Probléme configuration openid

Hi @Laurent 

I just put /introspect
and delete browser cache
now I have the following error in /var/log/centreon/login.log

<image removed because contains company information>

@idi from the latest picture you send, I can see that the “User information” endpoint give “email” address.

Do you have an user into Centreon with a login equal to this email address?

and in inspect page connection centreon I have this as an error

Hi @Laurent 

I did the test by modifying Email = Alias ​​/ Login (email address) and it works very well
now to standardize my conf, the AZURE team can't interpret the values ​​qye you told me “name”, “family_name”, “given_name” in claim (azure)

Hi @Laurent 

I asked the team AZURE  to configure on their side Login claim value equal “Alias ​​/ Login” they are seeing how to make the change, then I test on my side.

@idi I doesn’t understand why you change value returned from IDP.

You must keep email but be sure that the value return with email is equal to the value defined for Alias ​​/ Login value

On Azure, you must add a claim whatever its name (prefered_username, user_name, email, etc.) but the content of this variable must correspond to the login of a user registered in Centreon.

Centreon must be able to recognize a user who has authenticated on Azure.
Either you use the user's name or his email address but there must be a match.

So the name of the claim is not important (just define it into Centreon OIDC configuration), the value of this claim is really important to match users

@idi I think there is a misunderstanding, I will answer with an example configuration

I want to allow John Doe to access to Centreon UI using an Identity Provider.

In Centreon, I have this configuration for my user:

Here the login of John Doe is jdoe

To authenticate users with MS Azure, I configured Centreon like this:

So here I am waiting for MS Azure to add a claim whose name is login

In Microsoft Azure, I added an additional claim like:

So MS Azure will send to Centreon the login variable (claim) and Centreon will extract the jdoe value.

Because the jdoe value exists for an user, John Doe will be connected.

I hope this answer will be more understandable.

In the MS Azure configuration I put user.samaccountname but you need to define the correct Azure property which will send the jdoe value in our example.

Hi @idi, “login” is not present in the user information endpoint return.

If you use LDAP, I see that the login look like to “given_name” from user information endpoint return.

Maybe use “given_name” in the OpenId Connect for the “Login claim value” field.

Regards,