User authentification with Azure AD (social login) #3248

New Issue

OVERLORD · 2026-02-05T06:11:53+03:00

OVERLORD commented

2026-02-05 06:11:53 +03:00

Originally created by @LbqpdL on GitHub (Oct 6, 2022).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

First of all many thanks to the Devs for this tool.

My end goal is to manage my bookstack users from Azure AD. I'm using the Azure AD "free tier" (provided through an Office365 account) which does not come with Azure AD DS (Azure Active Directory Domain Services).

I followed https://www.bookstackapp.com/docs/admin/third-party-auth/ and added the following to my .env file:

AZURE_AUTO_REGISTER=true
AZURE_AUTO_CONFIRM_EMAIL=true
AZURE_APP_ID=redacted
AZURE_APP_SECRET=redacted
AZURE_TENANT=redacted

I can now see the "Connect with Azure" option on the login page.

I'm facing two different behaviours, based on whether a user exists already.

Existing user

The connection fails with error message "A user with the address name@domain.tld already exists".
Using the standard login for the existing user, I can then in Config > Users > User detail select in "Social networks" > "Link account"
After this step, it is possible to connect either through standard login, or through Azure AD.

Questions:

Is it possible to "merge" the standard and Azure AD account in Bookstack, or do I need to keep both accounts ?
Is there a way to "link" all existing users (as presented in the SAML video mentionned below), or is it something that each user as to do themselves ? I tried to link accounts as in the video but it did not work.
If I delete an existing account and recreate it through Azure AD (with same email address), will the existing contributions be recognised automatically ? Is there a way to reconciliate the previous contributions with the new user ?

Non-existing user

I have attributed an existing role to all new accounts (Editor).
At first login, a confirmation message says that the account has been created. I can see the account with Editor rights (the option to link the account to Azure is no longer present on this user, which makes sense).
However the user is thrown back to "login page" everytime he tries to access any wiki pages. The only page that seems to be available is the welcome page (even though all other users with Editor rights have access to everything).

Questions:

What am I missing ?

Other approach ?

As stated in another issue (https://github.com/BookStackApp/BookStack/issues/3601) "If you're looking to use AzureAD as your main/only auth option, and you want to provide a seamless experience, our SAML2 and OIDC options can both work with AzureAD I believe, with SAML2 having group/role sync support with BookStack (OIDC will gain this in the future). There are a bit more complex to set-up, but may work better (depending on environment and requirements)."

I watched the video on SAML2 configuration (https://www.youtube.com/watch?v=szweYsAow88).

Would there be any ressource / tutorial / pointers to get it working with Azure AD ?

Many thanks for you help.

Exact BookStack Version

BookStack v22.09.1

Log Content

No response

PHP Version

No response

Hosting Environment

Proxmox --> Debian VM / Docker LinuxServer.io SWAG reverse proxy --> Debian VM / Docker LinuxServer.io Bookstack image (docker compose)

Originally created by @LbqpdL on GitHub (Oct 6, 2022). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario First of all many thanks to the Devs for this tool. My end goal is to manage my bookstack users from Azure AD. I'm using the Azure AD "free tier" (provided through an Office365 account) which does **not** come with Azure AD DS (Azure Active Directory Domain Services). I followed https://www.bookstackapp.com/docs/admin/third-party-auth/ and added the following to my .env file: AZURE_AUTO_REGISTER=true AZURE_AUTO_CONFIRM_EMAIL=true AZURE_APP_ID=redacted AZURE_APP_SECRET=redacted AZURE_TENANT=redacted I can now see the "Connect with Azure" option on the login page. I'm facing two different behaviours, based on whether a user exists already. ### Existing user The connection fails with **error message** "A user with the address name@domain.tld already exists". Using the standard login for the existing user, I can then in Config > Users > User detail select in "Social networks" > "Link account" After this step, it is possible to connect either through standard login, or through Azure AD. **Questions:** 1. Is it possible to "merge" the standard and Azure AD account in Bookstack, or do I need to keep both accounts ? 2. Is there a way to "link" all existing users (as presented in the SAML video mentionned below), or is it something that each user as to do themselves ? I tried to link accounts as in the video but it did not work. 3. If I delete an existing account and recreate it through Azure AD (with same email address), will the existing contributions be recognised automatically ? Is there a way to reconciliate the previous contributions with the new user ? ### Non-existing user I have attributed an existing role to all new accounts (Editor). At first login, a confirmation message says that the account has been created. I can see the account with Editor rights (the option to link the account to Azure is no longer present on this user, which makes sense). However the user is **thrown back to "login page"** everytime he tries to access any wiki pages. The only page that seems to be available is the welcome page (even though all other users with Editor rights have access to everything). **Questions:** 4. What am I missing ? ### Other approach ? As stated in another issue (https://github.com/BookStackApp/BookStack/issues/3601) "If you're looking to use AzureAD as your main/only auth option, and you want to provide a seamless experience, our SAML2 and OIDC options can both work with AzureAD I believe, with SAML2 having group/role sync support with BookStack (OIDC will gain this in the future). There are a bit more complex to set-up, but may work better (depending on environment and requirements)." I watched the video on SAML2 configuration (https://www.youtube.com/watch?v=szweYsAow88). Would there be any ressource / tutorial / pointers to get it working with Azure AD ? Many thanks for you help. ### Exact BookStack Version BookStack v22.09.1 ### Log Content _No response_ ### PHP Version _No response_ ### Hosting Environment Proxmox --> Debian VM / Docker LinuxServer.io SWAG reverse proxy --> Debian VM / Docker LinuxServer.io Bookstack image (docker compose)

OVERLORD added the 🐕 Support label 2026-02-05 06:11:53 +03:00

OVERLORD closed this issue

2026-02-05 06:12:00 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3248