remix-auth-microsoft

// app/services/auth.server.ts import { MicrosoftStrategy } from "remix-auth-microsoft"; import { Authenticator } from "remix-auth"; interface User { id: string; // ... other user properties } export let authenticator = new Authenticator<User>(/* SessionStorage */); let microsoftStrategy = new MicrosoftStrategy( { clientId: process.env.MICROSOFT_CLIENT_ID ?? '', clientSecret: process.env.MICROSOFT_CLIENT_SECRET ?? '', redirectURI: process.env.MICROSOFT_REDIRECT_URI ?? 'http://localhost:3000/auth/microsoft/callback', tenantId: process.env.MICROSOFT_TENANT_ID, // optional for multi-tenant apps scopes: ['openid', 'profile', 'email', 'offline_access'], // recommended scopes prompt: 'select_account' // 'login', 'consent', 'none', 'select_account' }, async ({ request, tokens, profile }) => { // Here you can fetch the user from your database or create a new user // based on the profile data from Microsoft. // `tokens` contains accessToken, refreshToken, idToken, etc. // `profile` contains basic user info parsed from the ID token or user info endpoint. // Example: Using a placeholder User.findOrCreate // It's crucial to use a reliable identifier like 'sub' from the ID token // or 'id' from the user profile, not email, to prevent spoofing. const userProfileId = profile.id; // or profile.sub from the ID token if (!userProfileId) { throw new Error("Could not get user ID from Microsoft profile."); } // Replace with your actual user management logic const user = { id: userProfileId, email: profile.emails?.[0]?.value || 'unknown@example.com' }; console.log(`Authenticated user: ${user.id} (${user.email})`); // The returned object is stored in the session by the authenticator return user; } ); authenticator.use(microsoftStrategy, "microsoft"); // Example of a route to initiate authentication // app/routes/auth.microsoft.tsx // import type { ActionFunctionArgs } from "@remix-run/node"; // import { redirect } from "@remix-run/node"; // import { authenticator } from "~/services/auth.server"; // export async function action({ request }: ActionFunctionArgs) { // return authenticator.authenticate("microsoft", request, { // successRedirect: "/dashboard", // failureRedirect: "/login", // }); // }