NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(microsoft): resolve AADSTS50194 by enforcing tenant-specific endpoint planningsagenda.nl instead of common for single-tenant app

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-09 11:24:19 +02:00
parent 9833813db4
commit bc1537be0c
4 changed files with 103 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/callback_microsoft.php
+1 -1
View File
@@ -77,7 +77,7 @@ $appConfig = microsoft_get_app_config();
$clientId = $appConfig['client_id'];
$clientSecret = $appConfig['client_secret'];
$tenantId = $appConfig['tenant_id'];
$tenantId = (!empty($appConfig['tenant_id']) && $appConfig['tenant_id'] !== 'common') ? $appConfig['tenant_id'] : 'planningsagenda.nl';
if (empty($clientId) || empty($clientSecret)) {
header('Location: /profile.php?error=' . urlencode('Microsoft 365 configuratie (Client ID of Secret) ontbreekt in Fociz. Neem contact op met de beheerder.'));
auth/oauth_microsoft.php
+12
View File
@@ -15,6 +15,18 @@ $appConfig = microsoft_get_app_config();
$clientId = !empty($_GET['client_id']) ? trim($_GET['client_id']) : $appConfig['client_id'];
$tenantId = !empty($_GET['tenant_id']) ? trim($_GET['tenant_id']) : $appConfig['tenant_id'];
// Voorkom AADSTS50194: single-tenant Azure applicaties mogen NOOIT het /common endpoint gebruiken
if (empty($tenantId) || $tenantId === 'common') {
$userEmail = $user['email'] ?? '';
$parts = explode('@', $userEmail);
$domain = strtolower(trim(end($parts)));
if (!empty($domain) && !in_array($domain, ['gmail.com', 'outlook.com', 'hotmail.com', 'live.com', 'yahoo.com', 'icloud.com'])) {
$tenantId = $domain;
} else {
$tenantId = 'planningsagenda.nl';
}
}
if (empty($clientId)) {
$err = ($user['role'] === 'ADMIN')
? 'Vul eerst de Application (Client) ID en het Client Secret in bij het Systeembeheer om te koppelen met Microsoft 365.'