Open ID OIDC and Microsoft Entra ID

[seanrallSRS]

Postal Version 3.3.4
Running in docker on Ubuntu server

I have been trying to setup postal with microsoft enta ID and i keep getting the following "An issue occurred while logging you in with OpenID. Please try again later or contact your administrator."

looking at the Web logs i see this

162.228.165.60 - - [13/Sep/2024:23:13:30 +0000] "GET /login?return_to=%2F HTTP/1.1" 200 - 0.0204
D, [2024-09-13T23:13:33.266188 #9] DEBUG -- omniauth: (oidc) Request phase initiated.
E, [2024-09-13T23:13:33.682149 #9] ERROR -- omniauth: (oidc) Authentication failure! Not Found: OpenIDConnect::Discovery::DiscoveryFailed, Not Found
2024-09-13 23:13:33 +0000 INFO   POST /auth/oidc (302) event=request transaction=[REDACTED ID] controller=SessionsController action=oauth_failure format=html method=POST path=/auth/oidc request_id=[REDACTED] ip_address=[REDACTED] status=302 db_runtime=0
[REDACTED] - - [13/Sep/2024:23:13:33 +0000] "POST /auth/oidc HTTP/1.1" 302 - 0.4389
2024-09-13 23:13:33 +0000 INFO   GET /login (200) event=request transaction=[REDACTED] controller=SessionsController action=new format=html method=GET path=/login request_id=[REDACTED] ip_address=[REDACTED] status=200 view_runtime=2.114499919116497 db_runtime=0
[REDACTED] - - [13/Sep/2024:23:13:33 +0000] "GET /login HTTP/1.1" 200 - 0.0059

My config is as follows (Only showing the ODIC parts) :

oidc:
  # Start by enabling OIDC for your installation.
  enabled: true

  # The name of the OIDC provider as shown in the UI. For example:
  # "Login with My Proivder".
  name: Microsoft

  # The OIDC issuer URL provided to you by your Identity provider.
  # The provider must support OIDC Discovery by hosting their configuration
  # at https://identity.example.com/.well-known/openid-configuration.
  issuer: https://login.microsoftonline.com/[REDACTED]/v2.0/.well-known/openid-configuration

  # The client ID for OIDC
  identifier: [REDACTED]

  # The client secret for OIDC
  secret: [REDACTED]

  # Scopes to request from the OIDC server. You'll need to find these from your
  # provider. You should ensure you request enough scopes to ensure the user's
  # email address is returned from the provider.
  scopes: [openid, email]

In the entra ID portal for this Application registration added the email claim as well

Not sure what the issue could be at this point? any help or direction pointing to look at would be greatly appreciated.

[willpower232]

Interesting, have you double checked that https://login.microsoftonline.com/[REDACTED]/v2.0/.well-known/openid-configuration is publicly available?

[seanrallSRS]

It is publicly available, I can DM the full link if that helps you see anything more.

This is what it returns hitting that url:

{
  "token_endpoint": "https://login.microsoftonline.com/[REDACTED]/oauth2/v2.0/token",
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "private_key_jwt",
    "client_secret_basic"
  ],
  "jwks_uri": "https://login.microsoftonline.com/[REDACTED]/discovery/v2.0/keys",
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post"
  ],
  "subject_types_supported": [
    "pairwise"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "response_types_supported": [
    "code",
    "id_token",
    "code id_token",
    "id_token token"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ],
  "issuer": "https://login.microsoftonline.com/[REDACTED]/v2.0",
  "request_uri_parameter_supported": false,
  "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo",
  "authorization_endpoint": "https://login.microsoftonline.com/[REDACTED]/oauth2/v2.0/authorize",
  "device_authorization_endpoint": "https://login.microsoftonline.com/[REDACTED]/oauth2/v2.0/devicecode",
  "http_logout_supported": true,
  "frontchannel_logout_supported": true,
  "end_session_endpoint": "https://login.microsoftonline.com/[REDACTED]/oauth2/v2.0/logout",
  "claims_supported": [
    "sub",
    "iss",
    "cloud_instance_name",
    "cloud_instance_host_name",
    "cloud_graph_host_name",
    "msgraph_host",
    "aud",
    "exp",
    "iat",
    "auth_time",
    "acr",
    "nonce",
    "preferred_username",
    "name",
    "tid",
    "ver",
    "at_hash",
    "c_hash",
    "email"
  ],
  "kerberos_endpoint": "https://login.microsoftonline.com/[REDACTED]/kerberos",
  "tenant_region_scope": "NA",
  "cloud_instance_name": "microsoftonline.com",
  "cloud_graph_host_name": "graph.windows.net",
  "msgraph_host": "graph.microsoft.com",
  "rbac_url": "https://pas.windows.net"
} 

[willpower232]

Hmm I don't really know else that error could mean unless there is something preventing the server itself from getting there, you could try curl or wget from the server running Postal to confirm it sees the same contents.

[seanrallSRS]

Same content when running curl command on the box. I'll keep poking around and update here if i make any progress as it definitely seems like its a valid payload to me.
Thanks

[seanrallSRS]

For anyone having this same issue i finally figured it out. My issue was i put in the whole URL for the issuer where i only needed the first part and not .well-known/openid-configuration

Also for the sake of helping the next soul here are my steps based on this https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc

1. Sign in to the Microsoft Entra admin center.
2. Make a new App Under Applications > App Registrations
3. Browse to Identity > Applications > App registrations > > Authentication.
4. Under Platform configurations, select Add a platform.
5. In the pane that opens, select the appropriate platform for your application. select Web for a web application.
6. Under Redirect URIs, add the redirect URI of your application. For example, https://YOURPOSTALURL/auth/oidc/callback.
7. Under Implicit grant and hybrid flows, select the ID tokens (used for implicit and hybrid flows) checkbox.
   
8. Under Certificates and Secrets make a new Client Secret (this is your secret)
9. Under Token Configuration add an option claim of email
   
10. Go to API Permissions and add Microsoft Graph > email, openid, and User.Read
    

On the Overview the Application (clinet) ID is your identifier and Directory (tennant) ID is your tennant in the issuer URL
So for me my config looks like this

  # Start by enabling OIDC for your installation.
  enabled: true

  # The name of the OIDC provider as shown in the UI. For example:
  # "Login with My Proivder".
  name: Microsoft

  # The OIDC issuer URL provided to you by your Identity provider.
  # The provider must support OIDC Discovery by hosting their configuration
  # at https://identity.example.com/.well-known/openid-configuration.
  issuer: https://login.microsoftonline.com/[TENNANT]/v2.0

  # The client ID for OIDC
  identifier: [APPLICATION CLIENT ID]

  # The client secret for OIDC
  secret: [SECRET]

  # Scopes to request from the OIDC server. You'll need to find these from your
  # provider. You should ensure you request enough scopes to ensure the user's
  # email address is returned from the provider.
  scopes: [openid, email]