feat: add msft well-known application identity endpoint for integrations

cli/go.mod

@@ -62,7 +62,7 @@ require (
 	github.com/knadh/koanf/maps v0.1.2 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
-	github.com/lestrrat-go/httprc/v3 v3.0.5 // indirect
+	github.com/lestrrat-go/httprc/v3 v3.0.6 // indirect
 	github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect
 	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
@@ -91,7 +91,7 @@ require (
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fastjson v1.6.10 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
-	github.com/vektah/gqlparser/v2 v2.5.33 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.34 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect

cli/go.sum

@@ -6,8 +6,6 @@ github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KO
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=
 github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
-github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
-github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
@@ -126,8 +124,7 @@ github.com/lestrrat-go/dsig-secp256k1 v1.0.0 h1:JpDe4Aybfl0soBvoVwjqDbp+9S1Y2OM7
 github.com/lestrrat-go/dsig-secp256k1 v1.0.0/go.mod h1:CxUgAhssb8FToqbL8NjSPoGQlnO4w3LG1P0qPWQm/NU=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
-github.com/lestrrat-go/httprc/v3 v3.0.5 h1:S+Mb4L2I+bM6JGTibLmxExhyTOqnXjqx+zi9MoXw/TM=
-github.com/lestrrat-go/httprc/v3 v3.0.5/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
+github.com/lestrrat-go/httprc/v3 v3.0.6 h1:4FpLQ18KK/ypPbVU3NLWJNRvH3kcYiqKqWfKGqNWxxI=
 github.com/lestrrat-go/jwx/v3 v3.1.1 h1:yd9AdPmZ4INnQ7k42IrzXYpnEG803+SrQ6hdMvzHJzw=
 github.com/lestrrat-go/jwx/v3 v3.1.1/go.mod h1:uw/MN2M/Xiu4FhwcIwH11Zsh9JWx9SWzgALl7/uIEkU=
 github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=
@@ -183,8 +180,6 @@ github.com/samber/lo v1.53.0 h1:t975lj2py4kJPQ6haz1QMgtId2gtmfktACxIXArw3HM=
 github.com/samber/lo v1.53.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
 github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
 github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
-github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
-github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/sosodev/duration v1.4.0 h1:35ed0KiVFriGHHzZZJaZLgmTEEICIyt8Sx0RQfj9IjE=
 github.com/sosodev/duration v1.4.0/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
@@ -225,8 +220,7 @@ github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADT
 github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE=
 github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
 github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
-github.com/vektah/gqlparser/v2 v2.5.33 h1:lRp8aIeNUNbimf/axZd7ETg24q06hBtPaas+TcvI/7E=
-github.com/vektah/gqlparser/v2 v2.5.33/go.mod h1:c1I28gSOVNzlfc4WuDlqU7voQnsqI6OG2amkBAFmgts=
+github.com/vektah/gqlparser/v2 v2.5.34 h1:MEea5P0qhdcqfBL45ghKE+qr9laidVHTMHjav5h7ckk=
 github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=

common/go.mod

@@ -68,14 +68,13 @@ require (
 	github.com/riverqueue/river/rivershared v0.38.0 // indirect
 	github.com/riverqueue/river/rivertype v0.38.0 // indirect
 	github.com/samber/lo v1.53.0 // indirect
-	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/sosodev/duration v1.4.0 // indirect
 	github.com/tidwall/gjson v1.19.0 // indirect
 	github.com/tidwall/match v1.2.0 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/tinylib/msgp v1.6.4 // indirect
-	github.com/vektah/gqlparser/v2 v2.5.33 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.34 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect

common/go.sum

@@ -13,8 +13,6 @@ github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7l
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
-github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
-github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
@@ -85,11 +83,8 @@ github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jarcoal/httpmock v1.4.1 h1:0Ju+VCFuARfFlhVXFc2HxlcQkfB+Xq12/EotHko+x2A=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
@@ -129,8 +124,6 @@ github.com/rs/zerolog v1.35.1 h1:m7xQeoiLIiV0BCEY4Hs+j2NG4Gp2o2KPKmhnnLiazKI=
 github.com/rs/zerolog v1.35.1/go.mod h1:EjML9kdfa/RMA7h/6z6pYmq1ykOuA8/mjWaEvGI+jcw=
 github.com/samber/lo v1.53.0 h1:t975lj2py4kJPQ6haz1QMgtId2gtmfktACxIXArw3HM=
 github.com/samber/lo v1.53.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
-github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
-github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/sosodev/duration v1.4.0 h1:35ed0KiVFriGHHzZZJaZLgmTEEICIyt8Sx0RQfj9IjE=
 github.com/sosodev/duration v1.4.0/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg=
 github.com/stoewer/go-strcase v1.3.1 h1:iS0MdW+kVTxgMoE1LAZyMiYJFKlOzLooE4MxjirtkAs=
@@ -141,7 +134,6 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
@@ -169,8 +161,7 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
 github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
-github.com/vektah/gqlparser/v2 v2.5.33 h1:lRp8aIeNUNbimf/axZd7ETg24q06hBtPaas+TcvI/7E=
-github.com/vektah/gqlparser/v2 v2.5.33/go.mod h1:c1I28gSOVNzlfc4WuDlqU7voQnsqI6OG2amkBAFmgts=
+github.com/vektah/gqlparser/v2 v2.5.34 h1:MEea5P0qhdcqfBL45ghKE+qr9laidVHTMHjav5h7ckk=
 github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
@@ -225,11 +216,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68 h1:
 google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

config/.env.example

@@ -290,13 +290,16 @@ CORE_INTEGRATIONS_AZUREENTRAID_CLIENTID=""
 CORE_INTEGRATIONS_AZUREENTRAID_CLIENTSECRET=""
 CORE_INTEGRATIONS_AZUREENTRAID_REDIRECTURL="https://api.theopenlane.io/v1/integrations/auth/callback"
 CORE_INTEGRATIONS_AZUREENTRAID_DEFAULTTENANT=""
+CORE_INTEGRATIONS_AZUREENTRAID_APPLICATIONID=""
 CORE_INTEGRATIONS_MICROSOFTTEAMS_CLIENTID=""
 CORE_INTEGRATIONS_MICROSOFTTEAMS_CLIENTSECRET=""
 CORE_INTEGRATIONS_MICROSOFTTEAMS_REDIRECTURL="https://api.theopenlane.io/v1/integrations/auth/callback"
+CORE_INTEGRATIONS_MICROSOFTTEAMS_APPLICATIONID=""
 CORE_INTEGRATIONS_ONEDRIVE_CLIENTID=""
 CORE_INTEGRATIONS_ONEDRIVE_CLIENTSECRET=""
 CORE_INTEGRATIONS_ONEDRIVE_REDIRECTURL="https://api.theopenlane.io/v1/integrations/auth/callback"
 CORE_INTEGRATIONS_ONEDRIVE_CONTENTMODE="iframe"
+CORE_INTEGRATIONS_ONEDRIVE_APPLICATIONID=""
 CORE_INTEGRATIONS_OIDCLOCAL_ENABLED="false"
 CORE_INTEGRATIONS_OIDCLOCAL_CLIENTID="local-core-oidc"
 CORE_INTEGRATIONS_OIDCLOCAL_CLIENTSECRET="local-core-oidc-secret"

config/config.example.yaml

@@ -146,6 +146,7 @@ integrations:
         arn: ""
         secretaccesskey: ""
     azureentraid:
+        applicationid: ""
         clientid: ""
         clientsecret: ""
         defaulttenant: ""
@@ -175,6 +176,7 @@ integrations:
         clientsecret: ""
         redirecturl: https://api.theopenlane.io/v1/integrations/auth/callback
     microsoftteams:
+        applicationid: ""
         clientid: ""
         clientsecret: ""
         redirecturl: https://api.theopenlane.io/v1/integrations/auth/callback
@@ -185,6 +187,7 @@ integrations:
         enabled: false
         redirecturl: http://localhost:17608/v1/integrations/auth/callback
     onedrive:
+        applicationid: ""
         clientid: ""
         clientsecret: ""
         contentmode: iframe

config/configmap-config-file.yaml

@@ -1024,6 +1024,9 @@ data:
         {{- if .Values.openlane.coreConfiguration.integrations.azureentraid.defaulttenant }}
         defaulttenant: {{ .Values.openlane.coreConfiguration.integrations.azureentraid.defaulttenant | quote }}
         {{- end }}
+        {{- if .Values.openlane.coreConfiguration.integrations.azureentraid.applicationid }}
+        applicationid: {{ .Values.openlane.coreConfiguration.integrations.azureentraid.applicationid | quote }}
+        {{- end }}
       {{- end }}
       {{- if .Values.openlane.coreConfiguration.integrations.microsoftteams }}
       microsoftteams:
@@ -1033,6 +1036,9 @@ data:
         {{- if .Values.openlane.coreConfiguration.integrations.microsoftteams.redirecturl }}
         redirecturl: {{ .Values.openlane.coreConfiguration.integrations.microsoftteams.redirecturl | quote }}
         {{- end }}
+        {{- if .Values.openlane.coreConfiguration.integrations.microsoftteams.applicationid }}
+        applicationid: {{ .Values.openlane.coreConfiguration.integrations.microsoftteams.applicationid | quote }}
+        {{- end }}
       {{- end }}
       {{- if .Values.openlane.coreConfiguration.integrations.onedrive }}
       onedrive:
@@ -1045,6 +1051,9 @@ data:
         {{- if .Values.openlane.coreConfiguration.integrations.onedrive.contentmode }}
         contentmode: {{ .Values.openlane.coreConfiguration.integrations.onedrive.contentmode | quote }}
         {{- end }}
+        {{- if .Values.openlane.coreConfiguration.integrations.onedrive.applicationid }}
+        applicationid: {{ .Values.openlane.coreConfiguration.integrations.onedrive.applicationid | quote }}
+        {{- end }}
       {{- end }}
       {{- if .Values.openlane.coreConfiguration.integrations.oidclocal }}
       oidclocal:

config/helm-values.yaml

@@ -538,13 +538,16 @@ coreConfiguration:
       clientid: ""  # @schema type:string
       redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
       defaulttenant: ""  # @schema type:string
+      applicationid: ""  # @schema type:string
     microsoftteams:
       clientid: ""  # @schema type:string
       redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
+      applicationid: ""  # @schema type:string
     onedrive:
       clientid: ""  # @schema type:string
       redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
       contentmode: "iframe"  # @schema type:string; default:iframe
+      applicationid: ""  # @schema type:string
     oidclocal:
       enabled: false  # @schema type:boolean; default:false
       clientid: "local-core-oidc"  # @schema type:string; default:local-core-oidc

internal/httpserve/handlers/msftidentity.go

@@ -0,0 +1,69 @@
+package handlers
+
+import (
+	"github.com/google/uuid"
+	"github.com/samber/lo"
+	echo "github.com/theopenlane/echox"
+)
+
+// msftAssociatedApplications contains the associated azure applications with the domain
+type msftAssociatedApplications struct {
+	AssociatedApplications []application `json:"associatedApplications"`
+}
+
+// application contains the application id of a registered application
+type application struct {
+	// ApplicationID is the application of the registered application in Azure
+	ApplicationID string `json:"applicationId"`
+}
+
+// MSFTIdentityWellKnownHandler returns the application ids for associated applications in
+// order to populate the msft identity well-known handler
+//
+//	{
+//	  "associatedApplications": [
+//	    {
+//	      "applicationId": "<uuid>"
+//	    }
+//	  ]
+//	}
+func (h *Handler) MSFTIdentityWellKnownHandler(ctx echo.Context) error {
+	entraAppID := h.IntegrationsConfig.AzureEntraID.ApplicationID
+	oneDriveAppID := h.IntegrationsConfig.OneDrive.ApplicationID
+	teamsAppID := h.IntegrationsConfig.MicrosoftTeams.ApplicationID
+
+	applications := []application{}
+
+	if entraAppID != "" {
+		if _, err := uuid.Parse(entraAppID); err == nil {
+			applications = append(applications, application{
+				ApplicationID: entraAppID,
+			})
+		}
+
+	}
+
+	if oneDriveAppID != "" {
+		if _, err := uuid.Parse(oneDriveAppID); err == nil {
+			applications = append(applications, application{
+				ApplicationID: oneDriveAppID,
+			})
+		}
+
+	}
+
+	if teamsAppID != "" {
+		if _, err := uuid.Parse(teamsAppID); err == nil {
+			applications = append(applications, application{
+				ApplicationID: teamsAppID,
+			})
+		}
+	}
+
+	// ensure we do not have duplicate application ids
+	applications = lo.Uniq(applications)
+
+	return h.Success(ctx, msftAssociatedApplications{
+		AssociatedApplications: applications,
+	})
+}

internal/httpserve/route/msft_application.go

@@ -0,0 +1,26 @@
+package route
+
+import (
+	"net/http"
+
+	"github.com/theopenlane/core/internal/httpserve/handlers"
+)
+
+// registerMSFTIdentityWellKnownHandler serves up the msft identity well-known endpoint
+// in order to register an application with your domain in Azure, you must host a well-known file at
+// https://<domain>/.well-known/microsoft-identity-association.json
+func registerMSFTIdentityWellKnownHandler(router *Router) (err error) {
+	config := Config{
+		Path:          "/.well-known/microsoft-identity-association.json",
+		Method:        http.MethodGet,
+		Name:          "MSFTIdentityWellKnown",
+		Description:   "Microsoft Identity Association well-known configuration file",
+		Tags:          []string{"well-known", "msft", "azure"},
+		OperationID:   "MSFTIdentityWellKnown",
+		Security:      handlers.PublicSecurity,
+		Middlewares:   *publicEndpoint,
+		SimpleHandler: router.Handler.MSFTIdentityWellKnownHandler,
+	}
+
+	return router.AddUnversionedHandlerRoute(config)
+}

internal/httpserve/route/router.go

@@ -80,7 +80,7 @@ func (r *Router) handleSpecialResponses(operationID string, openAPIContext *hand
 	// Non-JSON responses only - these don't use h.Success() so need explicit registration
 	case "AcmeSolver":
 		r.addPlainTextResponse(openAPIContext, "ACME challenge response")
-	case "AppleMerchant", "SecurityTxt", "WebAuthnWellKnown", "Robots", "Favicon":
+	case "AppleMerchant", "SecurityTxt", "WebAuthnWellKnown", "Robots", "Favicon", "MSFTIdentityWellKnown":
 		r.addFileResponse(openAPIContext, "Static file content")
 	case "JWKS":
 		r.addJSONResponse(openAPIContext, "JSON Web Key Set", "application/json")
@@ -665,6 +665,7 @@ func RegisterRoutes(router *Router) error {
 		registerScopesHandler,
 		registerOrganizationRolesHandler,
 		registerRolesHandler,
+		registerMSFTIdentityWellKnownHandler,
 
 		// JOB Runners
 		// TODO(adelowo): at some point in the future, maybe we should extract these into

internal/integrations/definitions/azureentraid/config.go

@@ -11,4 +11,6 @@ type Config struct {
 	// DefaultTenant pins the admin consent flow to a specific tenant ID or domain (e.g. for local dev/testing)
 	// when empty the generic /organizations endpoint is used
 	DefaultTenant string `json:"defaulttenant" koanf:"defaulttenant"`
+	// ApplicationID is the application ID registered in azure, used in the well-known configuration for domain validation
+	ApplicationID string `json:"applicationid" koanf:"applicationid"`
 }

internal/integrations/definitions/microsoftteams/config.go

@@ -8,4 +8,6 @@ type Config struct {
 	ClientSecret string `json:"clientsecret" koanf:"clientsecret" sensitive:"true"`
 	// RedirectURL is the OAuth callback URL registered with the Azure application
 	RedirectURL string `json:"redirecturl" koanf:"redirecturl" default:"https://api.theopenlane.io/v1/integrations/auth/callback"`
+	// ApplicationID is the application ID registered in azure, used in the well-known configuration for domain validation
+	ApplicationID string `json:"applicationid" koanf:"applicationid"`
 }