mirror of
https://github.com/lobehub/lobehub.git
synced 2026-09-20 04:56:13 +08:00
YuTengjing
191f3fe776
* 📝 docs: fix outdated content across the docs site Audited docs/ against the current codebase and fixed stale content that drifted after major refactors (Clerk/NextAuth → Better Auth, src/server → apps/server, src/{config,envs,locales} → packages/*, model-bank updates). - self-hosting/auth: mark removed NextAuth/Clerk pages with deprecation warnings; fix microsoft/zitadel alias claims and the Logto callback path - environment-variables & advanced: correct wrong defaults (S3_SET_ACL, AI_IMAGE_DEFAULT_IMAGE_NUM, index/proxy URLs), drop non-existent env vars and fictional feature flags, fix OIDC config guidance - development: update refactored paths, Better Auth, .mjs configs, remove the MSW section (msw is not a dependency) - providers & model examples: replace retired model ids with in-bank ones; fix comfyui frontmatter corruption - usage: rename Moderator→Orchestrator, GTD→Task, correct shortcut keys, channel capability tables, Feishu/Lark WebSocket mode - platform/migration: fix dead links, docker service name, npx/npm → bun EN and zh-CN pairs updated together. * 📝 docs: fix Logto callback path and AUTH_SECRET deprecation guidance - Revert Logto/Sealos callback URLs to /api/auth/callback/logto to match the runtime SSO redirectURI override - Narrow legacy auth Callout: AUTH_SECRET remains required for Better Auth; mark NEXT_AUTH_SECRET as deprecated in zh-CN * 📝 docs: refresh agent skills for locales, env, auth, and agentRun paths Align OSS agent guidance with post-refactor layout: - packages/locales/src/default + bun run i18n - packages/env/src for env schemas (@/envs alias) - spa-auth shell + src/routes/auth segments - chat agentRun/transports/hetero instead of aiChat * 📝 docs: document APP_URL as required for Better Auth base URL Self-hosted auth uses appEnv.APP_URL as baseURL, not request-header auto-detection. NEXT_PUBLIC_AUTH_URL remains deprecated. * 📝 docs: note self-host search provider setup for web search Built-in lobe-web-browsing needs no client plugin, but self-hosted servers still require SEARCH_PROVIDERS / SEARXNG_URL (default SearXNG). * 📝 docs: point feature guide welcome UI at AgentHome Opening message/questions on the agent chat page live in src/features/AgentHome, not Onboarding WelcomeMessage.
114 lines
4.2 KiB
Plaintext
114 lines
4.2 KiB
Plaintext
---
|
|
title: Configuring Microsoft Authentication for LobeHub
|
|
description: >-
|
|
Learn how to configure Microsoft (Entra ID / Azure AD) SSO for LobeHub,
|
|
including creating applications in Azure Portal and setting up environment
|
|
variables.
|
|
tags:
|
|
- Microsoft
|
|
- Authentication
|
|
- Azure AD
|
|
- LobeHub
|
|
- Single Sign-On
|
|
---
|
|
|
|
# Configuring Microsoft Authentication
|
|
|
|
<Steps>
|
|
### Create a Microsoft Entra ID Application
|
|
|
|
1. Go to [Microsoft Entra Admin Center](https://entra.microsoft.com/)
|
|
2. Navigate to **Identity** > **Applications** > **App registrations** > **New registration**
|
|
3. Fill in the application name
|
|
4. Choose supported account types:
|
|
- **Single tenant**: Only users in your organization
|
|
- **Multitenant**: Users in any Azure AD organization
|
|
- **Multitenant + personal**: Also includes personal Microsoft accounts
|
|
|
|
<Image alt="App Register" inStep src="https://github.com/lobehub/lobehub/assets/13883964/4f9d83bd-b3fc-4abc-bcf4-ccbad65c219d" />
|
|
|
|
### Configure Redirect URI
|
|
|
|
In the **Redirect URI** section:
|
|
|
|
1. Select **Web** as the platform
|
|
2. Enter the callback URL
|
|
|
|
<Callout type={'info'}>
|
|
Callback URL format:
|
|
|
|
- Local development: `http://localhost:3210/api/auth/callback/microsoft`
|
|
- Production: `https://your-domain.com/api/auth/callback/microsoft`
|
|
</Callout>
|
|
|
|
Click **Register**.
|
|
|
|
### Get Application Credentials
|
|
|
|
After creation, view the **Overview** tab:
|
|
|
|
<Image alt="App Overview" inStep src="https://github.com/lobehub/lobehub/assets/13883964/48a0b702-05bd-4ce4-a007-a8ad00a36e5a" />
|
|
|
|
Note down:
|
|
|
|
- **Application (client) ID** - This is your `AUTH_MICROSOFT_ID`
|
|
- **Directory (tenant) ID** - Needed for single-tenant apps
|
|
|
|
### Create Client Secret
|
|
|
|
1. Go to **Certificates & secrets** > **Client secrets**
|
|
2. Click **New client secret**
|
|
3. Fill in description and select expiration time
|
|
4. Click **Add**
|
|
|
|
<Image alt="Create App Client Secret" inStep src="https://github.com/lobehub/lobehub/assets/13883964/c9d66fa0-158c-4bd3-a1fa-969e638259d2" />
|
|
|
|
<Callout type={'warning'}>
|
|
Copy the client secret **Value** immediately - you won't be able to see it
|
|
again.
|
|
</Callout>
|
|
|
|
### Configure Environment Variables
|
|
|
|
| Environment Variable | Type | Description |
|
|
| ------------------------------ | -------- | --------------------------------------------------------------- |
|
|
| `AUTH_SECRET` | Required | Session encryption key, generate with `openssl rand -base64 32` |
|
|
| `AUTH_SSO_PROVIDERS` | Required | Set to `microsoft` |
|
|
| `AUTH_MICROSOFT_ID` | Required | Application (client) ID |
|
|
| `AUTH_MICROSOFT_SECRET` | Required | Client secret value |
|
|
| `AUTH_MICROSOFT_AUTHORITY_URL` | Optional | Authority URL for Microsoft Entra ID |
|
|
| `AUTH_MICROSOFT_TENANT_ID` | Optional | Directory (tenant) ID for single-tenant apps |
|
|
|
|
<Callout type={'warning'}>
|
|
**Deprecated Environment Variables**: The following legacy variable names
|
|
are no longer supported. Setting any of them will cause the deployment to
|
|
fail at build/startup — use `AUTH_MICROSOFT_ID` / `AUTH_MICROSOFT_SECRET` /
|
|
`AUTH_MICROSOFT_TENANT_ID` instead:
|
|
|
|
- `AUTH_MICROSOFT_ENTRA_ID_ID` / `AUTH_MICROSOFT_ENTRA_ID_SECRET`
|
|
- `AUTH_AZURE_AD_ID` / `AUTH_AZURE_AD_SECRET`
|
|
- `AZURE_AD_CLIENT_ID` / `AZURE_AD_CLIENT_SECRET`
|
|
</Callout>
|
|
|
|
<Callout type={'tip'}>
|
|
Go to [📘 Environment Variables](/docs/self-hosting/environment-variables/auth#microsoft)
|
|
for detailed information.
|
|
</Callout>
|
|
</Steps>
|
|
|
|
<Callout type={'info'}>
|
|
After successful deployment, users will be able to authenticate with Microsoft
|
|
and use LobeHub.
|
|
</Callout>
|
|
|
|
## Common Issues
|
|
|
|
### Client Secret Expiration
|
|
|
|
Microsoft client secrets have a maximum validity of 24 months. Remember to rotate secrets before they expire.
|
|
|
|
## Related Resources
|
|
|
|
- [Microsoft Entra Admin Center](https://entra.microsoft.com/)
|
|
- [Quickstart: Register an application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)
|