Open sanzoghenzo opened 1 year ago
After examining the OpenID Connect scopes allowed by Microsoft, I tried to set the SCOPE
envvar to openid,email,profile
(groups
is not supported), but now I get the following (reformatted for readability):
time="2023-01-31T10:18:31Z"
level=warning
msg="failed to exchange token: oauth2: cannot fetch token: 400 Bad Request
Response: {
"error": "invalid_request",
"error_description": "AADSTS900144: The request body must contain the following parameter: 'code'.
Trace ID: cf14a3e4-4fe2-463b-9924-49a2a2668700
Correlation ID: f0772942-1940-474c-a47a-2525771124c2
Timestamp: 2023-01-31 10:18:30Z",
"error_codes":[900144],
"timestamp": "2023-01-31 10:18:30Z",
"trace_id": "cf14a3e4-4fe2-463b-9924-49a2a2668700",
"correlation_id": "f0772942-1940-474c-a47a-2525771124c2",
"error_uri": "https://login.microsoftonline.com/error?code=900144"
}
source_ip=95.251.233.238
I solved going back to thomseddon/traefik-forward-auth that has the right scopes by default.
I suppose that the SCOPE doesn't manage the user input as it should (I see that it is defined as a simple string, not as CommaSeparatedList
).
Hi, I'm trying to use this wonderful tool (thanks!) in my company development server.
I got to the point where I can login with Microsoft OIDC, but after a correct login I get a "Bad Gateway" page. The logs shows "missing ID token".
This is my docker compose (some of the envvars are there after a trial and error phase, not sure if I need them all):
Here's the full log (tenant, client id and domains are ok, I've obscured them):
I don't understand if it's a configuration problem, a traefik-forward-auth bug or a microsoft OIDC limitation. What am I missing here?
Thanks in advance for any help!