DefGuard / DefGuard/defguard

Entra ID authentication fails when attributes are missing on the account

Open
#1,674 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
2.8k
Forks
115
Avg merge
1d 4h
Merged PRs (30d)
51

Description

**Describe the bug**
OIDC Authentication fails with Entra ID accounts missing certain (non-mandatory) attributes. This is verified for the given_name attribute, but I suspect the same behavior for the family_name and email attributes too.

**To Reproduce**
Steps to reproduce the behavior:
1. Configure OpenID with the provider Microsoft
2. Add the optional token claims as described in https://docs.defguard.net/features/external-openid-providers/microsoft.
3. Provision an account in Entra ID with an empty given_name attribute.
4. Attempt to sign in using External SSO to the Defguard Enrollment Portal with said account.
5. The user is presented with an Internal Server error, and in the logs the following error message is printed:
`/api/v1/openid/callback message=Unexpected error: status: 'Internal error', self: "OpenID auth error Bad Rqeust: Failed to retrieve given name from provider's userinfo endpoint and the ID token. Make sure you have configured your provider correctly and that you have granted the necessary permissions to retrieve such information from the token or the userinfo endpoint."`

**Expected behavior**
The given_name and family_name are not mandatory attributes in Entra ID. There are use-cases (for example, guests invited using Entra ID Governance Entitlement Management ) where the attribute is empty. In these instances, the user should be created without these attributes.

**Version information**
- Defguard Core version: v1.5.2
- Defguard Proxy version v1.5.1
- Chrome 141

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.