@anshugarg15Problem
Our current auth config is static — we can't make OAuth endpoints dynamic or conditional based on customer-provided values. This blocks two key enterprise use cases:
1. Microsoft Tenant ID in OAuth URL
Microsoft single-tenant apps require /{tenantId} in the token/authorize URL instead of /common. Our current setup hardcodes /common, which:
- Blocks single-tenant Entra apps entirely
- May not enforce tenant-specific security policies even for multi-tenant apps during refresh
- Customer (Glean) raised this — Ishan (Glean) confirmed: 'refreshing using /common for multitenant apps is also not correct — ideally you should be using /{tenant} for both token and refresh endpoints'
2. Slack Team ID
Same pattern — Slack's OAuth can be scoped to a specific workspace using team parameter. Without advanced params, we can't pass this dynamically.
RFC
Karthikeya has written an RFC: Advanced Auth Parameters for Toolkits
Lingala has reviewed and approved the approach, with comments to discuss.
A PR was started with Zen but needs testing.
Impact
- Glean (enterprise) — blocked on single-tenant MS apps & Slack team scoping
- General enterprise — M&A scenarios where tenancy controls on OAuth are critical
- Multiple toolkits — not just MS & Slack, this is a general pattern needed across enterprise auth
Context
- Internal discussion thread
- Customer thread (ext-glean)
- Originally planned for end of April, but action-scope mapping work is progressing well so this may be picked up sooner
Ask
Check whether Microsoft OAuth can support an OAuth endpoint like (instead of ), and whether adding it would be breaking.