fastapi-azure-auth

import os from fastapi import FastAPI, Depends, HTTPException, status from pydantic import AnyHttpUrl from pydantic_settings import BaseSettings, SettingsConfigDict from fastapi_azure_auth import SingleTenantAzureAuthorizationCodeBearer from fastapi_azure_auth.user import User class Settings(BaseSettings): BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000'] TENANT_ID: str = os.environ.get('TENANT_ID', '') APP_CLIENT_ID: str = os.environ.get('APP_CLIENT_ID', '') OPENAPI_CLIENT_ID: str = os.environ.get('OPENAPI_CLIENT_ID', '') SCOPE_DESCRIPTION: str = os.environ.get('SCOPE_DESCRIPTION', 'user_impersonation') model_config = SettingsConfigDict( env_file='.env', env_file_encoding='utf-8', case_sensitive=True ) @property def SCOPE_NAME(self) -> str: return f'api://{self.APP_CLIENT_ID}/{self.SCOPE_DESCRIPTION}' @property def SCOPES(self) -> dict: return {self.SCOPE_NAME: self.SCOPE_DESCRIPTION} settings = Settings() # Configure Azure AD authentication scheme azure_scheme = SingleTenantAzureAuthorizationCodeBearer( app_client_id=settings.APP_CLIENT_ID, tenant_id=settings.TENANT_ID, scopes=settings.SCOPES, ) app = FastAPI( swagger_ui_oauth2_redirect_url='/oauth2-redirect', swagger_ui_init_oauth={ 'usePkceWithAuthorizationCodeGrant': True, 'clientId': settings.OPENAPI_CLIENT_ID, 'scopes': settings.SCOPE_NAME, }, ) @app.get("/authenticated-hello") async def authenticated_hello(user: User = Depends(azure_scheme)): if not user: raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated") return {"message": f"Hello, {user.name}! Your roles: {user.roles}"} # To run: uvicorn main:app --reload # Make sure to set TENANT_ID, APP_CLIENT_ID, OPENAPI_CLIENT_ID in your .env file or environment variables. # Also configure your Azure App Registration with the correct Redirect URIs (e.g., http://localhost:8000/oauth2-redirect).