Azure Authentication #2924

New Issue

OVERLORD · 2026-02-05T05:45:08+03:00

OVERLORD commented

2026-02-05 05:45:08 +03:00

Originally created by @corbing on GitHub (Jul 28, 2022).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

I have followed the authentication procedures for AzureAD (Microsoft) found in the docs. When I try to "login with Microsoft Azure" it asks for my credentials and then fails with a generic message:
An Error Occurred
An unknown error occurred
RETURN TO HOME

If I attempt to login again, it just immediately fails with the generic error above without requesting my MS credentials. I have rechecked all of the Azure IDs and even got a new APP_SECRET.

See below for the log error.

Exact BookStack Version

22.06.2

Log Content

[2022-07-28 02:44:24] production.ERROR: Client error: `POST https://login.microsoftonline.com/41e004fe-4b46-48c0>
{"error":"invalid_client","error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor >
 {"exception":"[object] (GuzzleHttp\\Exception\\ClientException(code: 401): Client error: `POST https://login.mi>
{\"error\":\"invalid_client\",\"error_description\":\"AADSTS700025: Client is public so neither 'client_assertio>
 at /var/www/bookstack/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php:113)

PHP Version

No response

Hosting Environment

Ubuntu 22.04 x64 on Digital Ocean installed via official script. https installed via certbot instructions.

# Application key
APP_KEY=base64:6Uy1uab1HJ4P<snip>

# Application URL
APP_URL=https://<snip>

# Active Directory Authenticaion with Microsoft 365
AZURE_APP_ID=c2a5e<snip>
AZURE_APP_SECRET=Jto8Q~<snip>
AZURE_TENANT=41e004fe-<snip>

Originally created by @corbing on GitHub (Jul 28, 2022). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario I have followed the authentication procedures for AzureAD (Microsoft) found in the docs. When I try to "login with Microsoft Azure" it asks for my credentials and then fails with a generic message: An Error Occurred An unknown error occurred RETURN TO HOME If I attempt to login again, it just immediately fails with the generic error above without requesting my MS credentials. I have rechecked all of the Azure IDs and even got a new APP_SECRET. See below for the log error. ### Exact BookStack Version 22.06.2 ### Log Content ``` [2022-07-28 02:44:24] production.ERROR: Client error: `POST https://login.microsoftonline.com/41e004fe-4b46-48c0> {"error":"invalid_client","error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor > {"exception":"[object] (GuzzleHttp\\Exception\\ClientException(code: 401): Client error: `POST https://login.mi> {\"error\":\"invalid_client\",\"error_description\":\"AADSTS700025: Client is public so neither 'client_assertio> at /var/www/bookstack/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php:113) ``` ### PHP Version _No response_ ### Hosting Environment Ubuntu 22.04 x64 on Digital Ocean installed via official script. https installed via certbot instructions. ``` # Application key APP_KEY=base64:6Uy1uab1HJ4P<snip> # Application URL APP_URL=https://<snip> # Active Directory Authenticaion with Microsoft 365 AZURE_APP_ID=c2a5e<snip> AZURE_APP_SECRET=Jto8Q~<snip> AZURE_TENANT=41e004fe-<snip> ```

OVERLORD added the 🐕 Support label 2026-02-05 05:45:08 +03:00

OVERLORD closed this issue

2026-02-05 05:45:14 +03:00

OVERLORD commented

2026-02-05 05:45:18 +03:00

@ssddanbrown commented on GitHub (Jul 28, 2022):

Hi @corbing,

From what I can find, this error can often be to the wrong type of application being created or due to non-expected settings being active.

Has this definitely been set-up as a standard app registration? Does it show anything in the top-left of the azure view about being an "Enterprise Application"?
When viewing the "Overview" page for the app registration, what is the text shown under the "Redirect URIs" property?
On the "Authentication" page for the app registration, is the "Allow public client flows" option enabled?

@ssddanbrown commented on GitHub (Jul 28, 2022): Hi @corbing, From what I can find, this error can often be to the wrong type of application being created or due to non-expected settings being active. - Has this definitely been set-up as a standard app registration? Does it show anything in the top-left of the azure view about being an "Enterprise Application"? - When viewing the "Overview" page for the app registration, what is the text shown under the "Redirect URIs" property? - On the "Authentication" page for the app registration, is the "Allow public client flows" option enabled?

OVERLORD commented

2026-02-05 05:45:26 +03:00

@corbing commented on GitHub (Jul 28, 2022):

Thank you for your help, Dan!

Has this definitely been set-up as a standard app registration?

It appears to be a standard app. It does not show "Enterprise Application" in the upper left on any of the Manage options. If I click the application name on the Overview page under the text "Managed application in local directory" then it goes to an area where I can set it up as an Enterprise Application and it does say "Enterprise Application" in the upper left. But, none of that is configured.

When viewing the "Overview" page for the app registration, what is the text shown under the "Redirect URIs" property?

It says:
Redirect URIs
0 web, 0 spa, 1 public client

If I click on that link it then shows:
Redirect URIs
https://domain/login/service/azure/callback

On the "Authentication" page for the app registration, is the "Allow public client flows" option enabled?

No, it was not. But, I enabled that option and still get the same results.

@corbing commented on GitHub (Jul 28, 2022): Thank you for your help, Dan! > * Has this definitely been set-up as a standard app registration? It appears to be a standard app. It does not show "Enterprise Application" in the upper left on any of the Manage options. If I click the application name on the Overview page under the text "Managed application in local directory" then it goes to an area where I can set it up as an Enterprise Application and it does say "Enterprise Application" in the upper left. But, none of that is configured. > * When viewing the "Overview" page for the app registration, what is the text shown under the "Redirect URIs" property? It says: Redirect URIs 0 web, 0 spa, 1 public client If I click on that link it then shows: Redirect URIs https://domain/login/service/azure/callback > * On the "Authentication" page for the app registration, is the "Allow public client flows" option enabled? No, it was not. But, I enabled that option and still get the same results.

OVERLORD commented

2026-02-05 05:45:31 +03:00

@ssddanbrown commented on GitHub (Jul 28, 2022):

No, it was not. But, I enabled that option and still get the same results.

Okay, leave that disabled, I was just checking it's not active.

It says:
Redirect URIs
0 web, 0 spa, 1 public client

This indicates to me that the wrong type of configured platform maybe.
Within the "Authentication" page of the app registration, you should have a "Web" type of application (With redirects) under the "Platform configurations" section. What do you have here?

@ssddanbrown commented on GitHub (Jul 28, 2022): > No, it was not. But, I enabled that option and still get the same results. Okay, leave that disabled, I was just checking it's not active. > It says: > Redirect URIs > 0 web, 0 spa, 1 public client This indicates to me that the wrong type of configured platform maybe. Within the "Authentication" page of the app registration, you should have a "Web" type of application (With redirects) under the "Platform configurations" section. What do you have here?

OVERLORD commented

2026-02-05 05:45:34 +03:00

@corbing commented on GitHub (Jul 28, 2022):

This indicates to me that the wrong type of configured platform maybe.

Bingo! That was the issue! I guess by default it configures it as a "mobile or desktop application". I added the web platform, updated the URI, and everything started working.

I very much appreciate your help! Look forward to diving in now!

@corbing commented on GitHub (Jul 28, 2022): > This indicates to me that the wrong type of configured platform maybe. Bingo! That was the issue! I guess by default it configures it as a "mobile or desktop application". I added the web platform, updated the URI, and everything started working. I very much appreciate your help! Look forward to diving in now!

OVERLORD commented

2026-02-05 05:45:37 +03:00

@ssddanbrown commented on GitHub (Jul 28, 2022):

@corbing Happy to help, I think the "Platform" box when creating the application is new, I've just updated our docs with a mention to set this to "Web" to help prevent future confusion.

Just an added note, If you're looking to use AzureAD as your main/only auth option, and you want to provide a seamless experience, Our SAML2 and OIDC options can both work with AzureAD I believe, with SAML2 having group/role sync support with BookStack (OIDC will gain this in the future). There are a bit more complex to set-up, but may work better (depending on environment and requirements. I do have videos covering these auth options on our YouTube channel, albeit no videos specifically for AzureAD.

@ssddanbrown commented on GitHub (Jul 28, 2022): @corbing Happy to help, I think the "Platform" box when creating the application is new, I've just updated our docs with a mention to set this to "Web" to help prevent future confusion. Just an added note, If you're looking to use AzureAD as your main/only auth option, and you want to provide a seamless experience, Our SAML2 and OIDC options can both work with AzureAD I believe, with SAML2 having group/role sync support with BookStack (OIDC will gain this in the future). There are a bit more complex to set-up, but may work better (depending on environment and requirements. I do have videos covering these auth options on our [YouTube channel](https://www.youtube.com/c/BookStackApp), albeit no videos specifically for AzureAD.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#2924