Conditional Access Control with Microsoft Azure Active Directory

auth_jwt_snippet.conf

auth_jwt "Closed site";
auth_jwt_key_file /etc/nginx/azure.jwk;

# vim: syntax=nginx

azure_finance_app.conf

auth_jwt_claim_set $jwt_groups groups;

map $jwt_groups $isFinance {
    "~566a3987-eff4-4c6d-9df3-0b23e5f49b1e" 1; # Finance group object ID
    default                                 0;
}

server {
    listen 80; # For testing only, use TLS in production

    # Azure identity token presented as a cookie
    auth_jwt "Finance app" token=$cookie_auth_token;
    auth_jwt_key_file /etc/nginx/azure.jwk;

    location / {
        # Ensure the user belongs to the Finance group
        auth_jwt_require $isFinance error=403;
        
        #error_page 403 /not_in_group.html; # Nice error page when forbidden

        # Successfully authenticated users are proxied to the finance app,
        # with email address passed as HTTP header
        proxy_set_header X-JWT-Email $jwt_claim_email;
        proxy_pass http://10.0.0.1; # Testing only, use upstream in production
    }
}

# vim: syntax=nginx

sample_azure_jwt.json

{
  "aio": "AUQAu/8GAAAAgsMuoz2rZG9FU6DgfQ6Eo+6qhp6+9AsCG71WssWeXhFmAFaWiS4X7NJg3/k6OVR2kVPGDLF0aWHniQD1qcY8sQ==",
  "amr": [
    "pwd"
  ],
  "aud": "ac6ee3d5-4a2b-4ce1-aff0-157181da2c6f",
  "nbf": 1514886571,
  "exp": 1514890471,
  "email": "xample@example.com",
  "name": "Xavier Ample",
  "family_name": "Ample",
  "given_name": "Xavier",
  "groups": [
    "22c852e1-7034-4610-8c1c-9a4b5576f240",
    "620647cc-abde-406f-b7c6-d062c9561cfb",
    "9692a7ad-fd5c-4183-8ea7-b816c06e21af"
  ],
  "iat": 1514886571,
  "idp": "live.com",
  "ipaddr": "10.0.0.1",
  "iss": "https //sts.windows.net/f96d557e-c5ae-4b75-a812-2d4106ead198/",
  "nonce": "14b09b909b959f7d4097525d91b89cc718f1d2cfd22841d4a1382391cd699641",
  "oid": "b57e3072-38eb-4332-89b8-d6038993b5e5",
  "sub": "EpFEXMqK7_SGudgq2GLFNKq7xotlHKXYmsTyMZiuO-Q",
  "tid": "f96d557e-c4ae-4b75-a912-2d4106ead198",
  "unique_name": "live.com#xample@example.com",
  "uti": "5ULp6hSi5EOY7N5CAdYJAA",
  "ver": "1.0",
  "wids": [
    "62e90394-79f5-4237-9190-052177145e10"
  ]
}

For a discussion of these files, see Conditional Access Control with Microsoft Azure Active Directory