Ajouter le SSO Google et Microsoft à une application — Guide OIDC complet

GET https://<endpoint_authorize_de_l_IdP>
  ?client_id=VOTRE_CLIENT_ID
  &response_type=code
  &redirect_uri=https://votre-app.example.com/auth/callback
  &scope=openid email profile
  &state=ALEA_ANTI_CSRF
  &nonce=ALEA_ANTI_REJEU
  &code_challenge=BASE64URL_SHA256_DU_VERIFIER
  &code_challenge_method=S256

Discovery : https://accounts.google.com/.well-known/openid-configuration
Authorize : https://accounts.google.com/o/oauth2/v2/auth
Token     : https://oauth2.googleapis.com/token
JWKS      : https://www.googleapis.com/oauth2/v3/certs
UserInfo  : https://openidconnect.googleapis.com/v1/userinfo
Issuer    : https://accounts.google.com

Discovery : https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
Authorize : https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
Token     : https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
JWKS      : https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys
UserInfo  : https://graph.microsoft.com/oidc/userinfo

// SSO OIDC avec Google et Microsoft — Node.js (Express + openid-client v5)
// npm i express express-session openid-client
import express from 'express';
import session from 'express-session';
import { Issuer, generators } from 'openid-client';

const app = express();
app.use(session({
  secret: process.env.SESSION_SECRET, resave: false, saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, sameSite: 'lax' }, // cookie de session sécurisé
}));

const REDIRECT = 'https://votre-app.example.com/auth/callback';

// 1) Découverte automatique des endpoints + création du client
async function makeClient(issuerUrl, clientId, clientSecret, redirectUri) {
  const issuer = await Issuer.discover(issuerUrl);
  return new issuer.Client({
    client_id: clientId,
    client_secret: clientSecret, // côté serveur UNIQUEMENT (client confidentiel)
    redirect_uris: [redirectUri],
    response_types: ['code'],
  });
}

const clients = {};
(async () => {
  // Google
  clients.google = await makeClient('https://accounts.google.com',
    process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, REDIRECT + '/google');
  // Microsoft (tenant = ID de tenant, 'organizations' ou 'common')
  clients.microsoft = await makeClient('https://login.microsoftonline.com/<tenant>/v2.0',
    process.env.MS_CLIENT_ID, process.env.MS_CLIENT_SECRET, REDIRECT + '/microsoft');
})();

// 2) Démarrage du login : PKCE + state + nonce, stockés en session, puis redirection
app.get('/login/:idp', (req, res) => {
  const client = clients[req.params.idp];
  const code_verifier = generators.codeVerifier();
  const code_challenge = generators.codeChallenge(code_verifier);
  const state = generators.state();
  const nonce = generators.nonce();
  req.session.oidc = { idp: req.params.idp, code_verifier, state, nonce };
  res.redirect(client.authorizationUrl({
    scope: 'openid email profile',
    code_challenge, code_challenge_method: 'S256', state, nonce,
  }));
});

// 3) Callback : openid-client vérifie state et VALIDE l'ID token (signature/iss/aud/exp/nonce)
app.get('/auth/callback/:idp', async (req, res) => {
  const client = clients[req.params.idp];
  const { code_verifier, state, nonce } = req.session.oidc || {};
  const params = client.callbackParams(req);
  const tokenSet = await client.callback(
    client.metadata.redirect_uris[0], params,
    { code_verifier, state, nonce }, // tout est vérifié pour vous
  );
  const claims = tokenSet.claims(); // contenu VALIDÉ de l'ID token

  // 4) Liaison de compte par e-mail VÉRIFIÉ uniquement
  if (!claims.email || claims.email_verified === false) {
    return res.status(403).send('E-mail non vérifié par le fournisseur.');
  }
  const user = await findOrCreateUser({
    provider: req.params.idp, subject: claims.sub, email: claims.email, name: claims.name,
  });

  // 5) Session applicative (aucun token stocké côté navigateur)
  req.session.userId = user.id;
  delete req.session.oidc;
  res.redirect('/');
});

app.get('/logout', (req, res) => req.session.destroy(() => res.redirect('/')));

# SSO OIDC avec Google et Microsoft — Python (Flask + Authlib)
# pip install Flask Authlib
import os
from flask import Flask, session, redirect, url_for, abort
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = os.environ["SECRET_KEY"]
app.config.update(SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SECURE=True,
                  SESSION_COOKIE_SAMESITE="Lax")

oauth = OAuth(app)

# 1) Déclaration des fournisseurs via leur discovery document
oauth.register(
    name="google",
    server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
    client_id=os.environ["GOOGLE_CLIENT_ID"],
    client_secret=os.environ["GOOGLE_CLIENT_SECRET"],
    client_kwargs={"scope": "openid email profile"},
)
oauth.register(
    name="microsoft",
    server_metadata_url="https://login.microsoftonline.com/<tenant>/v2.0/.well-known/openid-configuration",
    client_id=os.environ["MS_CLIENT_ID"],
    client_secret=os.environ["MS_CLIENT_SECRET"],
    client_kwargs={"scope": "openid email profile"},
)

# 2) Démarrage du login : Authlib génère state + nonce + PKCE et redirige
@app.route("/login/<idp>")
def login(idp):
    client = oauth.create_client(idp) or abort(404)
    redirect_uri = url_for("callback", idp=idp, _external=True)
    return client.authorize_redirect(redirect_uri)

# 3) Callback : échange du code + validation de l'ID token par Authlib
@app.route("/auth/callback/<idp>")
def callback(idp):
    client = oauth.create_client(idp) or abort(404)
    token = client.authorize_access_token()  # vérifie le state, échange le code
    claims = token["userinfo"]  # ID token déjà validé

    # 4) Liaison par e-mail vérifié uniquement
    if not claims.get("email") or claims.get("email_verified") is False:
        abort(403, "E-mail non vérifié par le fournisseur.")
    user = find_or_create_user(provider=idp, subject=claims["sub"],
                               email=claims["email"], name=claims.get("name"))

    # 5) Session applicative (pas de tokens stockés côté navigateur)
    session["user_id"] = user.id
    return redirect("/")

@app.route("/logout")
def logout():
    session.clear()
    return redirect("/")

Issuer    : https://accounts.google.com
Discovery : https://accounts.google.com/.well-known/openid-configuration

Discovery : https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
({tenant} = common | organizations | consumers | <tenant-id>)