Office 365 OAuth SSO Setup

This document will help you configure Microsoft Office 365 as an OAuth / OIDC provider making Drupal as an OAuth Client. Following these steps will allow you to configure OAuth / OpenID Connect SSO between Office 365 and your Drupal site such that your users will be able to log in to your Drupal site using their Office 365 credentials.

We provide the Drupal OAuth & OpenID Connect Login module which is compatible with Drupal 7, Drupal 8, Drupal 9, Drupal 10, and Drupal 11.

Download  Know more

Prerequisite:

• Install and activate the OAuth & OpenID Connect Login - OAuth2 Client SSO Login module on your Drupal site. Follow these steps to install the module.

Steps to configure Drupal as OAuth Client: 

• After successfully installing the module on your Drupal site, navigate to the Configuration tab and click on the miniOrange OAuth Client. (/admin/config/people/mo-oauth-client/mo-client-config)

  

• In the Manage section, under the Client Configuration tab, click on the + Add New button to configure the desired OAuth Client.

  

• Select Custom OAuth 2.0 Provider from the Select Application dropdown on the Configure OAuth tab. 
• Enter Office 365 in the Custom App Name text field.

• Copy the Callback/Redirect URL and keep it handy.

  

• If your provider only supports HTTPS Callback/Redirect URLs and you have an HTTP site, please make sure to enable the 'Enforce HTTPS Callback URL' checkbox under Settings tab.

  

Configure OAuth SSO Application in Microsoft Office 365

• Log in/Sign up for the Microsoft Office 365 Admin console.

• Click App registration from the Azure services section.

  

• Click on New registration button.

  

• Enter the following information on the Register an Application page:
  • Name: Enter display name in Name text field.
  • Supported Account type: Select one of the options, under Who can use this application or use this API? and select Accounts in this organizational directory only (Test only - Single tenant). If you are unsure which option to select, click on the Help me choose link.

  • Redirect URI (optional): Select a platform as Web. Paste the copied Callback/Redirect URL (from your Drupal site) into the Redirect URI text field.

    

• Click on the Register button to create the new application.

Integrating Drupal with Office 365:

• Office 365 assigns a unique Application ID to your application. Copy the Application (client) ID from the Microsoft Office portal.

  

• Then, go back to the Drupal site and paste the copied Client ID into the Client ID text field.

  

• On the Microsoft Office portal, click on Add a certificate or secret under the Essentials section.

  

• Click on New client secret button.
  • On the Add a client secret popup, provide the required information:
    • Description: Enter a Description for this client secret
    • Expires: Select Expires duration from the dropdown.

    • Click on the Add button.

      

• Then, copy the Value from the Client secrets tab. It's your Client Secret key.

  

• Paste the copied Client secrets Value into the Client Secret text field on your Drupal site.

  

• Again, go back to the Microsoft O365 portal.

• From the left side panel, click on the API permissions.

  

• Click on Add a permission button.

• In the Request API Permissions pop-up, click on the Office 365 Management APIs box under the Microsoft APIs tab.

  

• Under What type of permission does your application require?, select the Application permissions card box.

• Select the Permission and click on the Add permissions button.

  

• Navigate to Overview tab from left navigation panel.

  

• Click on Endpoints button, and copy the OAuth 2.0 authorization endpoint (v2).

  

• Navigate to the Drupal site and enter openid into the Scope text field.

• Then, paste the copied authorization endpoint into the Authorization Endpoint text field.

  

• Again navigate to the Microsoft Office 365 portal, copy the OAuth 2.0 token endpoint (v2) from the Endpoints window.

  

• Paste the copied OAuth token endpoint into the Token Endpoint text field on your Drupal site.

  

• Enter the UserInfo Endpoint as mentioned in the below table.

  Scope	openid
  Authorize Endpoint	https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize
  Token Endpoint	https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
  User Info Endpoint	https://graph.microsoft.com/oidc/userinfo

  

• The Send Client ID and Secret in allow you to specify whether the Client ID and Secret should be included in the header or the body of the Token Endpoint Request. If you're unsure which option to select, you can stick with the default settings. Click on the Save Configuration button.

• Check the checkbox to Enable Login with OAuth, scroll down, and click the Save Configuration button.

  

Test configuration of Drupal with Office 365:

• After successfully saving your application, click the Perform Test Configuration button to verify the OAuth SSO connection between Drupal and Office 365.

  

• On a Test Configuration pop-up, if you don't have any active sessions in Office 365 on the same browser, you will be asked to login into the Office 365. Once you are successfully logged into the Office 365, you will be provided with a list of the attributes that are received from the Office 365. 

• Click the Configure Mappings button.

  

• Once you click on the Configure Mapping button, you will be redirected to the Attribute Mapping tab. From there, select the appropriate attribute from the OAuth Server Attribute dropdown where the email value is received, and then click the Save Configuration button.

  

  Note: Mapping the Email Attribute is mandatory for your login to work. 

Congratulations! You have successfully configured Office 365 (O365) as OAuth Provider and Drupal as OAuth Client.

How to perform the SSO login?

• Now, open a new browser/private window and go to your Drupal site login page.
• Click on the Login using Office365 link to initiate the SSO from Drupal.

• If the configuration is correct, you will be logged in to the Drupal site.

 Back to top