Skip to main content

SSO Troubleshooting - Entra

Updated

This article contains several helpful solutions in the event that an issue arose while configuring a customer's SSO integration to Entra. Before beginning the troubleshooting process it can be helpful for you to have:

  • The Client ID and Tenant ID from cnfg.InstanceConfiguration
  • The ability to access and edit the customer's app registration
    • note that this will likely require you to pair with the customer over a Zoom call

Redirect URI Does Not Match Configured URIs

This issue is a common one and can happen for a multitude of reasons. First though, note the redirect URI, highlighted in blue, this is the URI that the application is trying to access, we will refer to it as the blue URI. Some common issues to check:

The blue URI does not match the actual URI of the application

  • The blue URI is built when the app starts up (i.e. you restart the app in IIS Manager), it is built by combining the InstanceUrl from the cnfg.InstanceConfiguration table with the route Account/Login
  • If the blue URI does not match the actual URI of the application, check that InstanceUrl from the cnfg.InstanceConfiguration table is correct. SELECT * FROM [cnfg].[InstanceConfiguration]
  • If the value in the cnfg.InstanceConfiguration is incorrect;
    • Manually update  via SQL
    • Restart the application in IIS Manager
  • If the value in cnfg.InstanceConfiguration is incorrect, it is crucial that you also double-check the latest Octopus deployment
    • This value is set every time a release is made to the customer's instance
    • If it is incorrect there is a possibility that the user's instance URL is not being built correctly in the Octopus deployment

The redirect URI is not correctly configured in the customer's app registration

  • If you have confirmed that the blue URI matches the expected instance URI, the next place to check is in the customer's app registration
    • Work with the customer to access the app registration in their Azure Portal
    • Under the 'Authentication' tab, review the redirect URIs
    • Ensure that there is a redirect URI that matches the blue URI, and that it is for a SPA application
    • If the URI is incorrect, simply fix it and save your changes
    • If the URI is correct but for a different platform, such as Web or Mobile, click 'Add new platform' and follow the prompts for a SPA application
    • Once the redirect URI is correctly configured, hit 'Save' and try again, you should not need to restart the application

The StockIQ configuration is incorrect

  • If you have verified that the blue URI is correct, and that there is a matching redirect URI in the customer's app registration, the next place to look is at the StockIQ configuration
    • Login as a StockIQ administrator, Admin/Login and go to Admin>System Configuration>SSO Authentication Settings
      • Note that it is possible to do this without signing in, you can see the Client and Tenant IDs in plain text in the database and can update them there if needed as well. [cnfg].[OidcSettings]
    • Review the Client ID and Tenant ID to ensure they are correct
      • The more likely outcome is that the Client ID is for a different app registration the customer has and needs to be updated
    • Once you have verified that the Client ID and Tenant ID are correct, save the changes
    • Restart the application in IIS Manager
    • Ask the customer to attempt signing in again

User account does not exist

This issue only arises if the account that the user attempted to login as is not in their Entra tenant. This can sometimes happen if the customer outsources to third-party staffing agencies, for customers in this scenario it is suggested that they do one the following.

  • Invite those users to their Entra instance as a B2B contributor
  • Create an account for the third-party employees in their Entra instance

It is NOT suggested to change their StockIQ app registration to a multi-tenanted instance, as this could potentially expose them to additional risk.

Application with identifier not found in directory

This issue occurs when either the Client ID or Tenant ID have not been correctly configured inside of StockIQ, make note of the green Client ID (note that yours will be different than the image above)

  • Grab the Client ID and Tenant ID from [cnfg].[OidcSettings], either directly from SQL or via Admin>System Settings>SSO Authentication Settings
    • Note that the Client ID from the database and the green Client ID should match
  • Work with the customer to review the app registration that they created to integrate with StockIQ
    • On the 'Overview' tab of the app registration instance in the customer's Azure Portal, confirm that the Client ID and Tenant ID you have from the database matches the Client ID and Tenant ID you have from the database
  • Correct the values accordingly
  • Restart the application in IIS Manager
  • Ask the customer to retry their authentication

Proof Key for Code Exchange Required

This issue should only arise if there is an issue with the code base of Stock IQ. Please contact the development team for resolution.

Related articles