# בעיה ב-OpenID Connect עם Azure AD
**URL:** https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706
**Category:** SSO
**Created:** [3 בינואר, 2019, 2:11pm UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706 "2019-01-03T14:11:01Z")
**Posts on this page:** 7
**Page:** 2
### Author:  [@andy.czerwonka](https://meta.discourse.org/u/andy.czerwonka)
#### Post date: [4 בינואר, 2019, 5:13pm UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706/21 "2019-01-04T17:13:51Z")
> [@Discourse OpenID Connect (OIDC)](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632/28):
>
> Out of interest, are any of the other tools you have connected to AD open-source? It would be interesting to look at their implementations.
Yes, we are using [KeyCloak](https://github.com/keycloak/keycloak) and use Azure AD for federation in behind it. It’s correctly bootstrapping the email, so it must do some kind of mapping just like the one you mention.
---
### Author:  [@andy.czerwonka](https://meta.discourse.org/u/andy.czerwonka)
#### Post date: [4 בינואר, 2019, 5:56pm UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706/22 "2019-01-04T17:56:17Z")
> [@Discourse OpenID Connect (OIDC)](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632/28):
>
> Possibly… the (admittedly small) risk would be if another provider decided to use the claim `upn` for something else (it is not mentioned in the openid-connect specification at all).
We have a fix. We were using the v1.0 version of the endpoint. When we switch to the v2.0, it works and we get the email just fine. Thanks for all your help @david, talking it through helps us triage the issue.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [4 בינואר, 2019, 5:58pm UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706/23 "2019-01-04T17:58:14Z")
Glad to hear it!
Would you be able to describe how to tell whether you’re using v1 or v2 in the azure portal? Then we can add a note to the instructions above so it doesn’t catch anyone else!
---
### Author:  [@andy.czerwonka](https://meta.discourse.org/u/andy.czerwonka)
#### Post date: [4 בינואר, 2019, 6:00pm UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706/24 "2019-01-04T18:00:09Z")
> [@Discourse OpenID Connect (OIDC)](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632/31):
>
> Would you be able to describe how to tell whether you’re using v1 or v2 in the azure portal?
Yep, adding /v2.0/ to the metadata document url.
[https://login.microsoftonline.com/replace-with-tenant-id/v2.0/.well-known/openid-configuration](https://login.microsoftonline.com/replace-with-tenant-id/v2.0/.well-known/openid-configuration)
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [4 בינואר, 2019, 6:03pm UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706/25 "2019-01-04T18:03:12Z")
Perfect, thanks. I’ve added a note to the OP
---
### Author:  [@pacharanero](https://meta.discourse.org/u/pacharanero)
#### Post date: [23 באפריל, 2020, 10:16am UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706/27 "2020-04-23T10:16:20Z")
Hi, I am getting a very similar issue to the OP here. I’m authenticating against [NHS.net](http://NHS.net), which under the hood is Active Directory and probably provided by Azure. I’m using the OIDC plugin and getting the following error:
`(oidc) Authentication failure! invalid_credentials: OAuth2::Error,`
(the error ends with a comma, and no further data, unlike the OP’s error though)
I’ve tried changing the settings of the authorization and token scope to `openid email profile` (and these are supported on the OIDC endpoint according to the configuration URL data)
Still getting that same error in the UI ‘Sorry, there was an error authorizing your account. Please try again.’
I’m not getting any data back from the JWT it seems. So it’s not quite the same as the ‘missing email field’ issue, but it started with the same error. The only other place on Meta I can find that error (that seems relevant) is [SSL Error during OAuth2](https://meta.discourse.org/t/ssl-error-during-oauth2/135257) That turned out to be related to an SSL issue (and interestingly [NHS.net](http://NHS.net)’s cert does have that issue, which I have reported). But having installed the SSL workaround, the Faraday SSL errors went away. But it does still look as though some part of the OpenID Connect flow is broken still.
Any suggestions on next steps for debugging this?
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [4 ביוני, 2024, 1:41am UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706/28 "2024-06-04T01:41:00Z")
[Previous page](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706.md?page=1)