OpenID authentication via Azure fails

If your web portal uses an application server connection, you should find the log messages in the AppServer logs.

In regards to the error, the only thing I can think of is to check the settings in Azure AD to see if Azure AD is configured to not send the ID token in the implicit grant flow.

Hi Markus,

I also checked inside the application server logs inside this folder C:\inetpub\wwwroot\AppServer\App_Data\Logs but there are no new logs generated regarding the openID sign-in trial.

Should I check in another folder or enable an additional logging mode?

Moreover, the azure AD is configured to send an ID token as expected for the implicit and hybrid flows.

My settings which work but I am not using 2fa, I will set that on my Azure tenant and test.

In Azure:

Redirect URI: servername.domain.com/.../page.axd

The two check boxes under Implicit grant and hybrid flows are unchecked

In Designer under Base Data\Security settings\OAuth 2.0/OpenID Connect configuration\Identity providers:

Under the Applications tab

Redirect URI: https://servername.domain.com/identitymanager/

Authentication method: client_secret_basic

Under Base Data\Security settings\Web server configurations\WebDesigner

Primary auth OAuth 2.0/OpenID Connect (role-based)

OAuth 2.0/OpenID Connect application: my application that I configured from Base Data\Security settings\OAuth 2.0/OpenID Connect configuration\Identity providers Applications tab

The above settings work for me.

I setup 2FA for one test user by using the Microsoft Authenticator application. Confirmed that I can log in to my Identity Manager web designer portal with this enabled as well.

Hi Troy,

These is exactly my configuration as well.

I am afraid the issue is on IDP level and not on OneIM level.
Do you have any other specifics for the IDP configuration, like mandatory configuration needed otherwise it does not work?

sorry that should be:

In Azure:

Redirect URI: servername.domain.com/.../page.axd

No I do not have any mandatory configuration set in the IDP or anywhere else.

No problem, I've already use that one.

Markus, at this point how are we supposed to move forward?
Should I contact the support team or is not going to help?
Thing is, from project side there is limited Azure expertise therefore it is not possible yet to at least find out where the root cause resides.

All I can say is, that I cannot help any further here in the community. I suggest contacting support, mentioning this threat and seeing if they can help you.

Thanks a lot for your help so far.
If a solution is found, I will mention it here.

Seems like the solution here is what Markus mentioned in the first place about the httpCookies value change to Lax.

But, supplementary action was to remove redundant text from some fields when configuring the identity provider in designer.

Reason is, I tried to populate the values for the identity provider in designer manually at the beginning, meaning not using the wizard.

Then, as a colleague suggested, we used the wizard in order to auto-populate the values on endpoints, Issuer, JSON web key etc. because that could fix the issue as I could have made an error when I populated manually the fields.

After that, some field values contained redundant invalid characters like %, random text etc. which did not notice at that point as I thought the wizard did its job.

Afterwards, Markus pointed me to update the httpCookies value.

I should had checked the values once more in Designer before trying again after I updated the web.config file.

As the wizard which provided those extra redundant characters and caused the error to persist instead of been solved after Markus' suggestion.

Anyway, long story and long day but case solved. Thanks everybody!

Seems like the solution here is what Markus mentioned in the first place about the httpCookies value change to Lax.

But, supplementary action was to remove redundant text from some fields when configuring the identity provider in designer.

Reason is, I tried to populate the values for the identity provider in designer manually at the beginning, meaning not using the wizard.

Then, as a colleague suggested, we used the wizard in order to auto-populate the values on endpoints, Issuer, JSON web key etc. because that could fix the issue as I could have made an error when I populated manually the fields.

After that, some field values contained redundant invalid characters like %, random text etc. which did not notice at that point as I thought the wizard did its job.

Afterwards, Markus pointed me to update the httpCookies value.

I should had checked the values once more in Designer before trying again after I updated the web.config file.

As the wizard which provided those extra redundant characters and caused the error to persist instead of been solved after Markus' suggestion.

Anyway, long story and long day but case solved. Thanks everybody!