YouTrack Server
 
2019.2
Get YouTrack Standalone
You are viewing the documentation for an earlier version of YouTrack Server. View this page in the current documentation
  1. Administration
  2. Access Management
  3. Auth Modules
  4. Microsoft Live Auth Module

Microsoft Live Auth Module

Last modified: 17 December 2019

The Microsoft Live authentication module is a pre-configured OAuth 2.0 auth module that lets users log in to YouTrack with their Microsoft Live credentials.

Enable Microsoft Live Authentication

To allow users with existing Microsoft Live accounts to log in to YouTrack, enable the authentication module.

This procedure takes place in three steps:

  1. Generate a Redirect URI in YouTrack. When you create an authentication module, YouTrack generates a redirect URI to use with the authorization service. This URI identifies the source of each login request.

  2. Generate a Client ID and Secret in Microsoft Live. Every login request sent from YouTrack includes a unique identifier. The ID and secret you store in the authentication module tell the Microsoft Live authorization service that each login request is authorized.

  3. Enable the Auth Module in YouTrack. When you have generated the information YouTrack uses to authenticate with the Microsoft Live authorization service, copy the values into YouTrack and enable the module.

Generate a Redirect URI in YouTrack

To get started, open YouTrack and create an authentication module for Microsoft accounts. When you create the authentication module, YouTrack generates a redirect URI to use with the authorization service.

To generate a redirect URI in YouTrack:

tip

Requires permissions: Low-level Admin Write

  1. In the Access Management section of the Administration menu, select Auth Modules.

  2. From the New Module drop-down list, select Microsoft Live.

    • The Auth Modules page displays the settings for a new Microsoft Live authentication module.

    • YouTrack generates a redirect URI for you to use in the authorization service.

    Microsoft live auth redirect uri

  3. If the feature is supported by your browser, use the Copy button to copy the redirect URI to your clipboard.

note

Make sure to update the Redirect URI in the authorization service when you change the base URL of your YouTrack instance. For example, after migrating data to an external Hub service or changing proxy settings.

Generate a Client ID and Secret

The next step is to register the authorized redirect URI for YouTrack in Microsoft Live.

To get a Client ID and Secret in Microsoft Live:

  1. Access the Microsoft Application Registration Portal.

  2. On the My applications page, click the Add an app button.

  3. Enter a name and click the Create button.

  4. In the Platforms section, click the Add Platform button and select the Web option.

  5. Paste the redirect URI from YouTrack into the Redirect URIs input field, then click the Save button.

  6. Use the value that is stored as the Application Id for the Client ID setting in Hub.

  7. Use the Generate New Password option to generate a value for the Client secret setting in Hub.

    Application registration portal

Enable the Auth Module in YouTrack

  1. Copy the Application Id from the Microsoft Application Registration Portal and paste it into the Client ID input field in YouTrack.

  2. Click the Generate New Password button in the Application Secrets section of the Microsoft Application Registration Portal, copy the value, then paste it into the Client secret input field in YouTrack.

  3. Configure the optional settings for the authentication module. For more information, see Additional Settings.

  4. Click the Save button to apply the settings.

  5. Click the Enable module button.

    • The Microsoft Live authentication module is enabled.

    • The icon stored in the Button image setting is added to the login dialog window. Users can click this icon to log in to YouTrack with their credentials in Microsoft Live.

Settings

The first section of the settings page displays the general settings for the authentication module. Here, you also find the redirect URI that you use to register YouTrack in the authorization service and the input fields that store the Client ID and Client Secret that are generated in the authorization service.

Setting

Description

Type

Displays the type of authorization service that is enabled for third-party authentication in YouTrack.

Name

Stores the name of the authentication module. Use this setting to distinguish this module from other authentication modules in the Auth Modules list.

Button image

Displays the image used for the button that a user clicks to log in to YouTrack with a their account in the connected authorization service. You can upload a JPG, GIF or PNG file. The image is resized to 48 x 48 pixels automatically.

Redirect URI

Displays the authorized redirect URI that is used to register the connection to YouTrack in the authorization service.

Client ID

Stores the identifier that the authorization service uses to validate a login request. You generate this value in the authorization service when you configure the authorization settings for a web application and enter an authorized redirect URI.

Client Secret

Stores the secret or password used to validate the client ID. You generate this value in the authorization service together with the client ID.

Authorization Service Endpoints

The settings in this section of the page store the OAuth 2.0 endpoints used by Microsoft Live.

For pre-configured OAuth 2.0 modules, the values that are used by the selected authorization service are set automatically.

Setting

Description

Authorization

Stores the endpoint that YouTrack uses to obtain authorization from the resource owner via user-agent redirection.

Token

Stores the endpoint that YouTrack uses to exchange an authorization grant for an access token.

User data

Stores the endpoint used to locate profile data for the authenticated user.

Email

The endpoint used to locate the email address of the authenticated user Use only when the email address is not stored in the user profile

Default email verification state

Determines which state should be set for an email address in YouTrack, when the authentication service does not return the verification status for an email address.

Field Mapping

When a user profile response object is returned by Microsoft Live, values from the specified field paths are copied to the the Hub accounts that are linked with each YouTrack profile. Use the following settings to define the endpoint that locates profile data for the authenticated user and map fields that are stored in the authorization service to Hub accounts for YouTrack users.

For the Microsoft Live module, the values are set automatically.

Use a sequence of path segments separated by slashes (/) to specify a path to a field inside a nested object.

Additional settings let you define the request scope, and choose how to authenticate with the service.

Field

Description

User ID

Maps to the field that stores the value to copy to the User ID property in the Hub account.

Email

Maps to the field that stores the value to copy to the Email field in the Hub account.

Verified email

Maps to the field that stores the value to copy to the verified email property in the Hub account.

Full name

Maps to the field that stores the value to copy to the Full name field in the Hub account.

Avatar

Maps to the field that stores the image to use as the Avatar in the Hub account.

Image URL pattern

Generates an image URL for avatars that are referenced by an ID. Use the <picture-id> placeholder to reference the field that stores the avatar.

Scope

Sets the scope for the access request. Enter a list of scopes, separated by spaces.

Authentication

Determines how credentials are passed to the authorization service.

Additional Settings

The following options are located at the bottom of the page. Use these settings to manage Hub account creation and group membership, and to reduce the loss of processing resources consumed by idle connections.

Option

Description

User creation

Enables creation of Hub accounts for unregistered users who log in with an account that is stored in the connected authorization service. YouTrack uses the email address to determine whether the user has an existing account.

Auto-join groups

Adds users to a group when they log in with an account that is stored in the connected authorization service. You can select one or more groups. New users that auto-join a group inherit all of the permissions assigned to this group.
We recommend that you add users to at least one group. Otherwise, a new user is only granted the permissions that are currently assigned to the All Users group.

Connection timeout

Sets the period of time to wait to establish a connection to the authorization service. The default setting is 5000 milliseconds (5 seconds).

Read timeout

Sets the period of time to wait to read and retrieve user profile data from the authorization service. The default setting is 5000 milliseconds (5 seconds).

Audit

Links to the Audit Events page in YouTrack. There, you can view a list of changes that were applied to this authentication module.