by Chris Swinney.
Hi All,
I raised this as an issue in the MS o365-moodle plugin tracker but haven't got any feedback as yet, so wonder if anyone else was doing something similar.
We use Moodle (indeed now Moodle Workplace) to deliver training both internally, and (most importantly) externally to many partners and customers. We currently use the O365 series of plugins (which includes the OpenID Connect authentication plugin), that allows us
to not only provide authentication against Azure AD for our internal employees but also to pre-provision those users into our internal courses that are required when onboarding new staff.
However, we need to provide a mechanism to enable ALL our partners and customers to be able to use their own MS365/Google authentication. Correct me if I'm wrong, but I do NOT think I can use the current OpenID Connect authentication?
You can set up multi-tenancy in the O365 plugins, but I believe this is more for multiple tenants that would exist within your own organisations rather than generic tenants used by others. I did try this on a demo setup and it appeared as if other domains were then asked for consent against our AAD app, which is totally impractical.
Question 1
Does this then mean that I need two separate authentication buttons for MS365? One for internal users via the OpenID Connect, and another for all other users via Oauth2?
Question 2
Slightly different but related to above, is it possible to allow users to sign up with their corporate identities, yet also bind that Moodle account to be able to be accessed using a personal login? People do have a tendency to move positions and companies, but their training accomplishments should be personal to them, but also linked to the partner organisation what at that organisation.
NOTE: I should also say, we will not be providing a CAS, so all authentication like this should be offloaded to the relevant Identity Providers.
e. 
