SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-14 20:21:59 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Loading loop after connection with IDP Azure #1091

New Issue
Closed
opened 2025-11-20 05:23:55 -05:00 by saavagebueno · 6 comments
saavagebueno commented 2025-11-20 05:23:55 -05:00
Owner
Copy Link

Originally created by @Kipsz on GitHub (Jul 25, 2024).

I set up the setup.env file as described in the documentation, but I get an error in the management container logs:

Error: failed retrieving a new idp manager with err: azure IdP configuration is incomplete, GraphAPIEndpoint is missing.

I've double-checked the doc and the problems reported here several times, but I can't seem to make any progress....

here is my setup.env :
image

Originally created by @Kipsz on GitHub (Jul 25, 2024). I set up the setup.env file as described in the documentation, but I get an error in the management container logs: **_Error: failed retrieving a new idp manager with err: azure IdP configuration is incomplete, GraphAPIEndpoint is missing._** I've double-checked the doc and the problems reported here several times, but I can't seem to make any progress.... here is my setup.env : ![image](https://github.com/user-attachments/assets/1db09e70-26d7-406e-be6f-614e5d2c733d)
saavagebueno added the waiting-feedbackidpconfig-issueazure labels 2025-11-20 05:23:55 -05:00
saavagebueno commented 2025-11-20 05:23:56 -05:00
Author
Owner
Copy Link

@robdeweese commented on GitHub (Jul 25, 2024):

I think on mine, I hade to change my mgmt idp to "none"

@robdeweese commented on GitHub (Jul 25, 2024): I think on mine, I hade to change my mgmt idp to "none"
saavagebueno commented 2025-11-20 05:23:56 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Jul 26, 2024):

No idea whats missing but here is my config to compare:

openid-configuration.json:
openid-configuration.json {"token_endpoint":"https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token","token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt","client_secret_basic"],"jwks_uri":"https://login.microsoftonline.com/TENANT-ID/discovery/v2.0/keys","response_modes_supported":["query","fragment","form_post"],"subject_types_supported":["pairwise"],"id_token_signing_alg_values_supported":["RS256"],"response_types_supported":["code","id_token","code id_token","id_token token"],"scopes_supported":["openid","profile","email","offline_access"],"issuer":"https://login.microsoftonline.com/TENANT-ID/v2.0","request_uri_parameter_supported":false,"userinfo_endpoint":"https://graph.microsoft.com/oidc/userinfo","authorization_endpoint":"https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/authorize","device_authorization_endpoint":"https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/devicecode","http_logout_supported":true,"frontchannel_logout_supported":true,"end_session_endpoint":"https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/logout","claims_supported":["sub","iss","cloud_instance_name","cloud_instance_host_name","cloud_graph_host_name","msgraph_host","aud","exp","iat","auth_time","acr","nonce","preferred_username","name","tid","ver","at_hash","c_hash","email"],"kerberos_endpoint":"https://login.microsoftonline.com/TENANT-ID/kerberos","tenant_region_scope":"EU","cloud_instance_name":"microsoftonline.com","cloud_graph_host_name":"graph.windows.net","msgraph_host":"graph.microsoft.com","rbac_url":"https://pas.windows.net"}

docker-compose.yml:

version: "3"
services:
  #UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.MY-DOMAIN.com:33073
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.MY-DOMAIN.com:33073
      # OIDC
      - AUTH_AUDIENCE=APPLICATION-ID
      - AUTH_CLIENT_ID=APPLICATION-ID
      - AUTH_CLIENT_SECRET= # NOT SURE WHY THIS IS EMPTY ON MINE > The secret is in management.json 
      - AUTH_AUTHORITY=https://login.microsoftonline.com/TENANT-ID/v2.0
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access User.Read api://APPLICATION-ID/api
      - AUTH_REDIRECT_URI=/auth
      - AUTH_SILENT_REDIRECT_URI=/silent-auth
      - NETBIRD_TOKEN_SOURCE=idToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=netbird.MY-DOMAIN.com
      - LETSENCRYPT_EMAIL=me@MY-DOMAIN.com

management.json:

{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:netbird.MYDOMAIN.com:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:netbird.MYDOMAIN.com:3478",
                "Username": "self",
                "Password": "PASSWORD
            }
        ]
    },
    "Signal": {
        "Proto": "http",
        "URI": "netbird.MYDOMAIN.com:10000",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "Encryption-KEY",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "/etc/letsencrypt/live/netbird.MYDOMAIN.com/fullchain.pem",
        "CertKey": "/etc/letsencrypt/live/netbird.MYDOMAIN.com/privkey.pem",
        "AuthAudience": "APPLICATION-ID",
        "AuthIssuer": "https://login.microsoftonline.com/TENANT-ID/v2.0",
        "AuthUserIDClaim": "oid",
        "AuthKeysLocation": "https://login.microsoftonline.com/TENANT-ID/discovery/v2.0/keys",
        "OIDCConfigEndpoint": "https://login.microsoftonline.com/TENANT-ID/v2.0/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false
    },
    "IdpManagerConfig": {
        "ManagerType": "azure",
        "ClientConfig": {
            "Issuer": "https://login.microsoftonline.com/TENANT-ID/v2.0",
            "TokenEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token",
            "ClientID": "APPLICATION-ID",
            "ClientSecret": "MY-Entra-ID-SECRET",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "GraphApiEndpoint": "https://graph.microsoft.com/v1.0",
            "ObjectId": "Object-ID-Of-Entra-ID-AppRegistration"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "none",
        "ProviderConfig": {
            "ClientID": "",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "APPLICATION-ID",
            "TokenEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token",
            "DeviceAuthEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/devicecode",
            "AuthorizationEndpoint": "",
            "Scope": "openid",
            "UseIDToken": false,
            "RedirectURLs": null
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "APPLICATION-ID",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "APPLICATION-ID",
            "TokenEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/authorize",
            "Scope": "openid profile email offline_access User.Read api://APPLICATION-ID/api",
            "UseIDToken": true,
            "RedirectURLs": [
                "http://localhost:53000"
            ]
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}%
@florian-obradovic commented on GitHub (Jul 26, 2024): No idea whats missing but here is my config to compare: **openid-configuration.json:** `openid-configuration.json {"token_endpoint":"https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token","token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt","client_secret_basic"],"jwks_uri":"https://login.microsoftonline.com/TENANT-ID/discovery/v2.0/keys","response_modes_supported":["query","fragment","form_post"],"subject_types_supported":["pairwise"],"id_token_signing_alg_values_supported":["RS256"],"response_types_supported":["code","id_token","code id_token","id_token token"],"scopes_supported":["openid","profile","email","offline_access"],"issuer":"https://login.microsoftonline.com/TENANT-ID/v2.0","request_uri_parameter_supported":false,"userinfo_endpoint":"https://graph.microsoft.com/oidc/userinfo","authorization_endpoint":"https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/authorize","device_authorization_endpoint":"https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/devicecode","http_logout_supported":true,"frontchannel_logout_supported":true,"end_session_endpoint":"https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/logout","claims_supported":["sub","iss","cloud_instance_name","cloud_instance_host_name","cloud_graph_host_name","msgraph_host","aud","exp","iat","auth_time","acr","nonce","preferred_username","name","tid","ver","at_hash","c_hash","email"],"kerberos_endpoint":"https://login.microsoftonline.com/TENANT-ID/kerberos","tenant_region_scope":"EU","cloud_instance_name":"microsoftonline.com","cloud_graph_host_name":"graph.windows.net","msgraph_host":"graph.microsoft.com","rbac_url":"https://pas.windows.net"}` **docker-compose.yml:** ``` version: "3" services: #UI dashboard dashboard: image: netbirdio/dashboard:latest restart: unless-stopped ports: - 80:80 - 443:443 environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.MY-DOMAIN.com:33073 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.MY-DOMAIN.com:33073 # OIDC - AUTH_AUDIENCE=APPLICATION-ID - AUTH_CLIENT_ID=APPLICATION-ID - AUTH_CLIENT_SECRET= # NOT SURE WHY THIS IS EMPTY ON MINE > The secret is in management.json - AUTH_AUTHORITY=https://login.microsoftonline.com/TENANT-ID/v2.0 - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access User.Read api://APPLICATION-ID/api - AUTH_REDIRECT_URI=/auth - AUTH_SILENT_REDIRECT_URI=/silent-auth - NETBIRD_TOKEN_SOURCE=idToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN=netbird.MY-DOMAIN.com - LETSENCRYPT_EMAIL=me@MY-DOMAIN.com ``` **management.json:** ``` { "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.MYDOMAIN.com:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:netbird.MYDOMAIN.com:3478", "Username": "self", "Password": "PASSWORD } ] }, "Signal": { "Proto": "http", "URI": "netbird.MYDOMAIN.com:10000", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "Encryption-KEY", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "/etc/letsencrypt/live/netbird.MYDOMAIN.com/fullchain.pem", "CertKey": "/etc/letsencrypt/live/netbird.MYDOMAIN.com/privkey.pem", "AuthAudience": "APPLICATION-ID", "AuthIssuer": "https://login.microsoftonline.com/TENANT-ID/v2.0", "AuthUserIDClaim": "oid", "AuthKeysLocation": "https://login.microsoftonline.com/TENANT-ID/discovery/v2.0/keys", "OIDCConfigEndpoint": "https://login.microsoftonline.com/TENANT-ID/v2.0/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false }, "IdpManagerConfig": { "ManagerType": "azure", "ClientConfig": { "Issuer": "https://login.microsoftonline.com/TENANT-ID/v2.0", "TokenEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token", "ClientID": "APPLICATION-ID", "ClientSecret": "MY-Entra-ID-SECRET", "GrantType": "client_credentials" }, "ExtraConfig": { "GraphApiEndpoint": "https://graph.microsoft.com/v1.0", "ObjectId": "Object-ID-Of-Entra-ID-AppRegistration" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "none", "ProviderConfig": { "ClientID": "", "ClientSecret": "", "Domain": "", "Audience": "APPLICATION-ID", "TokenEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token", "DeviceAuthEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/devicecode", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "APPLICATION-ID", "ClientSecret": "", "Domain": "", "Audience": "APPLICATION-ID", "TokenEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/authorize", "Scope": "openid profile email offline_access User.Read api://APPLICATION-ID/api", "UseIDToken": true, "RedirectURLs": [ "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } }% ```
saavagebueno commented 2025-11-20 05:23:56 -05:00
Author
Owner
Copy Link

@Kipsz commented on GitHub (Jul 26, 2024):

Thank you for sharing your conf @florian-obradovic

It works! The content of the Scope line was empty in the PKCEAuthorizationFlow block in the management.json file.

image

Netbird displays a UserID that is impossible to remember. How can I retrieve the first name, surname and email?
image

EDIT :
Without any change on my part and from one second to the next, I can no longer access the interface with the following error :

image

image

@Kipsz commented on GitHub (Jul 26, 2024): Thank you for sharing your conf @florian-obradovic It works! The content of the Scope line was empty in the PKCEAuthorizationFlow block in the management.json file. ![image](https://github.com/user-attachments/assets/a185ebaf-2854-448e-b6cb-00f76de9f06a) Netbird displays a UserID that is impossible to remember. How can I retrieve the first name, surname and email? ![image](https://github.com/user-attachments/assets/10497542-d4c8-4126-b276-57c309004d45) **EDIT :** Without any change on my part and from one second to the next, I can no longer access the interface with the following error : ![image](https://github.com/user-attachments/assets/478c9e48-e0cb-418e-8030-037a2643491d) ![image](https://github.com/user-attachments/assets/e647fea9-cfc2-4150-bb9c-a4907807b316)
saavagebueno commented 2025-11-20 05:23:56 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Jul 26, 2024):

I would suggest to follow the steps of https://docs.netbird.io/selfhosted/identity-providers#azure-ad-microsoft-entra-id
Looks like you don't submit the names, etc but only the object id.

@florian-obradovic commented on GitHub (Jul 26, 2024): I would suggest to follow the steps of https://docs.netbird.io/selfhosted/identity-providers#azure-ad-microsoft-entra-id Looks like you don't submit the names, etc but only the object id.
saavagebueno commented 2025-11-20 05:23:56 -05:00
Author
Owner
Copy Link

@Kipsz commented on GitHub (Jul 29, 2024):

I would suggest to follow the steps of https://docs.netbird.io/selfhosted/identity-providers#azure-ad-microsoft-entra-id Looks like you don't submit the names, etc but only the object id.

I found my problem, I was not redoing a ./configure.sh when I changed my setup.env
So now I access the netbird interface with NETBIRD_MGMT_IDP=‘none’ in my setup.env (thank you @robdeweese )

However, I don't have admin rights to configure NetBird, is there anything I can do on the Azure side for that?

@Kipsz commented on GitHub (Jul 29, 2024): > I would suggest to follow the steps of https://docs.netbird.io/selfhosted/identity-providers#azure-ad-microsoft-entra-id Looks like you don't submit the names, etc but only the object id. I found my problem, I was not redoing a ./configure.sh when I changed my setup.env So now I access the netbird interface with NETBIRD_MGMT_IDP=‘none’ in my setup.env (thank you @robdeweese ) However, I don't have admin rights to configure NetBird, is there anything I can do on the Azure side for that?
saavagebueno commented 2025-11-20 05:23:56 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 23, 2025):

@Kipsz did you manage to resolve the issue? Can we close this?

@nazarewk commented on GitHub (Apr 23, 2025): @Kipsz did you manage to resolve the issue? Can we close this?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label azure config-issue idp waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1091
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?