How to setup OIDC with Azure AD?

[cmenzi]

We trying to setup dependency track with Azure AD. We encountered several issues during setup, where we found a workaround by some them.

1. Reply-Url with wildcards * is not supported by Azure AD
   1. We just added the following url: https://dependencytrack.example.com/static/oidc-callback.html?redirect=%2fdashboard. With this value the token gets passed to dependency track

So after successful receiving the token, we always get an Invalid username or password and Unauthorized (401).

What do we need configure on Azure AD and Dependency Track to make it work?

[nscuro]

Hi @cmenzi, could you provide the Dependency-Track and AzureAD configurations that you're using?

If you're getting a 401, DT wasn't able to access AzureAD's /userinfo endpoint with the access token acquired during login. You should see this in the DT server logs as well as in AzureAD's logs.

That being said, you'll find that team synchronization doesn't currently work with AzureAD / Microsoft Identity. This limitation has already been resolved though and will be available with Dependency-Track v4.3.0: #1008

[cmenzi]

Hi @Jessica-Arg

I've updated the template above. According to this, #1252, the ALPINE_OIDC_CLIENT_ID was missing. I also had trouble after I've upgraded to newer version.

[Jessica-Arg]

@cmenzi YES!! IT WORKS! thank you! I though I would never solve it haha

[valentijnscholten]

@cmenzi Thanks for sharing. Could you add you API permiions screenshot? I think that is missing. I am asking because I am still not seeing the SSO login button.

[daniel-anova]

Has someone managed to make group sync work or assign Teams based on AD group membership?

[valentijnscholten]

I was planning to look at that at some point, from what I have found it should be possible to have both AAD groups and on premise security groups added to the groups claim: https://docs.cribl.io/logstream/usecase-azure-ad/