Entra ID authentication fails when attributes are missing on the account
- Dominant language
- Rust
- Stars
- 2.8k
- Forks
- 115
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 51
Description
**Describe the bug**
OIDC Authentication fails with Entra ID accounts missing certain (non-mandatory) attributes. This is verified for the given_name attribute, but I suspect the same behavior for the family_name and email attributes too.
**To Reproduce**
Steps to reproduce the behavior:
1. Configure OpenID with the provider Microsoft
2. Add the optional token claims as described in https://docs.defguard.net/features/external-openid-providers/microsoft.
3. Provision an account in Entra ID with an empty given_name attribute.
4. Attempt to sign in using External SSO to the Defguard Enrollment Portal with said account.
5. The user is presented with an Internal Server error, and in the logs the following error message is printed:
`/api/v1/openid/callback message=Unexpected error: status: 'Internal error', self: "OpenID auth error Bad Rqeust: Failed to retrieve given name from provider's userinfo endpoint and the ID token. Make sure you have configured your provider correctly and that you have granted the necessary permissions to retrieve such information from the token or the userinfo endpoint."`
**Expected behavior**
The given_name and family_name are not mandatory attributes in Entra ID. There are use-cases (for example, guests invited using Entra ID Governance Entitlement Management ) where the attribute is empty. In these instances, the user should be created without these attributes.
**Version information**
- Defguard Core version: v1.5.2
- Defguard Proxy version v1.5.1
- Chrome 141
Contributor guide
Assessment
This issue has not been assessed yet.