Skip to main content

Login

GET 
/auth/login

Redirect browser to Entra OIDC authorization endpoint.

The ARMOR_AUTH_ENTRA_CLIENT_ID and ARMOR_AUTH_ENTRA_CLIENT_SECRET settings control the app registration. ARMOR_AUTH_ENTRA_TENANT_ID selects the directory.

step_up=1: forces a fresh Entra sign-in (prompt=login — the IdP cannot silently satisfy this from an existing IdP session) AND sends an explicit claims request requiring the Conditional Access Authentication Context configured via ARMOR_AUTH_STEP_UP_ACR_VALUE to be present as an essential acrs claim, so Entra actively enforces whatever the admin's CA policy for that context requires (typically MFA) rather than the callback merely hoping a fresh login happened to trigger it. The callback below still independently re-verifies the returned acrs claim before treating the result as step-up (fail closed either way).

Not amr: an earlier version of this endpoint requested amr=["mfa"] instead. Microsoft confirms amr (Authentication Methods References) is a v1.0-token-only claim — it is never present in v2.0 ID tokens (the endpoint this app uses), regardless of app registration or claims-request configuration. Live-observed 2026-07-13: Entra's own "Add optional claim" picker for this app doesn't even list amr as a choice for ID tokens, confirming it's unsupported here, not just unconfigured. acrs + Conditional Access Authentication Context is Microsoft's documented v2.0 replacement.

Prerequisite (Entra ID P1+ licensing required): an admin must create an Authentication Context Class Reference and a Conditional Access policy requiring MFA for it, then set ARMOR_AUTH_STEP_UP_ACR_VALUE to that context's id. See infra/azure/README.md's Prerequisites section. If unset, this endpoint fails closed (500) rather than silently downgrading step-up to "any fresh sign-in."

Request​

Responses​

Successful Response

Response Headers
    RateLimit

    Current tenant quota state (draft-ietf-httpapi-ratelimit-headers structured field): "tenant";r=<remaining>;t=<seconds-to-reset>. Emitted on every response when per-tenant rate limiting is enabled (ARMOR_TENANT_RATE_LIMIT_PER_MIN > 0; off by default).

    RateLimit-Policy

    The quota policy the RateLimit header reports against: "tenant";q=<limit>;w=<window-seconds>.

    X-Correlation-Id

    Request correlation id — present on every response; quote it when reporting an issue. Error bodies carry the same value as correlation_id.

Was this helpful?

Optional comments unlock after a short time on this docs site.

Ask the docs

Tier-scoped answers from this portal corpus (extractive; no external LLM).

Comments

Loading comments…

Suggest an edit

Propose a correction. Staff review every suggestion and open a draft PR; nothing publishes without CI.