habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

providers/oauth2: allow m2m for JWKS without alg in keys (#12196)

Browse Source 
* providers/oauth2: allow m2m for JWKS without alg in keys

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* Update index.md

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>
Signed-off-by: Jens L. <jens@beryju.org>

* Apply suggestions from code review

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>
Signed-off-by: Jens L. <jens@beryju.org>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Signed-off-by: Jens L. <jens@beryju.org>
Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>
This commit is contained in:
Jens L.
2024-11-27 19:01:40 +01:00
committed by GitHub
parent c05124c9dd
commit f9e8138be3
5 changed files with 28 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
website/docs/users-sources/sources/social-logins/azure-ad/index.md
View File

@ -111,3 +111,22 @@ return True
9. Open **Flow settings** and choose _azure-ad-enrollment_ as enrollment flow.
Try to login with a **_new_** user. You should see no prompts and the user should have the correct information.
### Machine-to-machine authentication <span class="badge badge--version">authentik 2024.12+</span>
If using [Machine-to-Machine](../../../../add-secure-apps/providers/oauth2/client_credentials.md#jwt-authentication) authentication, some specific steps need to be considered.
When getting the JWT token from Azure AD, set the scope to the Application ID URI, and _not_ the Graph URL; otherwise the JWT will be in an invalid format.
```http
POST /<azure-ad-tenant-id>/oauth2/v2.0/token/ HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&
client_id=<application_client_id>&
scope=api://<application_client_id>/.default&
client_secret=<application_client_secret>
```
The JWT returned from the request above can be used with authentik to exchange it for an authentik JWT.