SSO with Azure Entra ID

[rbohyra]

Hi Folks,
I didn't find answer on my own, sorry if I missed such discussion.
Is there anyone from you who successfully setup SSO with Entra ID?
My config file is:
"oidc_providers":{
"azuread": {
"display_name": "Sign in with SSO",
"color": "blue",
"icon": "login",
"provider_url": "https://login.microsoftonline.com/*tenantID*/oauth2/v2.0/authorize",
"client_id": "",
"client_secret": "",
"redirect_url": "https://dns/api/auth/oidc/azuread/redirect", # tried diferent url`s here, /uri/callback/ w/oidc etc
"token_url": "https://login.microsoftonline.com/*tenantID*/oauth2/v2.0/token" # Actually I have tried without token too, that is my last config
}
},
As well I tried to play with scopes, with user mapping, claims - no luck.
From the web view I simply have option to login with SSO, but its refresh login screen, and after that I simply get 307 or 404.

[tboerger]

Here is a full configuration which is working fine for Entra ID/ Azure AD, it is possible that it also works with lesser URLs, but this way I have been able to properly authenticate:

        "azuread": {
            "icon": "microsoft",
            "display_name": "Sign in with EntraID",
            "client_id": "REDACTED",
            "client_secret": "REDACTED",
            "redirect_url": "http://localhost:3000/api/auth/oidc/azuread/redirect",
            "endpoint": {
                "issuer": "https://login.microsoftonline.com/*tenantid*/v2.0",
                "auth": "https://login.microsoftonline.com/*tenantid*/oauth2/v2.0/authorize",
                "token": "https://login.microsoftonline.com/*tenantid*/oauth2/v2.0/token",
                "userinfo": "https://graph.microsoft.com/oidc/userinfo",
                "jwks": "https://login.microsoftonline.com/*tenantid*/discovery/v2.0/keys"
            },
            "scopes": [
                "openid",
                "email",
                "profile",
                "User.Read"
            ]
        }

[fiftin]

Thanks a lot Thomas, I will add this to the docs.

[MarcoDomingosSyone]

Hi, did something changed? Even with this, I still get loop login

[m-soltani]

I have an issue regarding Entra ID Authentication, I have configured the app registration exactly as explained. The flow starts with asking my Entra ID credentials and but redirecting back to the semaphore UI, the docker container throws the following error:

AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token

Does your implementation re-use the authorization codes being issued? Or is this a symptom for another problem?

Thank you

[m-soltani]

I have an issue regarding Entra ID Authentication, I have configured the app registration exactly as explained. The flow starts with asking my Entra ID credentials and but redirecting back to the semaphore UI, the docker container throws the following error:

AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token

Does your implementation re-use the authorization codes being issued? Or is this a symptom for another problem?

Thank you

cookie_hash and cookie_encryption are necessary properties which should be present for authentication flow to works correctly. I was not aware of this fact. The issue has been resolved now.

[ydastous]

Hello, in my case, after following the config in the doc, when i try to sign-in, i am redirect to the login page, and in log application i have the message:
level=error msg="failed to verify signature: failed to verify id token signature",
Is there a way to have the JWT in the log for debugging ?

[ydastous]

Figured it out !

I need to specify the clientID in the jwks url no idea why) :
And when we put the endpoint stanza we need to remove the providerURL, my config look like:

        "azuread": {
            "icon": "microsoft",
            "display_name": "Sign in with EntraID",
            "client_id": "REDACTED",
            "client_secret": "REDACTED",
            "redirect_url": "http://localhost:3000/api/auth/oidc/azuread/redirect",
            "endpoint": {
                "issuer": "https://login.microsoftonline.com/*tenantid*/v2.0",
                "auth": "https://login.microsoftonline.com/*tenantid*/oauth2/v2.0/authorize",
                "token": "https://login.microsoftonline.com/*tenantid*/oauth2/v2.0/token",
                "userinfo": "https://graph.microsoft.com/oidc/userinfo",
                "jwks": "https://login.microsoftonline.com/*tenantid*/discovery/v2.0/keys?appId=*client_id*"
            }

[tboerger]

Sounds like the docs should get expanded

[lafayetteduarte]

For oidc settings, could be nice to query the well-known endpoint and retrieve this settings.
On azure ad this can be found at :

https://login.microsoftonline.com/{your_azure_active_directory_id}/.well-known/openid-configuration

@ydastous the reason your jwks URL contains the appid is bc you have some custom mapped claims . In that scenario, the signing keys are customised to your app alone.

You can read about this here:

https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens

And quoting from this doc :

"If the application has custom signing keys as a result of using the claims-mapping feature, append an appid query parameter that contains the application ID. For validation, use jwks_uri that points to the signing key information of the application. For example: https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration?appid=00001111-aaaa-2222-bbbb-"

Anyway, loading the values from the discovery document seems to be the best approach since this should be implemented by every identity provider that is oidc compliant.

I've seen some that dont have the discovery doc tho.

From all the approaches I've seen in this space, the cleanest uses the discovery document and allow you to specify the fields manually ( as the current semaphore allows ) .