Portainer CE with OAuth2 using Azure AD - authentication

Question

I would like to ask how to properly setup the authentication for Portainer CE v2.9.3 using OAuth2 with Azure AD.
The following fields in the Custom OAuth2 UI needs to be filled:
Client ID
Client secret
Authorization URL
Access token URL
Resource URL
Redirect URL
Logout URL
User identifier
Scopes
Currently, I use the following values:
Client ID: <tentant id>
Client secret: <created secret for the app in Azure AD>
Authorization URL: https://login.microsoftonline.com/``/oauth2/v2.0/authorize
Access token URL: https://login.microsoftonline.com/``/oauth2/v2.0/token
Resource URL: https://graph.microsoft.com/oidc/userinfo
Redirect URL: <our internal URL for the Portainer deployment>
Logout URL: <our internal URL for the Portainer deployment>
User identifier: email
Scopes: <Application ID URI>
When using these values, I get the following error:
{
"error": {
"code": "InvalidAuthenticationToken",
"message": "Access token validation failure. Invalid audience.",
"innerError": {
"date": <some date>,
"request-id": <some request id>,
"client-request-id": <some client request id>
}
}
}
I need to use Portainer CE with the Customer OAuth Provider.
Thank you for any usefull advice.

Answer 1

Possible causes of Audience invalid error and workarounds
Client ID must be either the ApplicationId or ApplicationIdUri
depending on the app configuration.(not tenant Id)
Note :first try clientId:<Application Id> and if that is giving the
same error , change clientId to ApplicationIdUri i.e; clientId:api://<Application Id>
Scope is something that you see under add a scope blade .
When you click on add a scope ,you can mention any permission and it appears as a scope like below:
This scope must be in scopes value
Make sure to grant admin consent if required if app registration has permissions.
Example:
Another is the end point from which you are getting the token maybe different . Try to decode access token in https://jwt.io and see “ISS” value has v2 endpoint .If it has V2 endpoint,
in azure Active directory, Go to Manifest and change “accessTokenAcceptedVersion”:2 .Also check that Audience value i.e; “AUD” must match the client Id .The audience invalid occurs if they doesn’t match.
Reference