Get Azure Multitenant working?

[juergenroesch]

Hi,

when I change the OIDCProviderMetadataURL from https://login.microsoftonline.com/xxxxxx-xxxxx-xxxxxxx/.well-known/openid-configuration to https://login.microsoftonline.com/common/.well-known/openid-configuration, i get the following error:

oidc_proto_validate_jwt: requested issuer (https://sts.windows.net/{tenantid}/) does not match received "iss" value in id_token (https://sts.windows.net/xxxxx-xxxxx-xxxxxxxxx/), referer: https://login.microsoftonline.com/
oidc_proto_parse_idtoken: id_token payload could not be validated, aborting, referer: https://login.microsoftonline.com/

The idea behind is to allow authentication for all microsoft AD users.

Any ideas how to get that working?

[zandbelt]

You'll need to configure:

OIDCValidateIssuer Off

See: https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.14.2/auth_openidc.conf#L172-L175

[juergenroesch]

thanks, that helped. and since that Value was not working i found that in the debian repo is a very old and replaced that with that one from github.