Auth
Sign users in with Fabric SSO — Rayfin's managed sessions, per-user data isolation, and one client API for every deployed app.
Rayfin Auth gives you managed sign-in and session handling without building an identity
service yourself. Enable it in rayfin.yml, call ensureSignedInWithFabric(client.auth, ...), and every client.data.* call after that automatically carries the authenticated
context — no manual header or token passing between modules.
Why use Rayfin Auth
- Zero auth infrastructure — sessions and token handling work with no external identity service to deploy or configure.
- Pre-integrated with data — after sign-in, every
client.data.*call automatically carries the authenticated context. - Automatic per-user data isolation — JWT claims drive the row-level security policies you declare on your entities (see Permissions), so each user sees only the data they own without hand-written SQL.
- One client API —
getSession,onSessionChange, andsignOutwork the same way no matter which Fabric SSO flow (popup or embedded) signed the user in.
Fabric SSO is the only auth method
Rayfin apps sign users in with the Microsoft Entra identity they already used to open the Fabric portal. There's no separate login form, sign-up step, or password to manage — the user authenticates once in Fabric and the app inherits that session.
Note
Sign-in works from a local dev server as well as from the deployed app. The popup flow
returns its handoff code to any origin listed in allowedRedirectUris, including
http://localhost:5173 — what it requires is a backend deployed to Fabric. Only the
embedded (iframe) flow needs the app itself to be running inside the Fabric portal. See
Fabric SSO for both flows.
Configuring auth
Enable the service and Fabric SSO in rayfin/rayfin.yml:
services:
auth:
enabled: true
allowedRedirectUris:
- http://localhost:5173
fabric:
enabled: trueRedeploy (npx rayfin up) after changing this file — auth settings are synced to the
remote service on every deploy. See Redirect URIs for what
allowedRedirectUris controls.
In this section
- Fabric SSO — enable it, install the provider package, and
call
ensureSignedInWithFabric. - Sessions — the opaque session object,
onSessionChange, and token handling. - Delegated access — how functions, connectors, and entity policies use the signed-in user's identity.
- React integration — an auth context, a hook, and route guarding.
In my Rayfin app, set up authentication:
- In rayfin/rayfin.yml, enable services.auth with fabric.enabled: true, and keep
allowedRedirectUris scoped to my app's own origin(s), including http://localhost:5173 for
local frontend development.
- Install @microsoft/rayfin-auth-provider-fabric and call ensureSignedInWithFabric from a
button click handler for the popup flow, plus initEmbeddedAuth in a startup effect for
the embedded/iframe flow.
- Use onSessionChange to react to session changes — onAuthStateChange does not exist on the
Rayfin auth client. Gate UI on isAuthenticated or the presence of a user object, never on
session internals.
Explain which files you changed and how to test sign-in.Seeding data
Populate @anonymous() Rayfin entities with RayfinServerClient in a Node.js script — @authenticated() entities have no scripted seeding path today.
Fabric SSO
Sign users in with their Microsoft Entra identity through the Fabric portal — enable it in rayfin.yml, install the provider package, and call ensureSignedInWithFabric.