OpenIdConnect to Microsoft v2 endpoint #1660

New Issue

2025-11-02T04:08:45-06:00

GiteaMirror commented

2025-11-02 04:08:45 -06:00

Originally created by @cblomart on GitHub (Mar 28, 2018).

Gitea version (or commit ref):
Git version:
Operating system:
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

I try to integrate Microsoft authentication via OpenidConnect:
https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration

Application is registerd trought:
https://apps.dev.microsoft.com/

I am redirected to microsoft authentication and can authenticate but when redirected to the callback i get an error 500.
The logs shows:
2018/03/28 18:59:20 [...routers/user/auth.go:407 handleOAuth2SignIn()] [E] UserSignIn: Invalid token received from provider

From the looks of it the error comes from:
https://github.com/golang/oauth2/blob/master/token.go#L131

I couldn't find where to debug further to know if either:

token is null
no access token
token expired (did check time on the gitea host)

Is there a way to see the token response (so i can check content of access token as well as id token)?

Originally created by @cblomart on GitHub (Mar 28, 2018).  - Gitea version (or commit ref): - Git version: - Operating system: - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description I try to integrate Microsoft authentication via OpenidConnect: https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration Application is registerd trought: https://apps.dev.microsoft.com/ I am redirected to microsoft authentication and can authenticate but when redirected to the callback i get an error 500. The logs shows: 2018/03/28 18:59:20 [...routers/user/auth.go:407 handleOAuth2SignIn()] [E] UserSignIn: Invalid token received from provider From the looks of it the error comes from: https://github.com/golang/oauth2/blob/master/token.go#L131 I couldn't find where to debug further to know if either: - token is null - no access token - token expired (did check time on the gitea host) Is there a way to see the token response (so i can check content of access token as well as id token)?

GiteaMirror added the issue/stale type/bug labels 2025-11-02 04:08:45 -06:00

GiteaMirror closed this issue

2025-11-02 04:08:45 -06:00

GiteaMirror commented

2025-11-02 04:08:45 -06:00

@cblomart commented on GitHub (Apr 6, 2018):

Hello,

Just to know if anyone has a pointer on how to see the returned token (if there is one)?

Cédric

@cblomart commented on GitHub (Apr 6, 2018): Hello, Just to know if anyone has a pointer on how to see the returned token (if there is one)? Cédric

GiteaMirror commented

2025-11-02 04:08:46 -06:00

@tvvignesh commented on GitHub (Dec 19, 2018):

@cblomart I have the same problem. Were you able to find any solution to this?

@tvvignesh commented on GitHub (Dec 19, 2018): @cblomart I have the same problem. Were you able to find any solution to this?

GiteaMirror commented

2025-11-02 04:08:46 -06:00

@stale[bot] commented on GitHub (Feb 17, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Feb 17, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 04:08:46 -06:00

@techknowlogick commented on GitHub (Feb 17, 2019):

Closing as the oauth dep has been upgraded

@techknowlogick commented on GitHub (Feb 17, 2019): Closing as the oauth dep has been upgraded

GiteaMirror commented

2025-11-02 04:08:47 -06:00

@cblomart commented on GitHub (Feb 17, 2019):

Still have the issue... on latest commit:

[Macaron] 2019-02-17 21:59:48: Started GET /user/oauth2/Microsoft for [ho an ip address],
[Macaron] 2019-02-17 21:59:48: Completed GET /user/oauth2/Microsoft 307 Temporary Redirect in 48.353628ms,
[Macaron] 2019-02-17 21:59:57: Started GET /user/oauth2/Microsoft/callback?code=[not at all intersting code from azure ad]&state=973f8575-6990-4cc4-a630-442356a6c05b&session_state=8d6cec08-cd3a-45a6-a21a-4e56fa07b834 for [ho an ip address],
[Macaron] 2019-02-17 21:59:58: Completed GET /user/oauth2/Microsoft/callback?code=[not at all intersting code from azure ad]&state=973f8575-6990-4cc4-a630-442356a6c05b&session_state=8d6cec08-cd3a-45a6-a21a-4e56fa07b834 500 Internal Server Error in 431.195252ms,
[Macaron] 2019-02-17 21:59:58: Started GET /img/500.png for [ho an ip address],
[Macaron] [Static] Serving /img/500.png,
[Macaron] 2019-02-17 21:59:58: Completed GET /img/500.png 200 OK in 1.3557ms,
[Macaron] 2019-02-17 21:59:58: Started GET /serviceworker.js for [ho an ip address],
[Macaron] 2019-02-17 21:59:58: Completed GET /serviceworker.js 200 OK in 10.868038ms,

@cblomart commented on GitHub (Feb 17, 2019): Still have the issue... on latest commit: [Macaron] 2019-02-17 21:59:48: Started GET /user/oauth2/Microsoft for [ho an ip address], [Macaron] 2019-02-17 21:59:48: Completed GET /user/oauth2/Microsoft 307 Temporary Redirect in 48.353628ms, [Macaron] 2019-02-17 21:59:57: Started GET /user/oauth2/Microsoft/callback?code=[not at all intersting code from azure ad]&state=973f8575-6990-4cc4-a630-442356a6c05b&session_state=8d6cec08-cd3a-45a6-a21a-4e56fa07b834 for [ho an ip address], [Macaron] 2019-02-17 21:59:58: Completed GET /user/oauth2/Microsoft/callback?code=[not at all intersting code from azure ad]&state=973f8575-6990-4cc4-a630-442356a6c05b&session_state=8d6cec08-cd3a-45a6-a21a-4e56fa07b834 500 Internal Server Error in 431.195252ms, [Macaron] 2019-02-17 21:59:58: Started GET /img/500.png for [ho an ip address], [Macaron] [Static] Serving /img/500.png, [Macaron] 2019-02-17 21:59:58: Completed GET /img/500.png 200 OK in 1.3557ms, [Macaron] 2019-02-17 21:59:58: Started GET /serviceworker.js for [ho an ip address], [Macaron] 2019-02-17 21:59:58: Completed GET /serviceworker.js 200 OK in 10.868038ms,

GiteaMirror commented

2025-11-02 04:08:47 -06:00

@cblomart commented on GitHub (Feb 17, 2019):

Forunaltely logs gave a bit more information...
2019/02/17 22:09:07 [...routers/user/auth.go:548 handleOAuth2SignIn()] [E] UserSignIn: oauth2: error validating JWT token: issuer in token does not match issuer in OpenIDConfig discovery

@cblomart commented on GitHub (Feb 17, 2019): Forunaltely logs gave a bit more information... 2019/02/17 22:09:07 [...routers/user/auth.go:548 handleOAuth2SignIn()] [E] UserSignIn: oauth2: error validating JWT token: issuer in token does not match issuer in OpenIDConfig discovery

GiteaMirror commented

2025-11-02 04:08:47 -06:00

@cblomart commented on GitHub (Feb 17, 2019):

The openidconnect url for the "common" endpoint is
https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration

It allows to authentify any azure ad account (multi tenant)...but unfortunatly the issuer provided in the discovery is "https://login.microsoftonline.com/{tenantid}/v2.0".

The "tenantid" here should be the tenant of the user ... so gitea cannot work multitenant.

i replaced the "common" part of the discovery with the tennant id and it goes further!

@cblomart commented on GitHub (Feb 17, 2019): The openidconnect url for the "common" endpoint is https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration It allows to authentify any azure ad account (multi tenant)...but unfortunatly the issuer provided in the discovery is "https://login.microsoftonline.com/{tenantid}/v2.0". The "tenantid" here should be the tenant of the user ... so gitea cannot work multitenant. i replaced the "common" part of the discovery with the tennant id and it goes further!

GiteaMirror referenced this issue

2025-11-02 11:59:27 -06:00

[PR #1660] [MERGED] Fix CSS for code in wiki markdown #15979

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#1660