Office 365单一登录集成

Question

We have integrated login with Office 365 into our system and encountered an issue. When users try to sign up from a school domain, we are able to create one account only. All accounts from one domain have the same account ID and we are unable to differ them. For example we receive the same account ID for alice@sample.com and bob@sample.com email addresses. A big problem we currently have is, after alice@sample.com signs up and the account is created, when bob@sample.com tries to sign up, he is logged into Alice's account. The mechanism we are using for Microsoft SSO is absolutely the same as we do with Google, Edmodo or other SSO providers. How can we address this?

We are using oAuth2. For all email addresses of the same domain, we receive the same officeID.

$jsonResponse = oAuthService::getTokenFromAuthCode($auth_code, $redirectUri); $jsonAccessTokenPayload = json_decode($decodedAccessTokenPayload, true); $officeId = $jsonAccessTokenPayload['tid'];

Answer 1

tid is the tenant ID. It is intended to be identical for different users in the same Azure AD tenant.

You probably want to use the oid value (Object ID). That is unique and immutable for each user in the tenant.

You could combine the two to get a tenant identifier along with the user's object ID.

All the JWT token and claim values are explained on this page .