fix(microsoft): resolve AADSTS50194 by enforcing tenant-specific endpoint planningsagenda.nl instead of common for single-tenant app

2026-09-09 11:24:19 +02:00
parent 9833813db4
commit bc1537be0c
4 changed files with 103 additions and 62 deletions
@@ -15,6 +15,18 @@ $appConfig = microsoft_get_app_config();
 $clientId = !empty($_GET['client_id']) ? trim($_GET['client_id']) : $appConfig['client_id'];
 $tenantId = !empty($_GET['tenant_id']) ? trim($_GET['tenant_id']) : $appConfig['tenant_id'];

+// Voorkom AADSTS50194: single-tenant Azure applicaties mogen NOOIT het /common endpoint gebruiken
+if (empty($tenantId) || $tenantId === 'common') {
+    $userEmail = $user['email'] ?? '';
+    $parts = explode('@', $userEmail);
+    $domain = strtolower(trim(end($parts)));
+    if (!empty($domain) && !in_array($domain, ['gmail.com', 'outlook.com', 'hotmail.com', 'live.com', 'yahoo.com', 'icloud.com'])) {
+        $tenantId = $domain;
+    } else {
+        $tenantId = 'planningsagenda.nl';
+    }
+}
+
 if (empty($clientId)) {
    $err = ($user['role'] === 'ADMIN')
        ? 'Vul eerst de Application (Client) ID en het Client Secret in bij het Systeembeheer om te koppelen met Microsoft 365.'