We are getting a client secret error. (oidc) Authentication failure! invalid_credentials: OAuth2::Error, invalid_client: AADSTS70002: Error validating credentials. AADSTS50012: Invalid client secret is provided. Trace ID: 9748cd74-7a0a-4ac5-8802-b2072c0b0d00 Correlation ID: f6677275-43f3-4d73-a0d2-ec6187a5e26a Has anyone seen this issue before? We’re using Azure AD as our provider and use it successfully with other OIDC clients.

Thanks a tonne, I will wait for that. While I have you, one last question. If we can get this working, the next part will be to migrate an existing instance, where we were just using plain-old LDAP for auth. Is there a bulk approach to link existing users to an OIDC associated account? How would be go about making this a simple transition for existing users? We don’t want to lose all the content. Thoughts?

If the email addresses match, then accounts will be linked up automatically. If not, then you can use the rails console to migrate the associations - that would rely on the UIDs being the same for OpenID-connect as LDAP

Here we go: https://github.com/discourse/discourse-openid-connect/commit/94bba5f710febf1c511c7cbfc94bdb0c27cd0281 Enable the new openid connect verbose logging site setting, and you should see some useful information in your logs. For example: [49] The userinfo response line should show you whether the endpoint is returning an email address correctly

Fantastic! I’ll grabbed it and here is what I am seeing in the log as part of the userinfo response. [Selection_057]

Also note, the discovery document shows scopes_supported: - openid

So it looks like the userinfo endpoint does not include the email address. Maybe there is some configuration that can be done in Azure AD so that it provides the email? Is the email address included in the JWT?

[image]Discourse OpenID Connect (OIDC) Is the email address included in the JWT? [Selection_058]

Interestingly, we use the same configuration for other apps where Azure AD is the IDP and those applications seem to pull the email just fine. Admittedly, I don’t know all the details of those products and how they accomplish that.

Hmm… have you tried putting the email scope in both the openid_connect_authorize_scope setting AND the openid_connect_token_scope setting?

[image]Discourse OpenID Connect (OIDC) Hmm… have you tried putting the email scope in both the openid_connect_authorize_scope setting AND the openid_connect_token_scope setting? Yes, just tried ‘openid email profile’ in both. Same result. I also found this post, which may speak to the problem?

OpenID Connect issue with Azure AD

Product Support SSO

andy.czerwonka (Andy Czerwonka) January 4, 2019, 4:13pm 14

Topic		Replies	Views
Updated discourse-plugin-office365-auth due to bug? SSO	1	1354	October 24, 2020
Openid issues with Azure AD SSO	1	690	October 13, 2022
Using OpenID Connect with User Flows in Azure B2C SSO openid-connect	3	294	November 15, 2022
Not able to logged in using discourse-azure-ad auth plugin Product Support	1	950	January 23, 2019
User email address at account creation (through oAuth) incorrect Product Support	3	1343	September 19, 2017

OpenID Connect issue with Azure AD

Related topics