-
|
Hi, I’m trying to use mod_auth_openidc as an Apache reverse proxy in front of an internal web app (Checkmk), with Microsoft Entra ID as the OIDC provider. Environment
What worksThe browser-side OIDC flow appears to work correctly now:
So the problem is no longer redirect URI / callback / cookie handling. What failsThe failure now happens during code redemption at the token endpoint. Entra returns:
Relevant sanitized log excerpt: The generated client_assertion header in my logs looks like this: The payload includes the expected fields like iss, sub, aud, jti, exp, iat, and the audience is the /oauth2/v2.0/token endpoint. alg = PS256 So my question is whether the assertion currently generated by mod_auth_openidc in this setup is still not Entra-compatible for certificate-based private_key_jwt. Question: More concretely: Notes: I also found the older Azure AD / private_key_jwt discussion (#762), which looks related, but I am not sure what the current status is for modern Entra + current releases. |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments
-
|
looks like a duplicate of #1269, so use >= 2.4.16.4, see also the release notes at https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.16.4 |
Beta Was this translation helpful? Give feedback.
-
|
thank you very much. sry for oversseing this. |
Beta Was this translation helpful? Give feedback.
looks like a duplicate of #1269, so use >= 2.4.16.4, see also the release notes at https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.16.4