Entra SSO error

someDude

When signing in after MFA authentication the user is returned to the sign in portal with a quick "Error getting access_token' in the upper left

Entra logs show that signin was successful.

wrongecho

Hey @someDude

Take a look at https://docs.itflow.org/aad_sso

Specifically: Authentication blade: Under Implicit grant and hybrid flows select only ID tokens

Is this set?

someDude

Yes. Does it matter if I'm using Cloudflare (free) WAF & DNS proxy?

wrongecho

someDude

Cool cool & Cloudflare shouldn't matter.

Can you share some more screenshots of the setup in Azure?

What do the error logs say? I think we log the actual error there.

someDude

wrongecho Which error logs? The client side logs from Entra all show successful login. Server Apache logs don't show anything

someDude

wrongecho

Entrs config looks fine.

There's nothing at all in your php/Apache error logs? There would usually be at least something, php is very chatty.

Also worth checking your ITFlow audit log and ensuring the contact is enabled for Azure SSO on the secure tab.

someDude

wrongecho

[Fri Oct 04 07:46:00.796559 2024] [authz_core:debug] [pid 110384] mod_authz_core.c(815): [client x.x.x.x:21916] AH01626: authorization result of <RequireAny>: granted, referer: https://go.example.com/portal/login.php

[Fri Oct 04 07:46:00.911797 2024] [ssl:debug] [pid 110384] ssl_engine_kernel.c(415): [client x.x.x.x:21916] AH02034: Subsequent (No.5) HTTPS request received for child 0 (server go.example.com:443), referer: https://go.example.com/portal/login.php

[Fri Oct 04 07:46:00.911899 2024] [authz_core:debug] [pid 110384] mod_authz_core.c(815): [client x.x.x.x:21916] AH01626: authorization result of Require all granted: granted, referer: https://go.example.com/portal/login.php

[Fri Oct 04 07:46:00.911905 2024] [authz_core:debug] [pid 110384] mod_authz_core.c(815): [client x.x.x.x:21916] AH01626: authorization result of <RequireAny>: granted, referer: https://go.example.com/portal/login.php

[Fri Oct 04 07:46:01.226233 2024] [ssl:debug] [pid 110384] ssl_engine_kernel.c(415): [client x.x.x.x:21916] AH02034: Subsequent (No.6) HTTPS request received for child 0 (server go.example.com:443), referer: https://login.microsoftonline.com/

[Fri Oct 04 07:46:01.226351 2024] [authz_core:debug] [pid 110384] mod_authz_core.c(815): [client x.x.x.x:21916] AH01626: authorization result of Require all granted: granted, referer: https://login.microsoftonline.com/

[Fri Oct 04 07:46:01.226356 2024] [authz_core:debug] [pid 110384] mod_authz_core.c(815): [client x.x.x.x:21916] AH01626: authorization result of <RequireAny>: granted, referer: https://login.microsoftonline.com/

[Fri Oct 04 07:46:01.526782 2024] [deflate:debug] [pid 110384] mod_deflate.c(904): [client x.x.x.x:21916] AH01384: Zlib: Compressed 107 to 99 : URL /portal/login_microsoft.php, referer: https://login.microsoftonline.com/

[Fri Oct 04 07:46:02.573473 2024] [ssl:debug] [pid 110384] ssl_engine_kernel.c(415): [client x.x.x.x:21916] AH02034: Subsequent (No.7) HTTPS request received for child 0 (server go.example.com:443), referer: https://go.example.com/portal/login_microsoft.php

[Fri Oct 04 07:46:02.573570 2024] [authz_core:debug] [pid 110384] mod_authz_core.c(815): [client x.x.x.x:21916] AH01626: authorization result of Require all granted: granted, referer: https://go.example.com/portal/login_microsoft.php

[Fri Oct 04 07:46:02.573575 2024] [authz_core:debug] [pid 110384] mod_authz_core.c(815): [client x.x.x.x:21916] AH01626: authorization result of <RequireAny>: granted, referer: https://go.example.com/portal/login_microsoft.php

[Fri Oct 04 07:46:02.575243 2024] [deflate:debug] [pid 110384] mod_deflate.c(904): [client x.x.x.x:21916] AH01384: Zlib: Compressed 3257 to 1160 : URL /portal/login.php, referer: https://go.example.com/portal/login_microsoft.php

someDude

wrongecho ITFlow audit log doesn't even show a login attempt by the client

wrongecho

someDude

That looks like the access log, not the error log?

someDude

wrongecho Thats the problem, nothing in the error logs so I set logging to debug

wrongecho

someDude Lack of logs seems like a configuration issue on the server.

The particular error seems like we can't even authenticate to Azure.

Are you definitely inputting the correct details into itflow settings? Common mistakes include using the object ID instead of the app ID and the secret ID instead of the actual secret value.

someDude

wrongecho

I recreated the secret ID
I'm an idiot, I had the username field filled with the email address, and the email address was blank.
3. I blame you for not making the email field required

wrongecho

Lol