<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Found this when trying OS_AUTH_TYPE="v3oidcpassword" </div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
For anybody using AzureAD as idp in Keystone, it is not OIDC compliant - surprised?</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
keystone will not validate tokens as they are signed for MS graph API essentially </div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
it results in "Apache WWW-Authenticate: Bearer error="invalid_token", error_description="JWT token could not be validated"</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
keystone attempts to validate the tokens from the metadata using whatever if finds in <a href="https://login.microsoftonline.com/6edb49c1-bf72-4eea-8b3f-a7fd0a25b68c/v2.0/.well-known/openid-configuration" style="margin:0px">https://login.microsoftonline.com/<tenant-guid>/v2.0/.well-known/openid-configuration</a></div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
or using an Apache variable in wsgi-keystone.conf called OIDCOAuthVerifyJwksUri</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
for example - it will reach here <a href="https://login.microsoftonline.com/6edb49c1-bf72-4eea-8b3f-a7fd0a25b68c/discovery/v2.0/keys" style="margin:0px">https://login.microsoftonline.com/<tenant-guid>/discovery/v2.0/keys</a> </div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
and find keys - however it won't be able to validate the token as MS inserts a nonce before signing them - i.e. the tokens can only be validated by ms graph</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
additionally, if you try to validate the tokens locally on keystone using Apache variable OIDCOAuthVerifyCertFiles the keys can rotate without warning.</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
The solution is using the app registration portal in Azure and modify the app registration by selecting 'expose an API' and add a scope - then request this scope on the client using apache variable 'OIDCScope'</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<a href="https://medium.com/@abhinavsonkar/making-azure-ad-oidc-compliant-5734b70c43ff" style="margin:0px">https://medium.com/@abhinavsonkar/making-azure-ad-oidc-compliant-5734b70c43ff</a><br>
</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Rob Duncan.</div>
<div style="margin: 0px; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br style="font-size:16px">
</div>
<br>
</div>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<meta name="GENERATOR" content="PageBreeze Free HTML Editor (http://www.pagebreeze.com)">
<title>disclaimer</title>
<hr>
<p style="LINE-HEIGHT: normal; MARGIN: 0cm 0cm 0pt; TEXT-AUTOSPACE: ; mso-pagination: none; mso-layout-grid-align: none" class="MsoNormal">
<span style="FONT-FAMILY: 'Arial','sans-serif'; FONT-SIZE: 8pt">The information contained and transmitted in this e-mail is confidential information, and is intended only for the named recipient to which it is addressed. The content of this e-mail may not have
been sent with the authority of National College of Ireland. Any views or opinions presented are solely those of the author and do not necessarily represent those of National College of Ireland. If the reader of this message is not the named recipient or a
person responsible for delivering it to the named recipient, you are notified that the review, dissemination, distribution, transmission, printing or copying, forwarding, or any other use of this message or any part of it, including any attachments, is strictly
prohibited. If you have received this communication in error, please delete the e-mail and destroy all record of this communication. Thank you for your assistance.<o:p></o:p></span></p>
<hr>
</body>
</html>