DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #1663] Unable to get azure token, statusCode 400 #2935

New Issue
Open
opened 2026-08-05 00:49:44 -04:00 by saavagebueno · 0 comments
saavagebueno commented 2026-08-05 00:49:44 -04:00
Owner
Copy Link

Originally created by @rqi14 on GitHub (Mar 4, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/1663

Describe the problem

Hi. I self-hosted using docker compose according to the tutorial. I used nginx as reverse proxy and entra id (azure) as IdP. I configured step by step but it gives me this error
WARN management/server/account.go:889: failed warming up cache due to error: unable to get azure token, statusCode 400

In the web interface, it keeps refreshing and complaints about these errors:

image

To Reproduce

Steps to reproduce the behavior:

  1. Setup reverse proxy, azure id according to tutorial
  2. Open https://netbird.FQDN/
  3. See error

Expected behavior

I should be able to run it without error

Are you using NetBird Cloud?

Self-host

NetBird version

0.26.2

NetBird status -d output:

If applicable, add the `netbird status -d' command output.

I don't have it but I can post the management container log here

management-1 | 2024-03-04T05:19:47Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://login.partner.microsoftonline.cn/<tenant-id>/v2.0, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0 management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize management-1 | 2024-03-04T05:19:48Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-03-04T05:19:48Z INFO management/server/store.go:94: using SQLite store engine management-1 | 2024-03-04T05:22:42Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://login.partner.microsoftonline.cn/<tenant-id>/v2.0, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0 management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize management-1 | 2024-03-04T05:22:43Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-03-04T05:22:43Z INFO management/server/store.go:94: using SQLite store engine management-1 | 2024-03-04T06:35:42Z INFO management/cmd/management.go:171: geo location service has been initialized from /var/lib/netbird/ management-1 | 2024-03-04T06:35:42Z INFO management/server/account.go:849: single account mode enabled, accounts number 0 management-1 | 2024-03-04T06:35:42Z WARN management/cmd/management.go:185: TrustedPeers are configured to default value '0.0.0.0/0', '::/0'. This allows connection IP spoofing. management-1 | 2024-03-04T06:35:46Z WARN management/server/account.go:889: failed warming up cache due to error: Post "https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token": dial tcp: lookup login.partner.microsoftonline.cn on 127.0.0.11:53: read udp 127.0.0.1:39173->127.0.0.11:53: i/o timeout management-1 | Error: failed creating JWT validator: Get "https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys": dial tcp: lookup login.partner.microsoftonline.cn on 127.0.0.11:53: read udp 127.0.0.1:39173->127.0.0.11:53: i/o timeout management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://login.partner.microsoftonline.cn/<tenant-id>/v2.0, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0 management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize management-1 | 2024-03-04T06:35:48Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-03-04T06:35:48Z INFO management/server/store.go:94: using SQLite store engine management-1 | 2024-03-04T06:35:49Z INFO management/cmd/management.go:171: geo location service has been initialized from /var/lib/netbird/ management-1 | 2024-03-04T06:35:49Z INFO management/server/account.go:849: single account mode enabled, accounts number 0 management-1 | 2024-03-04T06:35:49Z WARN management/cmd/management.go:185: TrustedPeers are configured to default value '0.0.0.0/0', '::/0'. This allows connection IP spoofing. management-1 | 2024-03-04T06:35:49Z INFO management/cmd/management.go:286: running gRPC backward compatibility server: [::]:33073 management-1 | 2024-03-04T06:35:49Z INFO management/cmd/management.go:318: running HTTP server and gRPC server on the same port: [::]:443 management-1 | 2024-03-04T06:35:49Z WARN management/server/account.go:889: failed warming up cache due to error: unable to get azure token, statusCode 400 management-1 | 2024-03-04T06:35:49Z INFO management/server/account.go:1590: overriding JWT Domain and DomainCategory claims since single account mode is enabled management-1 | 2024-03-04T06:35:49Z ERRO management/server/sqlite_store.go:374: when getting account from the store: record not found management-1 | 2024-03-04T06:35:50Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get azure token, statusCode 400 management-1 | 2024-03-04T06:35:50Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-03-04T06:35:50Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 4116581583: GET /api/peers status 401 management-1 | 2024-03-04T06:35:59Z INFO management/server/account.go:1590: overriding JWT Domain and DomainCategory claims since single account mode is enabled management-1 | 2024-03-04T06:36:00Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get azure token, statusCode 400 management-1 | 2024-03-04T06:36:00Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-03-04T06:36:00Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 4067145076: GET /api/groups status 401 management-1 | 2024-03-04T06:36:10Z INFO management/server/account.go:1590: overriding JWT Domain and DomainCategory claims since single account mode is enabled management-1 | 2024-03-04T06:36:10Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get azure token, statusCode 400 management-1 | 2024-03-04T06:36:10Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-03-04T06:36:10Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1564696021: GET /api/users status 401

Screenshots

If applicable, add screenshots to help explain your problem.

image

Additional context

Add any other context about the problem here.

I used microsoft 365 operated by 21vianet so the endpoint url is slightly different.

In entra id management centre, it gives me this error:

500011
	
The resource principal named {name} was not found in the tenant named {tenant}. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.

	
Developer error - the app requested access to a resource (application) that isn't installed in your tenant. If you expect the app to be installed, you may need to provide administrator permissions to add it. Check with the developers of the resource and application to understand what the right setup for your tenant is.

Below is my setup.env

## example file, you can copy this file to setup.env and update its values
##

# Image tags
# you can force specific tags for each component; will be set to latest if empty
NETBIRD_DASHBOARD_TAG=""
NETBIRD_SIGNAL_TAG=""
NETBIRD_MANAGEMENT_TAG=""
COTURN_TAG=""

# Dashboard domain. e.g. app.mydomain.com
NETBIRD_DOMAIN="netbird.example.com"

# TURN server domain. e.g. turn.mydomain.com
# if not specified it will assume NETBIRD_DOMAIN
NETBIRD_TURN_DOMAIN=""

# TURN server public IP address
# required for a connection involving peers in
# the same network as the server and external peers
# usually matches the IP for the domain set in NETBIRD_TURN_DOMAIN
NETBIRD_TURN_EXTERNAL_IP=""

# -------------------------------------------
# OIDC
#  e.g., https://example.eu.auth0.com/.well-known/openid-configuration
# -------------------------------------------
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration"
# The default setting is to transmit the audience to the IDP during authorization. However,
# if your IDP does not have this capability, you can turn this off by setting it to false.
#NETBIRD_DASH_AUTH_USE_AUDIENCE=false
NETBIRD_AUTH_AUDIENCE="<application-id>"
# e.g. netbird-client
NETBIRD_AUTH_CLIENT_ID="<application-id>"
# indicates the scopes that will be requested to the IDP
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api://<application-id>/api"
# NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace.
# NETBIRD_AUTH_CLIENT_SECRET=""
# if you want to use a custom claim for the user ID instead of 'sub', set it here
NETBIRD_AUTH_USER_ID_CLAIM="oid"
# indicates whether to use Auth0 or not: true or false
NETBIRD_USE_AUTH0="false"
# if your IDP provider doesn't support fragmented URIs, configure custom
# redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain.
NETBIRD_AUTH_REDIRECT_URI="/auth"
NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"
# Updates the preference to use id tokens instead of access token on dashboard
# Okta and Gitlab IDPs can benefit from this
# NETBIRD_TOKEN_SOURCE="idToken"
# -------------------------------------------
# OIDC Device Authorization Flow
# -------------------------------------------
NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"
NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=""
# Some IDPs requires different audience, scopes and to use id token for device authorization flow
# you can customize here:
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE
NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid"
NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false
# -------------------------------------------
# OIDC PKCE Authorization Flow
# -------------------------------------------
# Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative
# eg. 53000,54000
NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000"
# -------------------------------------------
# IDP Management
# -------------------------------------------
# eg. zitadel, auth0, azure, keycloak
NETBIRD_MGMT_IDP="azure"
# Some IDPs requires different client id and client secret for management api
NETBIRD_IDP_MGMT_CLIENT_ID=$NETBIRD_AUTH_CLIENT_ID
NETBIRD_IDP_MGMT_CLIENT_SECRET="<client-secret>"
# Required when setting up with Keycloak "https://<YOUR_KEYCLOAK_HOST_AND_PORT>/admin/realms/netbird"
# NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT=
# With some IDPs may be needed enabling automatic refresh of signing keys on expire
NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true
# NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice.
NETBIRD_IDP_MGMT_EXTRA_OBJECT_ID="<object-id-of-application-azure>"
NETBIRD_IDP_MGMT_EXTRA_GRAPH_API_ENDPOINT="https://microsoftgraph.chinacloudapi.cn/v1.0"
# -------------------------------------------
# Letsencrypt
# -------------------------------------------
# Disable letsencrypt
#  if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead
NETBIRD_DISABLE_LETSENCRYPT=true
# e.g. hello@mydomain.com
NETBIRD_LETSENCRYPT_EMAIL=""
# -------------------------------------------
# Extra settings
# -------------------------------------------
# Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection
NETBIRD_DISABLE_ANONYMOUS_METRICS=true
# DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted
NETBIRD_MGMT_DNS_DOMAIN=netbird.example.com
NETBIRD_MGMT_API_PORT=443
NETBIRD_SIGNAL_PORT=443
Originally created by @rqi14 on GitHub (Mar 4, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/1663 **Describe the problem** Hi. I self-hosted using docker compose according to the tutorial. I used nginx as reverse proxy and entra id (azure) as IdP. I configured step by step but it gives me this error `WARN management/server/account.go:889: failed warming up cache due to error: unable to get azure token, statusCode 400` In the web interface, it keeps refreshing and complaints about these errors: ![image](https://github.com/netbirdio/netbird/assets/26152437/0329f47a-170e-40c9-95bb-58bc74f1de2c) **To Reproduce** Steps to reproduce the behavior: 1. Setup reverse proxy, azure id according to tutorial 2. Open https://netbird.FQDN/ 3. See error **Expected behavior** I should be able to run it without error **Are you using NetBird Cloud?** Self-host **NetBird version** `0.26.2` **NetBird status -d output:** If applicable, add the `netbird status -d' command output. I don't have it but I can post the management container log here `management-1 | 2024-03-04T05:19:47Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://login.partner.microsoftonline.cn/<tenant-id>/v2.0, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0 management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token management-1 | 2024-03-04T05:19:48Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize management-1 | 2024-03-04T05:19:48Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-03-04T05:19:48Z INFO management/server/store.go:94: using SQLite store engine management-1 | 2024-03-04T05:22:42Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://login.partner.microsoftonline.cn/<tenant-id>/v2.0, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0 management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token management-1 | 2024-03-04T05:22:43Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize management-1 | 2024-03-04T05:22:43Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-03-04T05:22:43Z INFO management/server/store.go:94: using SQLite store engine management-1 | 2024-03-04T06:35:42Z INFO management/cmd/management.go:171: geo location service has been initialized from /var/lib/netbird/ management-1 | 2024-03-04T06:35:42Z INFO management/server/account.go:849: single account mode enabled, accounts number 0 management-1 | 2024-03-04T06:35:42Z WARN management/cmd/management.go:185: TrustedPeers are configured to default value '0.0.0.0/0', '::/0'. This allows connection IP spoofing. management-1 | 2024-03-04T06:35:46Z WARN management/server/account.go:889: failed warming up cache due to error: Post "https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token": dial tcp: lookup login.partner.microsoftonline.cn on 127.0.0.11:53: read udp 127.0.0.1:39173->127.0.0.11:53: i/o timeout management-1 | Error: failed creating JWT validator: Get "https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys": dial tcp: lookup login.partner.microsoftonline.cn on 127.0.0.11:53: read udp 127.0.0.1:39173->127.0.0.11:53: i/o timeout management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://login.partner.microsoftonline.cn/<tenant-id>/v2.0, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/v2.0 management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/discovery/v2.0/keys management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/token management-1 | 2024-03-04T06:35:48Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize, previously configured value: https://login.partner.microsoftonline.cn/<tenant-id>/oauth2/v2.0/authorize management-1 | 2024-03-04T06:35:48Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-03-04T06:35:48Z INFO management/server/store.go:94: using SQLite store engine management-1 | 2024-03-04T06:35:49Z INFO management/cmd/management.go:171: geo location service has been initialized from /var/lib/netbird/ management-1 | 2024-03-04T06:35:49Z INFO management/server/account.go:849: single account mode enabled, accounts number 0 management-1 | 2024-03-04T06:35:49Z WARN management/cmd/management.go:185: TrustedPeers are configured to default value '0.0.0.0/0', '::/0'. This allows connection IP spoofing. management-1 | 2024-03-04T06:35:49Z INFO management/cmd/management.go:286: running gRPC backward compatibility server: [::]:33073 management-1 | 2024-03-04T06:35:49Z INFO management/cmd/management.go:318: running HTTP server and gRPC server on the same port: [::]:443 management-1 | 2024-03-04T06:35:49Z WARN management/server/account.go:889: failed warming up cache due to error: unable to get azure token, statusCode 400 management-1 | 2024-03-04T06:35:49Z INFO management/server/account.go:1590: overriding JWT Domain and DomainCategory claims since single account mode is enabled management-1 | 2024-03-04T06:35:49Z ERRO management/server/sqlite_store.go:374: when getting account from the store: record not found management-1 | 2024-03-04T06:35:50Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get azure token, statusCode 400 management-1 | 2024-03-04T06:35:50Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-03-04T06:35:50Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 4116581583: GET /api/peers status 401 management-1 | 2024-03-04T06:35:59Z INFO management/server/account.go:1590: overriding JWT Domain and DomainCategory claims since single account mode is enabled management-1 | 2024-03-04T06:36:00Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get azure token, statusCode 400 management-1 | 2024-03-04T06:36:00Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-03-04T06:36:00Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 4067145076: GET /api/groups status 401 management-1 | 2024-03-04T06:36:10Z INFO management/server/account.go:1590: overriding JWT Domain and DomainCategory claims since single account mode is enabled management-1 | 2024-03-04T06:36:10Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get azure token, statusCode 400 management-1 | 2024-03-04T06:36:10Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-03-04T06:36:10Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1564696021: GET /api/users status 401 ` **Screenshots** If applicable, add screenshots to help explain your problem. ![image](https://github.com/netbirdio/netbird/assets/26152437/edb10411-8b9e-437c-b0a5-9ea78d794fdd) **Additional context** Add any other context about the problem here. I used microsoft 365 operated by 21vianet so the endpoint url is slightly different. In entra id management centre, it gives me this error: ``` 500011 The resource principal named {name} was not found in the tenant named {tenant}. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant. Developer error - the app requested access to a resource (application) that isn't installed in your tenant. If you expect the app to be installed, you may need to provide administrator permissions to add it. Check with the developers of the resource and application to understand what the right setup for your tenant is. ``` Below is my setup.env ``` ## example file, you can copy this file to setup.env and update its values ## # Image tags # you can force specific tags for each component; will be set to latest if empty NETBIRD_DASHBOARD_TAG="" NETBIRD_SIGNAL_TAG="" NETBIRD_MANAGEMENT_TAG="" COTURN_TAG="" # Dashboard domain. e.g. app.mydomain.com NETBIRD_DOMAIN="netbird.example.com" # TURN server domain. e.g. turn.mydomain.com # if not specified it will assume NETBIRD_DOMAIN NETBIRD_TURN_DOMAIN="" # TURN server public IP address # required for a connection involving peers in # the same network as the server and external peers # usually matches the IP for the domain set in NETBIRD_TURN_DOMAIN NETBIRD_TURN_EXTERNAL_IP="" # ------------------------------------------- # OIDC # e.g., https://example.eu.auth0.com/.well-known/openid-configuration # ------------------------------------------- NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://login.partner.microsoftonline.cn/<tenant-id>/v2.0/.well-known/openid-configuration" # The default setting is to transmit the audience to the IDP during authorization. However, # if your IDP does not have this capability, you can turn this off by setting it to false. #NETBIRD_DASH_AUTH_USE_AUDIENCE=false NETBIRD_AUTH_AUDIENCE="<application-id>" # e.g. netbird-client NETBIRD_AUTH_CLIENT_ID="<application-id>" # indicates the scopes that will be requested to the IDP NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api://<application-id>/api" # NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace. # NETBIRD_AUTH_CLIENT_SECRET="" # if you want to use a custom claim for the user ID instead of 'sub', set it here NETBIRD_AUTH_USER_ID_CLAIM="oid" # indicates whether to use Auth0 or not: true or false NETBIRD_USE_AUTH0="false" # if your IDP provider doesn't support fragmented URIs, configure custom # redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain. NETBIRD_AUTH_REDIRECT_URI="/auth" NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth" # Updates the preference to use id tokens instead of access token on dashboard # Okta and Gitlab IDPs can benefit from this # NETBIRD_TOKEN_SOURCE="idToken" # ------------------------------------------- # OIDC Device Authorization Flow # ------------------------------------------- NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none" NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="" # Some IDPs requires different audience, scopes and to use id token for device authorization flow # you can customize here: NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid" NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false # ------------------------------------------- # OIDC PKCE Authorization Flow # ------------------------------------------- # Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative # eg. 53000,54000 NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000" # ------------------------------------------- # IDP Management # ------------------------------------------- # eg. zitadel, auth0, azure, keycloak NETBIRD_MGMT_IDP="azure" # Some IDPs requires different client id and client secret for management api NETBIRD_IDP_MGMT_CLIENT_ID=$NETBIRD_AUTH_CLIENT_ID NETBIRD_IDP_MGMT_CLIENT_SECRET="<client-secret>" # Required when setting up with Keycloak "https://<YOUR_KEYCLOAK_HOST_AND_PORT>/admin/realms/netbird" # NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT= # With some IDPs may be needed enabling automatic refresh of signing keys on expire NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true # NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice. NETBIRD_IDP_MGMT_EXTRA_OBJECT_ID="<object-id-of-application-azure>" NETBIRD_IDP_MGMT_EXTRA_GRAPH_API_ENDPOINT="https://microsoftgraph.chinacloudapi.cn/v1.0" # ------------------------------------------- # Letsencrypt # ------------------------------------------- # Disable letsencrypt # if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead NETBIRD_DISABLE_LETSENCRYPT=true # e.g. hello@mydomain.com NETBIRD_LETSENCRYPT_EMAIL="" # ------------------------------------------- # Extra settings # ------------------------------------------- # Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection NETBIRD_DISABLE_ANONYMOUS_METRICS=true # DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted NETBIRD_MGMT_DNS_DOMAIN=netbird.example.com NETBIRD_MGMT_API_PORT=443 NETBIRD_SIGNAL_PORT=443 ```
saavagebueno added the management-servicewindowsidp labels 2026-08-05 00:49:44 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label idp management-service windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#2935
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?