Determine Social Provider Login Support (Facebook, Google) with StaticWebApps & App Service

Evaluate whether social providers include roles in their access tokens, i.e. via a role claim.

• If role claim(s) are included:
  • Can an end user can arbitrarily add themselves to roles or is that capability limited to FB app/enterprise admins?
    • If users can arbitrarily add themselves to roles, ensure we do NOT honor those roles to determine access in DAB engine and see whether SWA/AppService passes those roles through in the EasyAuth payload.
    • If just enterprise admins can manage roles/role assignments, no issues.
      • Check whether SWA/AppService passes those roles through in the EasyAuth payload. If not, developers must manage roles through SWA Azure Function Integration.
• No Role claims included:
  • Developers must manage roles through SWA Azure Functions (preview) Integration.

[aaronpowell]

I’ve got an example of how to setup SWA + Auth0 and SWA + Okta if they would be of use.

When it boils down to it though, the SWA backends don’t know what the identity provider is, they only see the token provided.

[ayush3797]

Needs discussion. Moving to Nov22.