FastAPI-Azure-Auth

https://intility.github.io/fastapi-azure-auth
Admin
FastAPI-Azure-Auth implements Azure Entra ID and Azure Entra ID B2C authentication and authorization...
Tokens:16,517
Snippets:131
Trust Score:8.3
Update:4 months ago
Show doc for...
Tokens:
Raw
### Basic FastAPI App Setup

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/fastapi_configuration

A minimal FastAPI application with a root endpoint. This serves as the starting point for the application. Ensure FastAPI and Uvicorn are installed.

```python
from fastapi import FastAPI
import uvicorn

app = FastAPI()


@app.get("/")
async def root():
    return {"message": "Hello World"}

if __name__ == '__main__':
    uvicorn.run('main:app', host='localhost', port=8000, reload=True)
```

--------------------------------

### Basic FastAPI App Setup

Source: https://intility.github.io/fastapi-azure-auth/single-tenant/fastapi_configuration

A minimal FastAPI application with a root endpoint and Uvicorn runner. Ensure dependencies like FastAPI and Gunicorn are installed.

```python
from fastapi import FastAPI
import uvicorn

app = FastAPI()


@app.get("/")
async def root():
    return {"message": "Hello World"}

if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### Install with pip

Source: https://intility.github.io/fastapi-azure-auth/installation

Use pip to install the package from PyPI. Ensure you have Python 3.8 or higher.

```bash
pip install fastapi-azure-auth
```

--------------------------------

### Load OpenID Configuration on Startup

Source: https://intility.github.io/fastapi-azure-auth/single-tenant/fastapi_configuration

Use the `lifespan` context manager with `on_event('startup')` to load the OpenID configuration when the application starts. This can improve initial response times.

```python
import uvicorn
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from fastapi_azure_auth import SingleTenantAzureAuthorizationCodeBearer
from pydantic import AnyHttpUrl, computed_field
from pydantic_settings import BaseSettings
from contextlib import asynccontextmanager
from typing import AsyncGenerator


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""
    TENANT_ID: str = ""
    SCOPE_DESCRIPTION: str = "user_impersonation"

    @computed_field
    @property
    def SCOPE_NAME(self) -> str:
        return f'api://{self.APP_CLIENT_ID}/{self.SCOPE_DESCRIPTION}'

    @computed_field
    @property
    def SCOPES(self) -> dict:
        return {
            self.SCOPE_NAME: self.SCOPE_DESCRIPTION,
        }

    class Config:
        env_file = '.env'
        env_file_encoding = 'utf-8'
        case_sensitive = True

settings = Settings()

@asynccontextmanager
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
    """
    Load OpenID config on startup.
    """
    await azure_scheme.openid_config.load_config()
    yield

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
        'scopes': settings.SCOPE_NAME,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )


azure_scheme = SingleTenantAzureAuthorizationCodeBearer(
    app_client_id=settings.APP_CLIENT_ID,
    tenant_id=settings.TENANT_ID,
    scopes=settings.SCOPES,
)

@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### Install with Poetry

Source: https://intility.github.io/fastapi-azure-auth/installation

Use Poetry to add the package to your project. Ensure you have Python 3.8 or higher.

```bash
poetry add fastapi-azure-auth
```

--------------------------------

### FastAPI App Setup with Azure Auth

Source: https://intility.github.io/fastapi-azure-auth/b2c/fastapi_configuration

This snippet demonstrates the complete setup of a FastAPI application with Azure AD B2C authentication. It includes Pydantic settings, CORS middleware, and the initialization of the B2CMultiTenantAuthorizationCodeBearer. Load OpenID configuration on startup for improved performance.

```python
import uvicorn
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from pydantic import AnyHttpUrl, computed_field
from pydantic_settings import BaseSettings, SettingsConfigDict
from fastapi_azure_auth import B2CMultiTenantAuthorizationCodeBearer
from contextlib import asynccontextmanager
from typing import AsyncGenerator


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    TENANT_NAME: str = ""
    APP_CLIENT_ID: str = ""
    OPENAPI_CLIENT_ID: str = ""
    AUTH_POLICY_NAME: str = ""
    SCOPE_DESCRIPTION: str = "user_impersonation"

    @computed_field
    @property
    def SCOPE_NAME(self) -> str:
        return f'https://{self.TENANT_NAME}.onmicrosoft.com/{self.APP_CLIENT_ID}/{self.SCOPE_DESCRIPTION}'

    @computed_field
    @property
    def SCOPES(self) -> dict:
        return {
            self.SCOPE_NAME: self.SCOPE_DESCRIPTION
        }

    @computed_field
    @property
    def OPENID_CONFIG_URL(self) -> str:
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/v2.0/.well-known/openid-configuration'

    @computed_field
    @property
    def OPENAPI_AUTHORIZATION_URL(self) -> str:
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/oauth2/v2.0/authorize'

    @computed_field
    @property
    def OPENAPI_TOKEN_URL(self) -> str:
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/oauth2/v2.0/token'

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

@asynccontextmanager
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
    """
    Load OpenID config on startup.
    """
    await azure_scheme.openid_config.load_config()
    yield

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
        'scopes': settings.SCOPE_NAME,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )

azure_scheme = B2CMultiTenantAuthorizationCodeBearer(
    app_client_id=settings.APP_CLIENT_ID,
    openid_config_url=settings.OPENID_CONFIG_URL,
    openapi_authorization_url=settings.OPENAPI_AUTHORIZATION_URL,
    openapi_token_url=settings.OPENAPI_TOKEN_URL,
    scopes=settings.SCOPES,
    validate_iss=False,
)


@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### FastAPI Application Setup with Azure B2C Auth

Source: https://intility.github.io/fastapi-azure-auth/b2c/fastapi_configuration

This snippet shows the complete setup for a FastAPI application using B2CMultiTenantAuthorizationCodeBearer for authentication. It includes environment settings, CORS middleware, and the main application instance.

```python
import uvicorn  
from fastapi import FastAPI, Security  
from fastapi.middleware.cors import CORSMiddleware  
from pydantic import AnyHttpUrl, computed_field  
from pydantic_settings import BaseSettings, SettingsConfigDict  
from fastapi_azure_auth import B2CMultiTenantAuthorizationCodeBearer  
from contextlib import asynccontextmanager  
from typing import AsyncGenerator  
  
  
class Settings(BaseSettings):  
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']  
    TENANT_NAME: str = ""  
    APP_CLIENT_ID: str = ""  
    OPENAPI_CLIENT_ID: str = ""  
    AUTH_POLICY_NAME: str = ""  
    SCOPE_DESCRIPTION: str = "user_impersonation"  
  
    @computed_field  
    @property  
    def SCOPE_NAME(self) -> str:  
        return f'https://{self.TENANT_NAME}.onmicrosoft.com/{self.APP_CLIENT_ID}/{self.SCOPE_DESCRIPTION}'  
  
    @computed_field  
    @property  
    def SCOPES(self) -> dict:  
        return {  
            self.SCOPE_NAME: self.SCOPE_DESCRIPTION  
        }  
  
    @computed_field  
    @property  
    def OPENID_CONFIG_URL(self) -> str:  
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/v2.0/.well-known/openid-configuration'  
  
    @computed_field  
    @property  
    def OPENAPI_AUTHORIZATION_URL(self) -> str:  
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/oauth2/v2.0/authorize'  
  
    @computed_field  
    @property  
    def OPENAPI_TOKEN_URL(self) -> str:  
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/oauth2/v2.0/token'  
  
    model_config = SettingsConfigDict(  
        env_file='.env',  
        env_file_encoding='utf-8',  
        case_sensitive=True  
    )  
  
settings = Settings()  
  
@asynccontextmanager  
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:  
    """  
    Load OpenID config on startup.  
    """  
    await azure_scheme.openid_config.load_config()  
    yield  
  
app = FastAPI(  
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',  
    swagger_ui_init_oauth={  
        'usePkceWithAuthorizationCodeGrant': True,  
        'clientId': settings.OPENAPI_CLIENT_ID,  
        'scopes': settings.SCOPE_NAME,  
    },  
)  
  
if settings.BACKEND_CORS_ORIGINS:  
    app.add_middleware(  
        CORSMiddleware,  
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],  
        allow_credentials=True,  
        allow_methods=['*'],  
        allow_headers=['*'],  
    )  
  
azure_scheme = B2CMultiTenantAuthorizationCodeBearer(  
    app_client_id=settings.APP_CLIENT_ID,  
    openid_config_url=settings.OPENID_CONFIG_URL,  
    openapi_authorization_url=settings.OPENAPI_AUTHORIZATION_URL,  
    openapi_token_url=settings.OPENAPI_TOKEN_URL,  
    scopes=settings.SCOPES,  
    validate_iss=False,  
)  
  
@app.get("/", dependencies=[Security(azure_scheme)])  
async def root():  
    return {"message": "Hello World"}  
  
  
if __name__ == '__main__':  
    uvicorn.run('main:app', reload=True)  
```

--------------------------------

### Environment Variables Setup

Source: https://intility.github.io/fastapi-azure-auth/b2c/fastapi_configuration

Defines environment variables for application settings using Pydantic's BaseSettings. It reads configurations from a .env file.

```python
from fastapi import FastAPI
import uvicorn
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    TENANT_NAME: str = ""
    APP_CLIENT_ID: str = ""
    OPENAPI_CLIENT_ID: str = ""
    AUTH_POLICY_NAME: str = ""
    SCOPE_DESCRIPTION: str = "user_impersonation"

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

app = FastAPI()

@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### Load OpenID Configuration on Startup

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/fastapi_configuration

Load the OpenID configuration immediately when the application starts instead of on the first user authentication. This improves initial response times. The configuration will be refreshed automatically if it's older than 24 hours.

```python
import uvicorn
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings, SettingsConfigDict
from fastapi_azure_auth import MultiTenantAzureAuthorizationCodeBearer
from contextlib import asynccontextmanager
from typing import AsyncGenerator


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

@asynccontextmanager
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
    """
    Load OpenID config on startup.
    """
    await azure_scheme.openid_config.load_config()
    yield

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )


azure_scheme = MultiTenantAzureAuthorizationCodeBearer(
    app_client_id=settings.APP_CLIENT_ID,
    scopes={
        f'api://{settings.APP_CLIENT_ID}/user_impersonation': 'user_impersonation',
    },
    validate_iss=False
)

@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', host='localhost', port=8000, reload=True)

```

--------------------------------

### FastAPI Application Setup with Azure Auth

Source: https://intility.github.io/fastapi-azure-auth/single-tenant/fastapi_configuration

Sets up a FastAPI application with CORS middleware and integrates SingleTenantAzureAuthorizationCodeBearer for authentication. Includes configuration for OpenAPI UI and lifespan management for OpenID configuration loading.

```python
import uvicorn
from fastapi import FastAPI, Security
from fastapi.middleware.cors import CORSMiddleware
from fastapi_azure_auth import SingleTenantAzureAuthorizationCodeBearer
from pydantic import AnyHttpUrl, computed_field
from pydantic_settings import BaseSettings
from contextlib import asynccontextmanager
from typing import AsyncGenerator


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""
    TENANT_ID: str = ""
    SCOPE_DESCRIPTION: str = "user_impersonation"

    @computed_field
    @property
    def SCOPE_NAME(self) -> str:
        return f'api://{self.APP_CLIENT_ID}/{self.SCOPE_DESCRIPTION}'

    @computed_field
    @property
    def SCOPES(self) -> dict:
        return {
            self.SCOPE_NAME: self.SCOPE_DESCRIPTION,
        }

    @computed_field
    @property
    def OPENAPI_AUTHORIZATION_URL(self) -> str:
        return f"https://login.microsoftonline.com/{self.TENANT_ID}/oauth2/v2.0/authorize"

    @computed_field
    @property
    def OPENAPI_TOKEN_URL(self) -> str:
        return f"https://login.microsoftonline.com/{self.TENANT_ID}/oauth2/v2.0/token"

    class Config:
        env_file = '.env'
        env_file_encoding = 'utf-8'
        case_sensitive = True

settings = Settings()

@asynccontextmanager
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
    """
    Load OpenID config on startup.
    """
    await azure_scheme.openid_config.load_config()
    yield

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
        'scopes': settings.SCOPE_NAME,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )


azure_scheme = SingleTenantAzureAuthorizationCodeBearer(
    app_client_id=settings.APP_CLIENT_ID,
    tenant_id=settings.TENANT_ID,
    scopes=settings.SCOPES,
)

@app.get("/", dependencies=[Security(azure_scheme)])
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### Scopes Configuration Example

Source: https://intility.github.io/fastapi-azure-auth/settings/single_tenant

Defines the scopes required for your application's authentication, mapping scope identifiers to their descriptions. Ensure these scopes are configured in Azure Entra ID.

```python
{
    f'api://{settings.APP_CLIENT_ID}/user_impersonation': 'user_impersonation',
}
```

--------------------------------

### Using Annotated Dependency in a View

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/guest_users

Example of how to use the `NonGuestUser` annotated dependency in a FastAPI route to ensure only non-guest users can access the endpoint.

```python
@app.get("/items/")
def read_items(user: NonGuestUser):
    ...

```

--------------------------------

### FastAPI App Configuration with OpenAPI Settings

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/fastapi_configuration

Initializes a FastAPI application with CORS middleware and configures OpenAPI settings for OAuth2, including redirect URL and client ID. This setup is necessary for the OpenAPI documentation to function correctly with Azure AD.

```python
import uvicorn
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )


@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', host='localhost', port=8000, reload=True)
```

--------------------------------

### Configure FastAPI with Azure AD B2C Settings

Source: https://intility.github.io/fastapi-azure-auth/b2c/fastapi_configuration

Define Pydantic settings for Azure AD B2C integration, including tenant details, client IDs, and scopes. This setup is crucial for initializing the authentication middleware.

```python
import uvicorn
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from pydantic import AnyHttpUrl, computed_field
from pydantic_settings import BaseSettings, SettingsConfigDict
from fastapi_azure_auth import B2CMultiTenantAuthorizationCodeBearer


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    TENANT_NAME: str = ""
    APP_CLIENT_ID: str = ""
    OPENAPI_CLIENT_ID: str = ""
    AUTH_POLICY_NAME: str = ""
    SCOPE_DESCRIPTION: str = "user_impersonation"

    @computed_field
    @property
    def SCOPE_NAME(self) -> str:
        return f'https://{self.TENANT_NAME}.onmicrosoft.com/{self.APP_CLIENT_ID}/{self.SCOPE_DESCRIPTION}'

    @computed_field
    @property
    def SCOPES(self) -> dict:
        return {
            self.SCOPE_NAME: self.SCOPE_DESCRIPTION
        }

    @computed_field
    @property
    def OPENID_CONFIG_URL(self) -> str:
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/v2.0/.well-known/openid-configuration'

    @computed_field
    @property
    def OPENAPI_AUTHORIZATION_URL(self) -> str:
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/oauth2/v2.0/authorize'

    @computed_field
    @property
    def OPENAPI_TOKEN_URL(self) -> str:
        return f'https://{self.TENANT_NAME}.b2clogin.com/{self.TENANT_NAME}.onmicrosoft.com/{self.AUTH_POLICY_NAME}/oauth2/v2.0/token'

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
        'scopes': settings.SCOPE_NAME,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )

azure_scheme = B2CMultiTenantAuthorizationCodeBearer(
    app_client_id=settings.APP_CLIENT_ID,
    openid_config_url=settings.OPENID_CONFIG_URL,
    openapi_authorization_url=settings.OPENAPI_AUTHORIZATION_URL,
    openapi_token_url=settings.OPENAPI_TOKEN_URL,
    scopes=settings.SCOPES,
    validate_iss=False,
)


@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### Example B2C Scopes Configuration

Source: https://intility.github.io/fastapi-azure-auth/settings/b2c

Defines the scopes for Azure Entra ID B2C authentication. Ensure these scopes are configured in your Azure Entra ID B2C application.

```python
{
    f'https://{settings.TENANT_NAME}.onmicrosoft.com/{settings.APP_CLIENT_ID}/user_impersonation': 'user_impersonation'
}
```

--------------------------------

### Call API with Client Credentials Flow (B2C)

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/calling_your_apis_from_python

This Python script shows how to authenticate with Azure AD B2C using the client credentials flow. It differs from the single-tenant example in the token endpoint URL and the scope format. Ensure your B2C tenant and application settings are correctly configured.

```python
import asyncio
from httpx import AsyncClient
from demo_project.core.config import settings

async def main():
    async with AsyncClient() as client:
        azure_response = await client.post(
            url=f'https://{settings.TENANT_NAME}.b2clogin.com/{settings.TENANT_NAME}.onmicrosoft.com/{settings.AUTH_POLICY_NAME}/oauth2/v2.0/token',
            data={
                'grant_type': 'client_credentials',
                'client_id': settings.OPENAPI_CLIENT_ID,  # the ID of the app reg you created the secret for
                'client_secret': settings.CLIENT_SECRET,  # the secret you created
                'scope': f'https://{settings.TENANT_NAME}.onmicrosoft.com/{settings.APP_CLIENT_ID}/.default',
            }
        )
        token = azure_response.json()['access_token']

        my_api_response = await client.get(
            'http://localhost:8000/api/v1/hello-graph',
            headers={'Authorization': f'Bearer {token}'},
        )
        print(my_api_response.json())

if __name__ == '__main__':
    asyncio.run(main())
```

--------------------------------

### FastAPI App Initialization and Configuration

Source: https://intility.github.io/fastapi-azure-auth/b2c/fastapi_configuration

Initializes a FastAPI application with CORS middleware and configures settings for OpenAPI documentation, including OAuth2 redirect URL and client ID.

```python
import uvicorn
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    TENANT_NAME: str = ""
    APP_CLIENT_ID: str = ""
    OPENAPI_CLIENT_ID: str = ""
    AUTH_POLICY_NAME: str = ""
    SCOPE_DESCRIPTION: str = "user_impersonation"

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )


@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)
```

--------------------------------

### OpenAPI Documentation with OAuth2

Source: https://intility.github.io/fastapi-azure-auth/single-tenant/fastapi_configuration

Configures FastAPI's OpenAPI documentation with OAuth2 settings, including redirect URL and client ID for authentication flow. Ensure 'usePkceWithAuthorizationCodeGrant' is set to True for PKCE flow.

```python
import uvicorn
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""
    TENANT_ID: str = ""

    class Config:
        env_file = '.env'
        env_file_encoding = 'utf-8'
        case_sensitive = True

settings = Settings()

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )

@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### Configure SingleTenantAzureAuthorizationCodeBearer

Source: https://intility.github.io/fastapi-azure-auth/single-tenant/fastapi_configuration

Set up the authorization scheme by providing your application client ID, tenant ID, and scopes. This is essential for authenticating users with Azure AD.

```python
import uvicorn
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from fastapi_azure_auth import SingleTenantAzureAuthorizationCodeBearer
from pydantic import AnyHttpUrl, computed_field
from pydantic_settings import BaseSettings


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""
    TENANT_ID: str = ""
    SCOPE_DESCRIPTION: str = "user_impersonation"

    @computed_field
    @property
    def SCOPE_NAME(self) -> str:
        return f'api://{self.APP_CLIENT_ID}/{self.SCOPE_DESCRIPTION}'

    @computed_field
    @property
    def SCOPES(self) -> dict:
        return {
            self.SCOPE_NAME: self.SCOPE_DESCRIPTION,
        }

    class Config:
        env_file = '.env'
        env_file_encoding = 'utf-8'
        case_sensitive = True

settings = Settings()

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
        'scopes': settings.SCOPE_NAME,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )


azure_scheme = SingleTenantAzureAuthorizationCodeBearer(
    app_client_id=settings.APP_CLIENT_ID,
    tenant_id=settings.TENANT_ID,
    scopes=settings.SCOPES,
)


@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### Settings Management with Pydantic

Source: https://intility.github.io/fastapi-azure-auth/single-tenant/fastapi_configuration

Integrates Pydantic's BaseSettings to load application settings from a .env file. This approach centralizes configuration and supports default values.

```python
import uvicorn
from fastapi import FastAPI
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""
    TENANT_ID: str = ""

    class Config:
        env_file = '.env'
        env_file_encoding = 'utf-8'
        case_sensitive = True

settings = Settings()

app = FastAPI()

@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', reload=True)

```

--------------------------------

### Call API with Client Credentials Flow (Single-Tenant)

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/calling_your_apis_from_python

This Python script demonstrates how to obtain an access token using the client credentials flow for a single-tenant Azure AD application and then use it to call a protected API endpoint. Ensure you have the necessary settings configured in your `settings` object.

```python
import asyncio
from httpx import AsyncClient
from demo_project.core.config import settings

async def main():
    async with AsyncClient() as client:
        azure_response = await client.post(
            url=f'https://login.microsoftonline.com/{settings.TENANT_ID}/oauth2/v2.0/token',
            data={
                'grant_type': 'client_credentials',
                'client_id': settings.OPENAPI_CLIENT_ID,  # the ID of the app reg you created the secret for
                'client_secret': settings.CLIENT_SECRET,  # the secret you created
                'scope': f'api://{settings.APP_CLIENT_ID}/.default',  # note: NOT .user_impersonation
            }
        )
        token = azure_response.json()['access_token']

        my_api_response = await client.get(
            'http://localhost:8000/api/v1/hello-graph',
            headers={'Authorization': f'Bearer {token}'},
        )
        print(my_api_response.json())

if __name__ == '__main__':
    asyncio.run(main())
```

--------------------------------

### FastAPI Settings with Pydantic and .env

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/fastapi_configuration

Integrates Pydantic's BaseSettings to load configuration from a .env file. This approach centralizes application settings and supports environment-specific configurations.

```python
import uvicorn
from fastapi import FastAPI
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

app = FastAPI()

@app.get("/")
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', host='localhost', port=8000, reload=True)
```

--------------------------------

### OpenAPI and Backend API Client IDs Environment Variables

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/azure_setup

Store both the backend API's Application (Client) ID and the OpenAPI documentation's Application (Client) ID in a .env file. This is essential for configuring authentication flows for both components.

```dotenv
APP_CLIENT_ID=  
OPENAPI_CLIENT_ID=
```

--------------------------------

### Configure Environment Variables for Azure B2C

Source: https://intility.github.io/fastapi-azure-auth/b2c/azure_setup

Set the TENANT_NAME, APP_CLIENT_ID, OPENAPI_CLIENT_ID, and AUTH_POLICY_NAME in your .env file. Ensure AUTH_POLICY_NAME includes the 'B2C_1_' prefix.

```env
TENANT_NAME=  
APP_CLIENT_ID=  
OPENAPI_CLIENT_ID=  
AUTH_POLICY_NAME=B2C_1_sign_up_sign_in  

```

--------------------------------

### Using Annotated Role Dependency in a View

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/locking_down_on_roles

Demonstrates how to use the created `AdminUser` Annotated dependency in a FastAPI route to protect it, ensuring only users with the 'AdminUser' role can access it.

```python
@app.get("/items/")

def read_items(user: AdminUser):
    ...

```

--------------------------------

### Securing API Endpoint with Specific Scopes

Source: https://intility.github.io/fastapi-azure-auth/single-tenant/fastapi_configuration

Demonstrates how to restrict access to an API endpoint by specifying required scopes in the Security dependency. If the user does not have the 'wrong_scope', they will be denied access.

```python
@app.get("/", dependencies=[Security(azure_scheme, scopes=['wrong_scope'])])
```

--------------------------------

### FastAPI Configuration for Specific Tenants

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/accept_specific_tenants_only

This snippet demonstrates how to configure FastAPI with MultiTenantAzureAuthorizationCodeBearer to accept only specific tenants. It includes a callable function to validate tenant IDs against a predefined mapping.

```python
import uvicorn
from fastapi import FastAPI, Security
from fastapi.middleware.cors import CORSMiddleware
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings, SettingsConfigDict
from fastapi_azure_auth import MultiTenantAzureAuthorizationCodeBearer
from fastapi_azure_auth.exceptions import Unauthorized


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )


async def check_if_valid_tenant(tid: str) -> str:
    tid_to_iss_mapping = {
        '9b5ff18e-53c0-45a2-8bc2-9c0c8f60b2c6': 'https://login.microsoftonline.com/9b5ff18e-53c0-45a2-8bc2-9c0c8f60b2c6/v2.0'
    }
    try:
        return tid_to_iss_mapping[tid]
    except KeyError:
        raise Unauthorized('Tenant not allowed')

azure_scheme = MultiTenantAzureAuthorizationCodeBearer(
    app_client_id=settings.APP_CLIENT_ID,
    scopes={
        f'api://{settings.APP_CLIENT_ID}/user_impersonation': 'user_impersonation',
    },
    validate_iss=True,
    iss_callable=check_if_valid_tenant
)


@app.on_event('startup')
async def load_config() -> None:
    """
    Load OpenID config on startup.
    """
    await azure_scheme.openid_config.load_config()


@app.get("/", dependencies=[Security(azure_scheme)])
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', host='localhost', port=8000, reload=True)

```

--------------------------------

### Annotated Dependency for Non-Guest Users

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/guest_users

An alternative way to create a dependency for non-guest users using `Annotated`, available in FastAPI 0.95.0 and later. This simplifies dependency declaration in your views.

```python
from typing import Annotated
from fastapi import Depends
from fastapi_azure_auth.exceptions import Unauthorized
from fastapi_azure_auth.user import User

async def deny_guest_users(user: User = Depends(azure_scheme)) -> None:
    """
    Deny guest users
    """
    if user.is_guest:
        raise Unauthorized('Guest user not allowed')

NonGuestUser = Annotated[User, Depends(deny_guest_users)]

```

--------------------------------

### Backend API Client ID Environment Variable

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/azure_setup

Store the Application (Client) ID for the backend API in a .env file. This ID is crucial for authentication configurations.

```dotenv
APP_CLIENT_ID=
```

--------------------------------

### Configure DEBUG Logging for FastAPI Azure Auth

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/troubleshooting

Set the logging level to DEBUG for the 'fastapi_azure_auth' logger to capture detailed diagnostic information. It's recommended to call dictConfig() before initializing FastAPI and the auth library.

```python
from logging.config import dictConfig

LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'formatters': {
        'verbose': {
            'format': '%(levelname)s %(asctime)s %(name)s %(message)s'
        },
    },
    'handlers': {
        'console': {
            'class': 'logging.StreamHandler',
            'formatter': 'verbose',
        },
    },
    'loggers': {
        'fastapi_azure_auth': {'handlers': ['console'], 'level': 'DEBUG', 'propagate': False},
    },
}

dictConfig(LOGGING)
```

--------------------------------

### Deny Guest Users Dependency

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/guest_users

Use this dependency to explicitly deny guest users from accessing an endpoint. This is useful when `allow_guest_users` is set to `True` globally but specific endpoints should remain restricted.

```python
from fastapi import Depends
from fastapi_azure_auth.exceptions import Unauthorized
from fastapi_azure_auth.user import User

async def deny_guest_users(user: User = Depends(azure_scheme)) -> None:
    """
    Deny guest users
    """
    if user.is_guest:
        raise Unauthorized('Guest user not allowed')

```

--------------------------------

### Mocking Azure Authentication for Tests

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/testing

This fixture mocks the Azure authentication scheme to provide a normal user for testing API endpoints. It overrides the dependency and sets up an AsyncClient for making requests.

```python
import pytest
from httpx import AsyncClient
from demo_project.api.dependencies import azure_scheme
from fastapi import Request
from fastapi_azure_auth.user import User
from demo_project.main import app as fastapi_app

@pytest.fixture
async def normal_user_client():
    async def mock_normal_user(request: Request):
        user = User(
            claims={},
            preferred_username="NormalUser",
            roles=["role1"],
            aud="aud",
            tid="tid",
            access_token="123",
            is_guest=False,
            iat=1537231048,
            nbf=1537231048,
            exp=1537234948,
            iss="iss",
            aio="aio",
            sub="sub",
            oid="oid",
            uti="uti",
            rh="rh",
            ver="2.0",
        )
        request.state.user = user
        return user

    fastapi_app.dependency_overrides[azure_scheme] = mock_normal_user
    async with AsyncClient(app=fastapi_app, base_url='http://test') as ac:
        yield ac

```

--------------------------------

### Access User with Depends()

Source: https://intility.github.io/fastapi-azure-auth/usage-and-faq/accessing_the_user

Use `Depends(<schema name>)` to inject the authenticated user object directly into your route function parameters. This is the recommended approach for type-safe access.

```python
from fastapi import APIRouter, Depends
from demo_project.api.dependencies import azure_scheme
from fastapi_azure_auth.user import User

router = APIRouter()

@router.get(
    '/hello-user',
    response_model=User,
    operation_id='helloWorldApiKey',
)
async def hello_user(user: User = Depends(azure_scheme)) -> dict[str, bool]:
    """
    Wonder how this auth is done?
    """
    return user.dict()
```

```python
from fastapi import APIRouter, Depends
from typing import Dict

from demo_project.api.dependencies import azure_scheme
from fastapi_azure_auth.user import User

router = APIRouter()

@router.get(
    '/hello-user',
    response_model=User,
    operation_id='helloWorldApiKey',
)
async def hello_user(user: User = Depends(azure_scheme)) -> Dict[str, bool]:
    """
    Wonder how this auth is done?
    """
    return user.dict()
```

--------------------------------

### Environment Variables for Azure B2C Configuration

Source: https://intility.github.io/fastapi-azure-auth/b2c/azure_setup

This snippet shows the environment variables that need to be set for Azure B2C authentication. These include tenant name, client IDs for the backend API and OpenAPI, and the authentication policy name.

```dotenv
TENANT_NAME=  
APP_CLIENT_ID=  
OPENAPI_CLIENT_ID=  
AUTH_POLICY_NAME=  

```

--------------------------------

### Add Authentication to API Views with Scopes

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/fastapi_configuration

Secure API views by adding authentication dependencies using FastAPI's `Security()` function. This allows for scope-based access control, ensuring only authorized users with specific permissions can access certain endpoints.

```python
import uvicorn
from fastapi import FastAPI, Security
from fastapi.middleware.cors import CORSMiddleware
from pydantic import AnyHttpUrl
from pydantic_settings import BaseSettings, SettingsConfigDict
from fastapi_azure_auth import MultiTenantAzureAuthorizationCodeBearer
from contextlib import asynccontextmanager
from typing import AsyncGenerator


class Settings(BaseSettings):
    BACKEND_CORS_ORIGINS: list[str | AnyHttpUrl] = ['http://localhost:8000']
    OPENAPI_CLIENT_ID: str = ""
    APP_CLIENT_ID: str = ""

    model_config = SettingsConfigDict(
        env_file='.env',
        env_file_encoding='utf-8',
        case_sensitive=True
    )

settings = Settings()

@asynccontextmanager
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
    """
    Load OpenID config on startup.
    """
    await azure_scheme.openid_config.load_config()
    yield

app = FastAPI(
    swagger_ui_oauth2_redirect_url='/oauth2-redirect',
    swagger_ui_init_oauth={
        'usePkceWithAuthorizationCodeGrant': True,
        'clientId': settings.OPENAPI_CLIENT_ID,
    },
)

if settings.BACKEND_CORS_ORIGINS:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=[str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
        allow_credentials=True,
        allow_methods=['*'],
        allow_headers=['*'],
    )


azure_scheme = MultiTenantAzureAuthorizationCodeBearer(
    app_client_id=settings.APP_CLIENT_ID,
    scopes={
        f'api://{settings.APP_CLIENT_ID}/user_impersonation': 'user_impersonation',
    },
    validate_iss=False
)

@app.get("/", dependencies=[Security(azure_scheme)])
async def root():
    return {"message": "Hello World"}


if __name__ == '__main__':
    uvicorn.run('main:app', host='localhost', port=8000, reload=True)

```

--------------------------------

### Environment Variables for Azure App IDs

Source: https://intility.github.io/fastapi-azure-auth/single-tenant/azure_setup

Store your Azure Entra ID Tenant ID, Backend Application Client ID, and OpenAPI Client ID in a .env file for easy access in your application configuration.

```dotenv
TENANT_ID=  
APP_CLIENT_ID=  
OPENAPI_CLIENT_ID=  

```

--------------------------------

### Caching Issuer Fetcher for Multi-Tenant Apps

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/accept_specific_tenants_only

Implement a sophisticated callable with in-memory caching for issuer validation in multi-tenant FastAPI applications. This class caches issuer information for a specified duration to improve performance.

```python
from datetime import datetime, timedelta
from typing import Optional
import logging

log = logging.getLogger(__name__)

class IssuerFetcher:
    def __init__(self) -> None:
        """
        Example class for multi tenant apps, that caches issuers for an hour
        """
        self.tid_to_iss: dict[str, str] = {}
        self._config_timestamp: Optional[datetime] = None

    async def __call__(self, tid: str) -> str:
        """
        Check if memory cache needs to be updated or not, and then returns an issuer for a given tenant
        :raises Unauthorized when it's not a valid tenant
        """
        refresh_time = datetime.now() - timedelta(hours=1)
        if not self._config_timestamp or self._config_timestamp < refresh_time:
            self._config_timestamp = datetime.now()
            # logic to find your allowed tenants and it's issuers here
            # (This example cache in memory for 1 hour)
            self.tid_to_iss = {
                'intility_tenant': 'intility_tenant',
            }
        try:
            return self.tid_to_iss[tid]
        except Exception as error:
            log.exception('`iss` not found for `tid` %s. Error %s', tid, error)
            raise Unauthorized('You must be an Intility customer to access this resource')


issuer_fetcher = IssuerFetcher()

azure_scheme = MultiTenantAzureAuthorizationCodeBearer(
    ...
    validate_iss=True,
    iss_callable=issuer_fetcher
)
```

--------------------------------

### Restrict API Access with Scopes

Source: https://intility.github.io/fastapi-azure-auth/multi-tenant/fastapi_configuration

Use the `scopes` parameter in `Security()` to limit API access to users with specific permissions. If a user lacks the required scope, they will be denied access.

```python
@app.get("/", dependencies=[Security(azure_scheme, scopes=['wrong_scope'])])  

```
Tokens:
Raw