From 48526c1ae592301835bbaf3ad8bc0d5ea5d94de0 Mon Sep 17 00:00:00 2001 From: JoeAldinger Date: Thu, 7 May 2026 10:10:41 -0400 Subject: [PATCH] PROJQUAY-10283: update Entra OIDC server example Co-authored-by: Cursor --- modules/configuring-oidc-authentication.adoc | 10 +++++----- modules/oidc-config-fields.adoc | 14 +++++++------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/modules/configuring-oidc-authentication.adoc b/modules/configuring-oidc-authentication.adoc index 5a404a649..fd964a22d 100644 --- a/modules/configuring-oidc-authentication.adoc +++ b/modules/configuring-oidc-authentication.adoc @@ -40,20 +40,20 @@ AZURE_LOGIN_CONFIG: <1> OIDC_SERVER: <4> SERVICE_NAME: Microsoft Entra ID <5> VERIFIED_EMAIL_CLAIM_NAME: <6> - USE_PKCE: True <7> + USE_PKCE: true <7> PKCE_METHOD: "S256" <8> - PUBLIC_CLIENT: True <9> + PUBLIC_CLIENT: true <9> # ... ---- <1> The parent key that holds the OIDC configuration settings. In this example, the parent key used is `AZURE_LOGIN_CONFIG`, however, the string `AZURE` can be replaced with any arbitrary string based on your specific needs, for example `ABC123`.However, the following strings are not accepted: `GOOGLE`, `GITHUB`. These strings are reserved for their respective identity platforms and require a specific `config.yaml` entry contingent upon when platform you are using. <2> The client ID of the application that is being registered with the identity provider. <3> The client secret of the application that is being registered with the identity provider. -<4> The address of the OIDC server that is being used for authentication. In this example, you must use `sts.windows.net` as the issuer identifier. Using `https://login.microsoftonline.com` results in the following error: `Could not create provider for AzureAD. Error: oidc: issuer did not match the issuer returned by provider, expected "https://login.microsoftonline.com/73f2e714-xxxx-xxxx-xxxx-dffe1df8a5d5" got "https://sts.windows.net/73f2e714-xxxx-xxxx-xxxx-dffe1df8a5d5/"`. +<4> The address of the OIDC server that is being used for authentication. For Microsoft Entra ID, you can typically use the v2 endpoint, for example `\https://login.microsoftonline.com//v2.0/`. <5> The name of the service that is being authenticated. <6> The name of the claim that is used to verify the email address of the user. -<7> Specifies whether to enable Proof Key for Code Exchange (PKCE) for OIDC authentication. Defaults to `False`. +<7> Specifies whether to enable Proof Key for Code Exchange (PKCE) for OIDC authentication. Defaults to `false`. <8> Specifies the code challenge method used to generate the `code_challenge` sent in the initial authorization request. Defaults to `S256`. -<9> Specifies whether to omit `client_secret` during token request when the client is public. Defaults to `False`. +<9> Specifies whether to omit `client_secret` during token request when the client is public. Defaults to `false`. . Proper configuration of Microsoft Entra ID results three redirects with the following format: + diff --git a/modules/oidc-config-fields.adoc b/modules/oidc-config-fields.adoc index 8fda4e0b4..d9efe17f1 100644 --- a/modules/oidc-config-fields.adoc +++ b/modules/oidc-config-fields.adoc @@ -33,7 +33,7 @@ You can configure {productname} to authenticate users through any OpenID Connect | **{nbsp}{nbsp}{nbsp}.OIDC_SERVER** + (Required) | String | The address of the OIDC server that is being used for authentication. + + -**Example:** `\https://sts.windows.net/6c878.../` +**Example:** `\https://login.microsoftonline.com//v2.0/` | **{nbsp}{nbsp}{nbsp}.PREFERRED_USERNAME_CLAIM_NAME** |String |Sets the preferred username to a parameter from the token. | **{nbsp}{nbsp}{nbsp}.SERVICE_ICON** | String | Changes the icon on the login screen. @@ -45,13 +45,13 @@ You can configure {productname} to authenticate users through any OpenID Connect | **{nbsp}{nbsp}{nbsp}.PREFERRED_GROUP_CLAIM_NAME** | String | The key name within the OIDC token payload that holds information about the user's group memberships. -| **{nbsp}{nbsp}{nbsp}.OIDC_DISABLE_USER_ENDPOINT** | Boolean | Whether to allow or disable the `/userinfo` endpoint. If using Azure Entra ID, this field must be set to `True` because Azure obtains the user's information from the token instead of calling the `/userinfo` endpoint. + +| **{nbsp}{nbsp}{nbsp}.OIDC_DISABLE_USER_ENDPOINT** | Boolean | Whether to allow or disable the `/userinfo` endpoint. If using Azure Entra ID, this field must be set to `true` because Azure obtains the user's information from the token instead of calling the `/userinfo` endpoint. + + - **Default:** `False` + **Default:** `false` | *USE_PKCE* | Boolean | Whether to enable support for Proof Key for Code Exchange. + + - **Default:** `False` + **Default:** `false` |*PKCE_METHOD* |Integer | The code challenge method used to generate the `code_challenge` sent in the initial authorization request. + + @@ -59,7 +59,7 @@ You can configure {productname} to authenticate users through any OpenID Connect |*PUBLIC_CLIENT* |Boolean | Whether to omit `client_secret` during token request when the client is public. + + - **Default:** `False` + **Default:** `false` |=== .OIDC example YAML @@ -90,8 +90,8 @@ AUTHENTICATION_TYPE: OIDC VERIFIED_EMAIL_CLAIM_NAME: PREFERRED_GROUP_CLAIM_NAME: OIDC_DISABLE_USER_ENDPOINT: true - USE_PKCE: True + USE_PKCE: true PKCE_METHOD: "S256" - PUBLIC_CLIENT: True + PUBLIC_CLIENT: true # ... ---- \ No newline at end of file