope will be requested:
Add any additional scopes as needed. Note that if you need to save additional scopes to the User object (more than the name, email and phone - e.g. a Social Security Number), you may save these by adding user-specific secrets. Add a new Secret, and select Secret Type |
Remove Default Scope | Remove |
Appfarm account options
Setting | Description |
---|---|
Auto Create Account | Automatically create a user in the solution when a new user authenticates. |
Initial Roles | Assign one or more roles when a new user is created. |
Advanced options
Setting | Description |
---|---|
Disable Same Browser Validation | Warning: This option should be used with caution and an understanding of the security implications. For added security Appfarm checks that a callback from a third-party authentication provider is made by the same browser that initiated the login. By selecting this option, that check will be disabled. This might be desirable to improve the authentication user experience. If, for example, the login flow involves a magic link sent to the user's email address, the user may not open the link in the same browser that the login was initiated from. This will normally result in the login attempt failing. By disabling same browser validation, the login attempt in this case would succeed. |
Auth Timeout | The amount of time a user can spend authenticating with the provider before returning to Appfarm. Normally the default (15 minutes) will be more than sufficient. In some cases, for example when the authentication involves sending a link to email, this timeout may be too short. The default is 900 seconds (15 minutes), and the maximum is 86400 seconds (24 hours). |
Last updated