OpenID 401 with Azure AD

[amf]

Still seeing "Failed to contact token endpoint: Request failed" with 401 being returned by the Proxmox front end, with latest Proxmox install. I can see comms between proxmox and the endpoint occurring, but of course cannot see the response.

issuer URL:
https://login.microsoftonline.com/##/v2.0
realm: myazuredomain.com
client ID: "application ID" from Azure app
client key: "client secret" description set in Azure
username claim: username
autocreate users: Yes

Anyone have any suggestions please?

 

[saggy2]

Still seeing "Failed to contact token endpoint: Request failed" with 401 being returned by the Proxmox front end, with latest Proxmox install. I can see comms between proxmox and the endpoint occurring, but of course cannot see the response.

issuer URL:
https://login.microsoftonline.com/##/v2.0
realm: myazuredomain.com
client ID: "application ID" from Azure app
client key: "client secret" description set in Azure
username claim: username
autocreate users: Yes

Anyone have any suggestions please?

issue continues to exists. I guess no one here has any idea whats going on!

 

[ondrejvalenta]

Still seeing "Failed to contact token endpoint: Request failed" with 401 being returned by the Proxmox front end, with latest Proxmox install. I can see comms between proxmox and the endpoint occurring, but of course cannot see the response.

issuer URL:
https://login.microsoftonline.com/##/v2.0
realm: myazuredomain.com
client ID: "application ID" from Azure app
client key: "client secret" description set in Azure
username claim: username
autocreate users: Yes

Anyone have any suggestions please?

What does your log says when you try to log in and receive an error?

I assume you have the last version of Proxmox libraries and rebooted afterwards, right?

 

[amf]

What does your log says when you try to log in and receive an error?

I assume you have the last version of Proxmox libraries and rebooted afterwards, right?


View attachment 52211

Syslog says:

pvedaemon[1666035]: openid authentication failure; rhost=::ffff:<ipv4 of client> msg=Failed to contact token endpoint: Request failed

This is actually a fresh deployment, so everything is bang up-to-date.

 

[amf]

Revisiting this with a fresh head and starting from scratch has resulted in it now working. Clearly something was amiss but since it was re-implemented from scratch unfortunately I can't say what. Thanks for the help in any case.

 

[mira]

Glad you got it working!

A colleague had a wrong client key on Friday which resulted in the same error.
And I copied the client key ID instead of the actual client key in the past when setting up Azure.

 

[scyto]

wrong client key

i concur - i just spent 20 mins troubleshooting this and then realized i had accidentally added a ( at the front of my client key (aka the secret value in AAD)

 

[talos]

i concur - i just spent 20 mins troubleshooting this and then realized i had accidentally added a ( at the front of my client key (aka the secret value in AAD)

I know your pain, same happend to me and not just ones.

 

[rinseaid]

I have also just seen this issue when configuring Authentik OIDC with PVE. My issue turned out to be special characters in the client secret. Once I switched to a client secret with only alphanumeric characters, the login worked successfully.

I am not sure which character was the culprit and am out of time to further troubleshoot, but it was one of: ^ $ % or @.