anchor.diff:          org_role = mkOption {
             description = "Which role anonymous users have in the organization.";
             default = "Viewer";
  +          type = types.str;
  +        };
  +      };
  +      azuread = {
  +        enable = mkOption {
  +          description = "Whether to allow Azure AD OAuth.";
  +          default = false;
  +          type = types.bool;
  +        };
  +        allowSignUp = mkOption {
  +          description = "Whether to allow sign up with Azure AD OAuth.";
  +          default = false;
  +          type = types.bool;
  +        };
  +        clientId = mkOption {
  +          description = "Azure AD OAuth client ID.";
  +          default = "";
  +          type = types.str;
  +        };
  +        clientSecretFile = mkOption {
  +          description = "Azure AD OAuth client secret.";
  +          default = null;
  +          type = types.nullOr types.path;
  +        };
  +        tenantId = mkOption {
  +          description = ''
  +            Tenant id used to create auth and token url. Default to "common"
  +            , let user sign in with any tenant.
  +            '';
  +          default = "common";
  +          type = types.str;
  +        };
  +        allowedDomains = mkOption {
  +          description = ''
  +            To limit access to authenticated users who are members of one or more groups,
  +            set allowedGroups to a comma- or space-separated list of group object IDs.
  +            You can find object IDs for a specific group on the Azure portal.
  +          '';
  +          default = "";
  +          type = types.str;
  +        };
  +        allowedGroups = mkOption {
  +          description = ''
  +            Limits access to users who belong to specific domains.
  +            Separate domains with space or comma.
  +          '';
  +          default = "";
             type = types.str;
           };
         };
  
positive.code:     AUTH_ANONYMOUS_ENABLED = boolToString cfg.auth.anonymous.enable;
      AUTH_ANONYMOUS_ORG_NAME = cfg.auth.anonymous.org_name;
      AUTH_ANONYMOUS_ORG_ROLE = cfg.auth.anonymous.org_role;
      AUTH_GOOGLE_ENABLED = boolToString cfg.auth.google.enable;
      AUTH_GOOGLE_ALLOW_SIGN_UP = boolToString cfg.auth.google.allowSignUp;
      AUTH_GOOGLE_CLIENT_ID = cfg.auth.google.clientId;
  
negative.code:         set -o errexit -o pipefail -o nounset -o errtrace
          shopt -s inherit_errexit
  
          ${optionalString (cfg.auth.azuread.clientSecretFile != null) ''
            GF_AUTH_AZUREAD_CLIENT_SECRET="$(<${escapeShellArg cfg.auth.azuread.clientSecretFile})"
            export GF_AUTH_AZUREAD_CLIENT_SECRET
          ''}
          ${optionalString (cfg.auth.google.clientSecretFile != null) ''
            GF_AUTH_GOOGLE_CLIENT_SECRET="$(<${escapeShellArg cfg.auth.google.clientSecretFile})"
            export GF_AUTH_GOOGLE_CLIENT_SECRET
  