Exact configuration for authorization with Azure AD

Community Support Server Deployment
1

I have been trying to enable authorization using the temporal helm chart with no success so far, the configuration I provide:
server

server:
  config:
    authorization:
      jwtKeyProvider:
       keySourceURIs:
          - https://login.microsoftonline.com/${tenant_id}/discovery/v2.0/keys
        refreshInterval: 1m
      permissionsClaimName: roles
      authorizer: default
      claimMapper: default

   additionalEnv:
     - name: TEMPORAL_JWT_PERMISSIONS_CLAIM
       value: "roles"
    - name: TEMPORAL_AUTH_AUTHORIZER
      value: "default"
    - name: TEMPORAL_AUTH_CLAIM_MAPPER
      value: "default"
    - name: TEMPORAL_JWT_KEY_SOURCE1
      value: "https://login.microsoftonline.com/${tenant_id}/discovery/v2.0/keys"
    - name: TEMPORAL_JWT_KEY_REFRESH
      value: "1m"
    - name: USE_INTERNAL_FRONTEND
      value: "true"

Web UI

 additionalEnv:
    - name: TEMPORAL_AUTH_ENABLED
      value: "true"
    - name: TEMPORAL_AUTH_PROVIDER_URL
      value: "https://login.microsoftonline.com/${tenant_id}/v2.0"
    - name: TEMPORAL_AUTH_ISSUER_URL
      value: "https://login.microsoftonline.com/${tenant_id}/v2.0"
    - name: TEMPORAL_AUTH_CALLBACK_URL
      value: "https://$my_url/auth/sso/callback"
    - name: TEMPORAL_AUTH_SCOPES
      value: 'openid,email,profile'

On the azure side I configure a write access to a namespace for a group.

So far, both web ui and workers return unauthorized without much context.

Would be nice to get some support.

2

I’ve recently been working on getting auth working with azure and have mostly gotten there, albeit I’m not using helm charts but creating my k8s resources by hand. What roles have you assigned to the user trying to login?

3

system:read and namespace:read only to my user, this works in web login, but I the internal workers actually failing which is expected, but I am not sure about internal workers or whether because my client doesn’t have this added yet

msg":"error starting temporal-sys-tq-scanner-workflow workflow","service":"worker","error":"Request unauthorized."

Thanks in advance!

4

Are you using the internal-frontend service? Release v1.20.0 · temporalio/temporal · GitHub

5

I am using it, that’s what makes me even more confused.

6

system:read
and mynamespace:write
btw, solved the internal frontend issue, so only web authorisation is not working

7

Hi @A_T, I’m struggling to make Azure AD work, getting Request unauthorized from Web UI as well as my workers. Would it be possible to post the list of env variables and any other relevant config here please?

Thanks in advance.