OAuth 2.0 - Tutorial 2 - Azure Server Side Python WebApp Auth Code Flow - Entra ID

flask==3.1.2
msal==1.34.0
python-dotenv==1.1.1

FROM python:3.11
WORKDIR /code

COPY requirements.txt .
RUN pip3 install -r requirements.txt 

# copy your actual python code
COPY main.py .

# Add some debugging
RUN echo "Files in /code:" && ls -la /code

# Expose the port that the app will run on
EXPOSE 5001

CMD ["flask", "--app", "main.py", "run", "--host", "0.0.0.0", "--port", "5001"]

import logging

logging.basicConfig(level=logging.DEBUG)

from flask import Flask, session, redirect, request, url_for
from dotenv import load_dotenv
import msal
import uuid
import os
import requests

app = Flask(__name__)
app.secret_key = os.urandom(24)  # Needed for session

# Specify the path to the .env file
dotenv_path = ".env"  # Update this with the actual path

# Load the .env file -> is not used in "prod" web app only on local development
load_dotenv(dotenv_path=dotenv_path)

# Config
config = {
    "client_id": os.getenv("CLIENT_ID"),
    "authority": f"https://login.microsoftonline.com/{os.getenv('TENANT_ID')}",
    "scope": ["User.Read"],
    "redirect_uri": os.getenv("REDIRECT_URI"),
    "client_secret": os.getenv("CLIENT_SECRET"),
}


def build_msal_app():
    return msal.ConfidentialClientApplication(
        client_id=config["client_id"],
        authority=config["authority"],
        client_credential=config["client_secret"],
    )


@app.route("/")
def index():
    if "user" in session:
        user = session["user"]
        return f"""
        <h2>Welcome {user['displayName']}</h2>
        <p>Email: {user.get('mail') or user.get('userPrincipalName')}</p>
        <a href="/logout">Logout</a>
        """
    return '<a href="/login">Login with Microsoft</a>'


@app.route("/login")
def login():
    msal_app = build_msal_app()
    flow = msal_app.initiate_auth_code_flow(
        scopes=config["scope"],
        redirect_uri=config["redirect_uri"],
        state=str(uuid.uuid4()),
    )
    session["auth_flow"] = flow
    return redirect(flow["auth_uri"])


@app.route("/callback")
def callback():
    msal_app = build_msal_app()
    try:
        result = msal_app.acquire_token_by_auth_code_flow(
            session.get("auth_flow", {}), request.args
        )
    except ValueError:
        return "Authentication failed", 400

    if "access_token" in result:
        session["access_token"] = result["access_token"]

        # Call Microsoft Graph to get user info
        graph_resp = requests.get(
            "https://graph.microsoft.com/v1.0/me",
            headers={"Authorization": f"Bearer {result['access_token']}"},
        )
        if graph_resp.ok:
            session["user"] = graph_resp.json()
            return redirect(url_for("index"))
        else:
            return f"Graph API error: {graph_resp.text}", 500

    return f"Error: {result.get('error_description')}", 400


@app.route("/logout")
def logout():
    session.clear()
    return redirect(url_for("index"))


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5001, debug=True)

IMG_NAME=flask-app
cd flask_app && \
docker buildx build --platform linux/amd64 -t ${IMG_NAME} .

ACR_NAME=nasatestreg
az login # First Login with the Azure CLI
az acr login --name $(ACR_NAME) # Login to you specific Azure Container Registry

docker tag ${IMG_NAME} $(ACR_NAME).azurecr.io/${IMG_NAME}:v5
docker push $(ACR_NAME).azurecr.io/${IMG_NAME}:v5