Error getting auth URL due to untrusted authority

[ubukawa]

Hello. I followed your tutorial and tried to build a server. (my own APP_ID, APP_SECRET and AUTHRITY in .env)

When I started the server, once I logged in, it returned the Error getting auth URL as below.

(Strangely, if I start the server with sudo privilege, it works without error.)

I am not sure but it seems that the provided authoirty in .env is not regarded as a trusted authority.
If possible, please advise me how I can include this authority in the knownAuthorities config parameter?

Thank you for your kind attention!

[jasonjoh]

What value do you have for OAUTH_AUTHORITY?

[ubukawa]

Thank you jasonjoh for your response. I am establishing a server internally, but I am using the tenant ID provided by my colleague as below.
OAUTH_AUTHORITY={tenandID}

[jasonjoh]

Hmm. Are you sure the tenant ID is correct? I've never seen this error or had to do any configuration of "knownAuthorities", not sure where that setting is.

[ubukawa]

Thank you. I confirmed that the tenant ID is correct.
Now, I realized that my situation was a little tricky, compared with your tutorial.
As I needed to run the server as a non-root user, I made node.js to listen the port by setting the capabilities command (setcap).

Is it mandatory to run the server as a root user?

[jasonjoh]

It should not be mandatory to run the server as a privileged user, but I'm guessing you were setting the port to something other than the 3000 default? I believe that you do have to run as a privileged user to use the default HTTP/HTTPS ports on Linux.

[errorstudent]

I did not change the value of AUTHORITY same as documentation, but I also got the same issue.

[jasonjoh]

@errorstudent can you provide more information? What OS are you running on? Have you changed the default port?

AzureAD/microsoft-authentication-library-for-js#2600 seems relevant

[ubukawa]

Dear jasonjoh, Thank you for your advise.
Yes, I used the port 80 and 443 for web hosting.
With these ports, a simple hosting by nodejs/express worked well without sudo privilege by using setcap command.
But, I now think setcap would be not enough for using Azure AD authentication at such well know ports. Thank you!
(I somehow understood the situation. Please feel free to close this issue once you finished the discussion with other colleague. Thank you!)