Redirect URL provided by pangolin has been added to "web" platform configuration with "ID tokens (used for implicit and hybrid flows)" as the selection.
Token Configuration has been left at the default.
I manually provisioned the user in pangolin with "username" being their UPN (which is the same as their email)
When they attempt to sign in, they do get to the point where they have to use Microsoft Authenticator, but upon returning to pangolin, they get the error in the attached screenshot:
Playing with a variety of settings (forgive me, I forget the exact configuration, I tried everything I could think of so I don't remember the exact combination) also yielded this error:
Not sure if this is a bug or if I am doing something completely wrong. Any help would be appreciated.
Originally created by @nightchrono on GitHub (May 5, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/679
Attempting to add Entra as my identity provider. I have the following configuration:
The correct Client ID provided by the App Registration in Entra
Secret provided by the "Client Credentials" section of App Registration
Authorization URL: https://login.microsoftonline.com/MYTENANT/oauth2/v2.0/authorize
Token URL: https://login.microsoftonline.com/MYTENANT/oauth2/v2.0/token
Redirect URL provided by pangolin has been added to "web" platform configuration with "ID tokens (used for implicit and hybrid flows)" as the selection.
Token Configuration has been left at the default.
I manually provisioned the user in pangolin with "username" being their UPN (which is the same as their email)
When they attempt to sign in, they do get to the point where they have to use Microsoft Authenticator, but upon returning to pangolin, they get the error in the attached screenshot:
Playing with a variety of settings (forgive me, I forget the exact configuration, I tried everything I could think of so I don't remember the exact combination) also yielded this error:
Not sure if this is a bug or if I am doing something completely wrong. Any help would be appreciated.
Sorry, one detail I forgot to note. The user in question only has an Exchange Online plan 1 license. I don't know if that is the issue here. They are able to use other SSO apps I have configured.
<!-- gh-comment-id:2851575349 -->
@nightchrono commented on GitHub (May 5, 2025):
Sorry, one detail I forgot to note. The user in question only has an Exchange Online plan 1 license. I don't know if that is the issue here. They are able to use other SSO apps I have configured.
If you're getting the user not provisioned error this means that oauth was successful it's just that Pangolin couldn't match the user ID extracted from the claims token to the username you set when you provisioned the user. For example if the user identifier path is set to email (instead of sub) then the username in the provisioned user should be the users email. There seems to be a decent list of claims for entra here: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
Also, we plan to log to the debug logs the full token so it's easier to debug when setting this up for the first time.
<!-- gh-comment-id:2852496553 -->
@miloschwartz commented on GitHub (May 5, 2025):
If you're getting the user not provisioned error this means that oauth was successful it's just that Pangolin couldn't match the user ID extracted from the claims token to the username you set when you provisioned the user. For example if the user identifier path is set to `email` (instead of sub) then the username in the provisioned user should be the users email. There seems to be a decent list of claims for entra here: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
Also, we plan to log to the debug logs the full token so it's easier to debug when setting this up for the first time.
Thanks. My user and I have mismatched schedules so I will attempt some changes based on that article when his and my schedules line up again.
<!-- gh-comment-id:2860623982 -->
@nightchrono commented on GitHub (May 7, 2025):
Thanks. My user and I have mismatched schedules so I will attempt some changes based on that article when his and my schedules line up again.
Just for anyone who wanders here with the same issue, I was able to fix it using the following settings:
<!-- gh-comment-id:2869178685 -->
@nightchrono commented on GitHub (May 10, 2025):
Just for anyone who wanders here with the same issue, I was able to fix it using the following settings:
@github-actions[bot] commented on GitHub (May 25, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:2907524029 -->
@github-actions[bot] commented on GitHub (May 25, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Jun 8, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
<!-- gh-comment-id:2953296381 -->
@github-actions[bot] commented on GitHub (Jun 8, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @nightchrono on GitHub (May 5, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/679
Attempting to add Entra as my identity provider. I have the following configuration:
The correct Client ID provided by the App Registration in Entra
Secret provided by the "Client Credentials" section of App Registration
Authorization URL: https://login.microsoftonline.com/MYTENANT/oauth2/v2.0/authorize
Token URL: https://login.microsoftonline.com/MYTENANT/oauth2/v2.0/token
Redirect URL provided by pangolin has been added to "web" platform configuration with "ID tokens (used for implicit and hybrid flows)" as the selection.
Token Configuration has been left at the default.
I manually provisioned the user in pangolin with "username" being their UPN (which is the same as their email)
When they attempt to sign in, they do get to the point where they have to use Microsoft Authenticator, but upon returning to pangolin, they get the error in the attached screenshot:
Playing with a variety of settings (forgive me, I forget the exact configuration, I tried everything I could think of so I don't remember the exact combination) also yielded this error:
Not sure if this is a bug or if I am doing something completely wrong. Any help would be appreciated.
@nightchrono commented on GitHub (May 5, 2025):
Sorry, one detail I forgot to note. The user in question only has an Exchange Online plan 1 license. I don't know if that is the issue here. They are able to use other SSO apps I have configured.
@miloschwartz commented on GitHub (May 5, 2025):
If you're getting the user not provisioned error this means that oauth was successful it's just that Pangolin couldn't match the user ID extracted from the claims token to the username you set when you provisioned the user. For example if the user identifier path is set to
email(instead of sub) then the username in the provisioned user should be the users email. There seems to be a decent list of claims for entra here: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-referenceAlso, we plan to log to the debug logs the full token so it's easier to debug when setting this up for the first time.
@nightchrono commented on GitHub (May 7, 2025):
Thanks. My user and I have mismatched schedules so I will attempt some changes based on that article when his and my schedules line up again.
@nightchrono commented on GitHub (May 10, 2025):
Just for anyone who wanders here with the same issue, I was able to fix it using the following settings:
@github-actions[bot] commented on GitHub (May 25, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Jun 8, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.