Auth

Rayfin Auth gives your app managed Microsoft Entra sign-in, session handling, and token refresh. After sign-in, client.data.* and client.functions.* calls use the authenticated context from the same client.auth instance.

Why use Rayfin Auth

• No separate identity provider to run — Rayfin Fabric apps use Microsoft Entra ID through Fabric SSO or delegated Entra token exchange.
• Pre-integrated SDK clients — once a session is installed on client.auth, attached Rayfin clients send the authenticated context automatically.
• Per-user data isolation — JWT claims drive row-level security policies declared on your entities. See Permissions.
• One session API — getSession, onSessionChange, refreshSession, and signOut work the same way no matter which supported flow installed the session.

Choose an auth path

Microsoft Entra ID is the only supported identity provider for Rayfin Fabric apps. Do not add alternate sign-in UI to a new Rayfin app.

Enable auth for browser apps

For Fabric SSO, enable the auth service and the Fabric provider in rayfin/rayfin.yml:

services:
  auth:
    enabled: true
    allowedRedirectUris:
      - http://localhost:5173
    fabric:
      enabled: true

Run npm run dev for the development loop. Scaffolded projects run rayfin dev, which provisions or reuses the managed Fabric backend, applies auth settings, writes RAYFIN_PUBLIC_* values to rayfin/.env, maps them to framework variables such as VITE_FABRIC_ITEM_ID, then starts the frontend.

Use npx rayfin up when you want to deploy static hosting or update a deployed environment without starting the local frontend. See Redirect URIs for what allowedRedirectUris controls.

Enable external Entra exchange

Direct Entra token sign-in and the external embed host call Rayfin's external brokered endpoints. Add externalEntraExchange: true and deploy the setting before using those flows:

services:
  auth:
    enabled: true
    fabric:
      enabled: true
      externalEntraExchange: true

This opt-in is not needed for the normal Fabric SSO popup or Fabric iframe flows.

Use sessions after any flow

Every flow installs the same opaque session on client.auth. Read only the documented fields and subscribe with onSessionChange:

const session = client.auth.getSession();

if (session.isAuthenticated && session.user) {
  showApp(session.user);
}

const unsubscribe = client.auth.onSessionChange((nextSession) => {
  console.log('Auth changed:', nextSession?.isAuthenticated ?? false);
});

// Later, for example on component unmount:
unsubscribe();

See Sessions for refresh, sign-out, and lifecycle details.

In this section

• Fabric SSO — enable it, install the provider package, and call initEmbeddedAuth plus ensureSignedInWithFabric.
• Direct Entra token sign-in — exchange an existing delegated Entra token for a Rayfin session. New in 1.36
• External embed host — broker sign-in for a Rayfin app embedded in your own portal. New in 1.36
• Sessions — the opaque session object, onSessionChange, token refresh, and sign-out.
• Delegated access — how Functions, connectors, and entity policies use signed-in identity or app identity.
• React integration — an auth context, a hook, local embedded startup, and route guarding.