gregori
Managed to get the user selection with Azure and then I get
RuntimeError POST /auth/azure/callback
Invalid issuer "https://login.microsoftonline.com/27… in ID Token
Which step of configuration am I missing?
providers: [
azure: [
client_id: “…”,
client_secret: “…”,
nonce: true,
#redirect_uri: “https://localhost:4006/auth/microsoft/callback”,
strategy: Assent.Strategy.AzureAD
]
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Bringing learning, work and compliance together since 1987.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #blog-post
- #ai
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 5- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
danschultzer
This is an error in the OpenID validation, which means that the claims that was received doesn’t have the same issuer as the one fetched from the
:openid_configuration_uripath. For Azure this URL would be:https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configurationI would check the
:tenant_idsetting: Assent.Strategy.AzureAD — Assent v0.1.8It defaults to
commonwhen not set.gregori
Yes with tenant configured it works, but I wanted to use it on multitenant.
danschultzer
It’s described here: Convert single-tenant app to multitenant on Microsoft Entra ID - Microsoft identity platform | Microsoft Learn
In short, you have to enable multi-tenancy in your app on Azure, and then update the application code to handle the issuer right:
I’m not sure. It feels like this might go against the OpenID specs. I think you might have to hack this.
One way is to pass in
:openid_configurationconfig option in the callback call where the issuer is dynamically set. We should probably discuss this in an issue at GitHub - pow-auth/assent: Multi-provider framework in Elixir · GitHubgregori
I posted an issue on github. And yes, I have it enabled on Azure. (it works with ueberauth).
danschultzer
Hmm, that lib is using oauth2, instead of OIDC and doesn’t seem like it does any validation of the token. I feel OIDC is the safer choice. I’ll go over this tomorrow, thanks for opening the issue!