Authentication via Azure AD OAuth failing with the error "Authentication failed: Could not determine id."

[nusol-sc]

I followed the instructions in the documentation for setting up Azure AD OAuth. However, I cannot save changes to either the Authorization URL or the Access Token URL. I can change them, and I receive a message saying "Successfully updated source", but neither URL is changed from the default. Because we are using a single tenant, I need to replace "common" with the tenant ID. Presumably this will not work until I can get those URLs updated.

I recreated the Azure AD source 4 times to no avail. As an aside, I was successful in configuring OAuth for Google, so I can log in via local auth and Google.

Does anyone have any suggestions?

[nusol-sc]

Update: I have it working but only after manually updating the authorization_url, access_token_url, and profile_url directly in the database.

When creating the OAuth source the default URLs are as follows:

• https://login.microsoftonline.com/common/oauth2/v2.0/authorize
• https://login.microsoftonline.com/common/oauth2/v2.0/token
• https://graph.microsoft.com/v1.0/me

I modified the authorization and access token URLs as follows, but didn't change the profile URL:

• https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/authorize
• https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token

After saving, the URLs are:

• https://login.microsoftonline.com/common/oauth2/authorize
• https://login.microsoftonline.com/common/oauth2/token
• https://login.microsoftonline.com/common/openid/userinfo

Note that Authentik changed the profile URL.

I then modified the appropriate row in the authentik_sources_oauth_oauthsource to set the URLs, including reverting the profile URL to the default value. Authentication now works. Huzzah!

Interestingly, when viewing the source details in Authentik, the URLs show the default values, but if you edit the source the current values display. If you make ANY changes, the URLs are overwritten as follows:

• https://login.microsoftonline.com/common/oauth2/authorize
• https://login.microsoftonline.com/common/oauth2/token
• https://login.microsoftonline.com/common/openid/userinfo

So the authorization and access token URLs are reverted to their default values. At this point authentication no longer works and I need to update the row in the database again.

Am I doing something boneheaded or might this be a bug?

[nusol-sc]

It looks like a bug

[ivugrinec]

I have met the same issue. Is there a way to update docker containers to a fixed version?

[l4rm4nd]

I can confirm the issue.

The bug occurs when using the latest Authentik image tag latest or 2023.10.4. As a workaround, you can use an older image tag like 2023.8.4 and it magically works again.

The issue seems to be that the authorization_url, access_token_url, and profile_url are not correctly saved by Authentik into the underlying database. There are no error logs though. However, you can kind of notice this when editing your OAuth Source at Federation and Social Logins . When you click edit again, after setting up the OAuth source, you will notice that it fallbacks to common and does not hold your IDs. It is not possible to save those via the frontend. As @nusol-sc outlined, you'd have to write into the database directly.

Note: The frontend will always show https://login.microsoftonline.com/common/oauth2/v2.0/authorize as Authorization URL and https://login.microsoftonline.com/common/oauth2/v2.0/token as Token URL at /if/admin/#/core/sources/<SOURCE-NAME>;%7B"page"%3A"page-overview"%7D. This should be fixed too by the developers of Authentik. Just ensure to click the Edit button and confirm that your secrets and IDs are correctly stored.

Let's track this bug here: #7744