strapi-plugin-salt-sso

Azure AD Single Sign-On plugin for Strapi 5

Features

• ✅ Azure AD OAuth 2.0 authentication
• ✅ Customizable redirect URLs
• ✅ Multi-locale support
• ✅ Built for Strapi 5.x
• ✅ Configurable UI for enable disable azure
• ✅ Security feature only login with azure when already register on strapi

Installation

yarn add strapi-plugin-salt-sso
# or
npm install strapi-plugin-salt-sso

Configuration

Add the following to your .env file:

# Azure AD Configuration
AZUREAD_TENANT_ID=your-tenant-id
AZUREAD_OAUTH_CLIENT_ID=your-client-id
AZUREAD_OAUTH_CLIENT_SECRET=your-client-secret
AZUREAD_OAUTH_REDIRECT_URI=http://localhost:1337/admin/auth/azure/callback

# Optional: Azure AD scope (default: User.Read)
AZUREAD_SCOPE=User.Read

Plugin config (config/plugins.ts)

You can also configure the plugin directly in config/plugins.ts for options not available via environment variables:

export default ({ env }) => ({
  'strapi-plugin-sso': {
    enabled: true,
    config: {
      tenantId: env('AZUREAD_TENANT_ID'),
      clientId: env('AZUREAD_OAUTH_CLIENT_ID'),
      clientSecret: env('AZUREAD_OAUTH_CLIENT_SECRET'),
      redirectUri: env('AZUREAD_OAUTH_REDIRECT_URI'),
      scope: env('AZUREAD_SCOPE', 'User.Read'),
      // Optional: custom logo shown on SSO error pages
      errorPageLogoUrl: '/uploads/my-company-logo.png',
    },
  },
});

| Option | Type | Default | Description | |--------|------|---------|-------------| | tenantId | string | '' | Azure AD tenant ID | | clientId | string | '' | Azure AD application (client) ID | | clientSecret | string | '' | Azure AD client secret | | redirectUri | string | http://localhost:1337/strapi-plugin-sso/azuread/callback | OAuth callback URL | | postLogoutRedirectUri | string | http://localhost:1337/admin/auth/login | Redirect URL after logout | | scope | string | 'User.Read' | OAuth scope | | errorPageLogoUrl | string \| null | null | URL of the logo shown on SSO error pages. Falls back to emoji if not set. Accepts relative paths (e.g. /uploads/logo.png) or absolute URLs. |

Get Azure AD Credentials

1. Go to Azure Portal
2. Navigate to Azure Active Directory → App registrations
3. Click New registration
4. Enter application name and select account type
5. Configure redirect URI: http://localhost:1337/admin/auth/azure/callback
6. Copy Application (client) ID
7. Go to Certificates & secrets → New client secret
8. Copy the secret value
9. Copy Directory (tenant) ID

Usage

1. After installation, the plugin will add a SSO button on the login page
2. Click the button to authenticate with Azure AD
3. On first login, a user will be created automatically
4. The user will be assigned to the authenticated role

Advanced Configuration

Custom Role Assignment

Create a custom service to assign roles based on Azure AD groups:

// src/extensions/users-permissions/strapi-server.ts
export default ({ strapi }) => {
  // Custom role assignment logic
};

Custom User Mapping

Modify the user creation logic in the plugin's service:

// server/src/services/azure.ts
const createUserFromAzure = async (profile) => {
  // Custom user creation logic
};

Development

# Install dependencies
yarn install

# Watch for changes
yarn watch

# Link to local Strapi project
yarn watch:link

# Build for production
yarn build

# Verify plugin
yarn verify

License

MIT

Support

For issues and questions, please open an issue on GitHub.