@@ -12,6 +12,7 @@ import (
1212 "golang.org/x/exp/slices"
1313
1414 "github.com/bitly/go-simplejson"
15+
1516 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
1617 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
1718 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
@@ -33,7 +34,6 @@ const (
3334 azureProviderName = "Azure"
3435 azureDefaultScope = "openid"
3536 azureDefaultGraphGroupField = "id"
36− azureV2Scope = "https://graph.microsoft.com/.default"
3737)
3838
3939var (
@@ -90,15 +90,16 @@ func NewAzureProvider(p *ProviderData, opts options.AzureOptions) *AzureProvider
9090 isV2Endpoint := false
9191 if strings.Contains(p.LoginURL.String(), "v2.0") {
9292 isV2Endpoint = true
93+ azureV2GraphScope := fmt.Sprintf("https://%s/.default", p.ProfileURL.Host)
9394
9495 if strings.Contains(p.Scope, " groups") {
9596 logger.Print("WARNING: `groups` scope is not an accepted scope when using Azure OAuth V2 endpoint. Removing it from the scope list")
9697 p.Scope = strings.ReplaceAll(p.Scope, " groups", "")
9798 }
9899
99− if !strings.Contains(p.Scope, " "+azureV2Scope) {
100+ if !strings.Contains(p.Scope, " "+azureV2GraphScope) {
100101 // In order to be able to query MS Graph we must pass the ms graph default endpoint
101− p.Scope += " " + azureV2Scope
102+ p.Scope += " " + azureV2GraphScope
102103 }
103104
104105 if p.ProtectedResource != nil && p.ProtectedResource.String() != "" {
@@ -118,12 +119,12 @@ func overrideTenantURL(current, defaultURL *url.URL, tenant, path string) {
118119 if current == nil || current.String() == "" || current.String() == defaultURL.String() {
119120 *current = url.URL{
120121 Scheme: "https",
121− Host: "login.microsoftonline.com",
122+ Host: current.Host,
122123 Path: "/" + tenant + "/oauth2/" + path}
123124 }
124125}
125126
126−func getMicrosoftGraphGroupsURL(graphGroupField string) *url.URL {
127+func getMicrosoftGraphGroupsURL(profileURL *url.URL, graphGroupField string) *url.URL {
127128
128129 selectStatement := "$select=displayName,id"
129130 if !slices.Contains([]string{"displayName", "id"}, graphGroupField) {
@@ -133,7 +134,7 @@ func getMicrosoftGraphGroupsURL(graphGroupField string) *url.URL {
133134 // Select only security groups. Due to the filter option, count param is mandatory even if unused otherwise
134135 return &url.URL{
135136 Scheme: "https",
136− Host: "graph.microsoft.com",
137+ Host: profileURL.Host,
137138 Path: "/v1.0/me/transitiveMemberOf",
138139 RawQuery: "$count=true&$filter=securityEnabled+eq+true&" + selectStatement,
139140 }
@@ -368,7 +369,7 @@ func (p *AzureProvider) getGroupsFromProfileAPI(ctx context.Context, s *sessions
368369 return nil, fmt.Errorf("missing access token")
369370 }
370371
371− groupsURL := getMicrosoftGraphGroupsURL(p.GraphGroupField).String()
372+ groupsURL := getMicrosoftGraphGroupsURL(p.ProfileURL, p.GraphGroupField).String()
372373
373374 // Need and extra header while talking with MS Graph. For more context see
374375 // https://docs.microsoft.com/en-us/graph/api/group-list-transitivememberof?view=graph-rest-1.0&tabs=http#request-headers