Azure provider: Unexpected audience causes invalid bearer token about oauth2-proxy

[betabandido]

@AMoghrabi No, I didn't. A little after reporting this I stopped using Azure to authenticate, so I didn't continue looking for a solution.

[JoelSpeed]

I'm wondering if you could attempt to set up the OIDC provider to point to azure? You could try the OIDC issuer as https://login.microsoftonline.com/<tennant> and see what happens?

[maxh8086]

Pointing to Similar resolution of ADFS :

https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code

https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

[betabandido]

@JoelSpeed I have tried using the OIDC provider, but I have run into a few issues.

First, the issuer returned by Azure is not the same as the one sent. So, I get the following error from https://github.com/coreos/go-oidc/blob/v2/oidc.go#L123

oidc: issuer did not match the issuer returned by provider,
expected "https://login.microsoftonline.com/<tennant-id>
got "https://sts.windows.net/<tennant-id>/"

I manually disabled the check in the go-oidc library and the different provider parameters (authURL, tokenURL, etc.) seem to be actually obtained successfully.

The second problem occurs at https://github.com/pusher/oauth2_proxy/blob/master/providers/oidc.go#L119

The token returned by Azure does not contain the email in the sub field (it is instead in the upn field). That means I cannot specify email addresses with -email-domain=<some domain>.

I hardcoded the email, compiled again and after running the proxy again, the authentication was completed successful.

Given that fixing one of the issues involves changing the go-oidc library, it is not clear to me whether there is an easy fix for this issue. What do you think?

[ploxiln]

It seems like OpenID-Connect is just as inconsistently implemented as Oauth2, and separate "provider" code tends to be needed for each ... it's just especially unfortunate that there seems to be 2 or 3 different Microsoft products with "Azure" in the name that all need different "provider" code to handle their quirks.

[maxh8086]

Microsoft expect resource (Actual consumer of Token ) to be included in every request sent by oauth2 proxy to respond right audience.. same happens in ADFS.. sample output has been shared for adfs request.

[betabandido]

@maxh8086 I suppose that is only the case for the oauth2 code grant, but not for the openid protocol (documentation does not list any resource field in the request for the latter). I believe there is no way to make this work using the openid protocol.

I can confirm that using the oauth2 code grant (where an extra request is needed to get the token) returns a token with the audience containing the spn: prefix. For this to work I believe it is needed to specify spn:your client id as the resource field in the first request, and then use api-version: 1.0 in the second request (to exchange the obtained code for the token).

[maxh8086]

For Microsoft resource is web api who is intent to consume the token. Yes you are true openid do not have it documented in a way that tells resource in grant type code / authorization code.. but this is how Microsoft has implemented its ADFS / Azure AD.. although i believe it clears the intention of token requesting application that code will be consumed by third party (kubernetes API) not by requestor (proxy). This has been tested with other app with to the help of application owner.. and able to get all custom grant using method stated by Microsoft article.

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[Fez29]

@JoelSpeed @ploxiln I suspect the issues I am having with Azure AD are related to the issues mentioned in this post. #502 I am seeing very similar behavior with issues with the issuer, audience etc.

[AMoghrabi]

Hi @betabandido. Did you end up solving this problem? I get the same error as you:

Unable to authenticate the request due to an error: [invalid bearer token, oidc: verify token: oidc: expected audience "spn:{client_id}" got ["{client_id}"]]