SSO with azure AD from RC101 to 9.2.0 doesn't work anymore

[KZ-Millennium]

Hello, I updated directus from RC101 to 9.2.0 and it seems the sso with azure AD has some breaking changes.

I didn't find any information in release note.

Here is the original config (which worked in RC101)

AUTH_MICROSOFT_CLIENT_ID=CLIENTID
AUTH_MICROSOFT_CLIENT_SECRET=SECRET
AUTH_MICROSOFT_AUTHORIZE_URL=https://login.microsoftonline.com/TENANTID/oauth2/v2.0/authorize
AUTH_MICROSOFT_SCOPE=openid email
AUTH_PROVIDERS=microsoft
AUTH_MICROSOFT_DRIVER=oauth2
AUTH_MICROSOFT_ACCESS_URL=https://login.microsoftonline.com/TENANTID/oauth2/v2.0/token

I have tried adding some new fields but I keep getting "INVALID_USER"

AUTH_MICROSOFT_ALLOW_PUBLIC_REGISTRATION=false
AUTH_MICROSOFT_PROFILE_URL=https://graph.microsoft.com/oidc/userinfo
AUTH_DISABLE_DEFAULT=false
AUTH_MICROSOFT_CLIENT_ID=CLIENTID
AUTH_MICROSOFT_CLIENT_SECRET=SECRET
AUTH_MICROSOFT_AUTHORIZE_URL=https://login.microsoftonline.com/TENANTID/oauth2/v2.0/authorize
AUTH_MICROSOFT_ICON=microsoft
AUTH_MICROSOFT_EMAIL_KEY=email
AUTH_MICROSOFT_SCOPE=openid profile email
AUTH_PROVIDERS=microsoft
AUTH_MICROSOFT_DRIVER=oauth2
AUTH_MICROSOFT_ACCESS_URL=https://login.microsoftonline.com/TENANTID/oauth2/v2.0/token

Here is the config of one of the user in 9.2.0

Can you help me figuring out what I'm doing wrong ?

Thank you !

[benhaynes]

CC @aidenfoxx

[aidenfoxx]

This was caused by a sneaky change in the openid-client library which prevents using an OpenID provider in an OAuth2 configuration. It's good in the sense that it forces users into the more secure OpenID flow, but difficult to communicate well. The most minimal solution is that users don't specify "openid" in their scope when using the "oauth2" driver. The ideal solution is they just use the correct "openid" driver.

[aidenfoxx]

This is caused by a change in openid-client (panva/node-openid-client@92ffee5). It is no longer possible to use an OpenID provider in OAuth2 mode. There was a discussion about this here #11048

You simply need to update your config to use OpenID instead of OAuth2 (example here #10511) or remove openid from your scope.

[KZ-Millennium]

Works perfectly ! Thank you for the answer !

[biapar]

Could you post your config?

[KZ-Millennium]

sure:

AUTH_MICROSOFT_CLIENT_ID=CLIENT_ID
AUTH_MICROSOFT_CLIENT_SECRET=CLIENT_SECRET
AUTH_MICROSOFT_DRIVER=openid
AUTH_MICROSOFT_EMAIL_KEY=email
AUTH_MICROSOFT_IDENTIFIER_KEY=email
AUTH_MICROSOFT_ISSUER_URL=https://login.microsoftonline.com/TENANT_ID/v2.0/.well-known/openid-configuration
AUTH_MICROSOFT_SCOPE=openid email
AUTH_PROVIDERS=microsoft