2 ms·
Btw, even single-tenant can be a bit scary in this regard: You can by default log in with guest users. For instance if someone has joined a teams meeting. So un
by matsemann 4y ago
Btw, even single-tenant can be a bit scary in this regard: You can by default log in with guest users. For instance if someone has joined a teams meeting. So unless you explicitly check permissions or disable this (for instance if you think "everyone in our org should have access to this"), you inadvertently could have external people log into your apps as well.
- hotfixguru 4y agoTutorial on how to deny Guest users in Azure AD[1] In general, one should always use roles in Azure. Even if you have a flaw like this, your endpoint would be safe if you required a role to access your endpoint. For multi-tenants, I completely this misconfiguration, there’s no real warnings when configuring it. In order to lock down to specific tenants, I recommend having a list of issuers that you check the token against.[2] [1] https://intility.github.io/fastapi-azure-auth/single-tenant/guest_users https://intility.github.io/fastapi-azure-auth/single-tenant/... [2] https://intility.github.io/fastapi-azure-auth/multi-tenant/accept_specific_tenants_only https://intility.github.io/fastapi-azure-auth/multi-tenant/a...