OpenID Connect issue with Azure AD

[andy.czerwonka]

@david

Out of interest, are any of the other tools you have connected to AD open-source? It would be interesting to look at their implementations.

Yes, we are using KeyCloak and use Azure AD for federation in behind it. It’s correctly bootstrapping the email, so it must do some kind of mapping just like the one you mention.

[andy.czerwonka]

@david

Possibly… the (admittedly small) risk would be if another provider decided to use the claim upn for something else (it is not mentioned in the openid-connect specification at all).

We have a fix. We were using the v1.0 version of the endpoint. When we switch to the v2.0, it works and we get the email just fine. Thanks for all your help @david, talking it through helps us triage the issue.

[david (David Taylor)]

Glad to hear it!

Would you be able to describe how to tell whether you’re using v1 or v2 in the azure portal? Then we can add a note to the instructions above so it doesn’t catch anyone else!

[andy.czerwonka]

@david

Would you be able to describe how to tell whether you’re using v1 or v2 in the azure portal?

Yep, adding /v2.0/ to the metadata document url.

https://login.microsoftonline.com/replace-with-tenant-id/v2.0/.well-known/openid-configuration

[david (David Taylor)]

Perfect, thanks. I’ve added a note to the OP

[pacharanero (Marcus Baw)]

Hi, I am getting a very similar issue to the OP here. I’m authenticating against NHS.net, which under the hood is Active Directory and probably provided by Azure. I’m using the OIDC plugin and getting the following error:

(oidc) Authentication failure! invalid_credentials: OAuth2::Error,
(the error ends with a comma, and no further data, unlike the OP’s error though)

I’ve tried changing the settings of the authorization and token scope to openid email profile (and these are supported on the OIDC endpoint according to the configuration URL data)

Still getting that same error in the UI ‘Sorry, there was an error authorizing your account. Please try again.’

I’m not getting any data back from the JWT it seems. So it’s not quite the same as the ‘missing email field’ issue, but it started with the same error. The only other place on Meta I can find that error (that seems relevant) is SSL Error during OAuth2 That turned out to be related to an SSL issue (and interestingly NHS.net’s cert does have that issue, which I have reported). But having installed the SSL workaround, the Faraday SSL errors went away. But it does still look as though some part of the OpenID Connect flow is broken still.

Any suggestions on next steps for debugging this?