OpenID with Azure AD is returning invalid_request #3877

New Issue

OVERLORD · 2026-02-05T07:44:58+03:00

OVERLORD commented

2026-02-05 07:44:58 +03:00

Originally created by @ccy1ju on GitHub (Jun 22, 2023).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

I am setting up BookStack in docker containers, and I want to have the SSO with Azure AD trough OpenID, so far this is the docker compose file:


volumes:
  db:
    external: true
    name: bookstack_db_data
  app:
    external: true
    name: bookstack_app_data

services:
  nginx-proxy:
    restart: unless-stopped
    image: {registry}/twc7fe/jwilder-nginx-proxy:v1
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - /local/home/app1/certificates:/etc/nginx/certs

  bookstack:
    image: lscr.io/linuxserver/bookstack
    container_name: bookstack
    expose:
      - "80"
    environment:
      - PUID=1000
      - PGID=1000
      - APP_URL=https://example.com
      - DB_HOST=bookstack_db
      - DB_PORT=3306
      - DB_USER=bookstack
      - DB_PASS=123456
      - DB_DATABASE=bookstackapp
      - VIRTUAL_HOST=example.com
      - VIRTUAL_PORT=80
      - AUTH_METHOD=oidc
      - AUTH_AUTO_INITIATE=false
      - OIDC_NAME=SSO
      - OIDC_DISPLAY_NAME_CLAIMS=preferred_username
      - OIDC_CLIENT_ID=client_id
      - OIDC_CLIENT_SECRET="password"
      - OIDC_ISSUER="https://login.microsoftonline.com/{tenant}/v2.0"
      - OIDC_ISSUER_DISCOVER=true
      - OIDC_DUMP_USER_DETAILS=true
      - APP_DEBUG=true
      - CURL_CA_BUNDLE=/certs/cacert.pem
    volumes:
      - app:/config
      - /local/home/app1/docker-compose/bookstack/cacert:/certs
    networks:
      - default
    restart: unless-stopped
    depends_on:
      - bookstack_db

  bookstack_db:
    image: lscr.io/linuxserver/mariadb
    container_name: bookstack_db
    environment:
      - PUID=1000
      - PGID=1000
      - MYSQL_ROOT_PASSWORD=123456
      - TZ=Europe/London
      - MYSQL_DATABASE=bookstackapp
      - MYSQL_USER=bookstack
      - MYSQL_PASSWORD=123456
    volumes:
      - db:/config
    networks:
      - default
    restart: unless-stopped

networks:
  default:
    external: true
    name: bookstack

But when I try to connect I am getting this error
production.ERROR: invalid_request {"exception":"[object] (League\OAuth2\Client\Provider\Exception\IdentityProviderException(code: 400): invalid_request at /app/www/app/Auth/Access/Oidc/OidcOAuthProvider.php:104)
With no further information.
The tenant, client and secret are correct, only the secret and the issuer are in quotes, and I tried without quotes as well, and encoding. I know I have connectivity to Azure AD because I could set the Azure AD as a third party login, but I don't want the users to be able to register themselves, instead I would give them access directly in Azure AD.
I've been the whole day here and I have no clue.
Does anyone know why this is happening?

Thanks in advance.

Exact BookStack Version

v23.05.2

Log Content

production.ERROR: invalid_request {"exception":"[object] (League\OAuth2\Client\Provider\Exception\IdentityProviderException(code: 400): invalid_request at /app/www/app/Auth/Access/Oidc/OidcOAuthProvider.php:104)

PHP Version

8.2.7

Hosting Environment

RHEL 8 server, but inside docker containers.

Originally created by @ccy1ju on GitHub (Jun 22, 2023). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario I am setting up BookStack in docker containers, and I want to have the SSO with Azure AD trough OpenID, so far this is the docker compose file: ```version: "3.9" volumes: db: external: true name: bookstack_db_data app: external: true name: bookstack_app_data services: nginx-proxy: restart: unless-stopped image: {registry}/twc7fe/jwilder-nginx-proxy:v1 ports: - "80:80" - "443:443" volumes: - /var/run/docker.sock:/tmp/docker.sock:ro - /local/home/app1/certificates:/etc/nginx/certs bookstack: image: lscr.io/linuxserver/bookstack container_name: bookstack expose: - "80" environment: - PUID=1000 - PGID=1000 - APP_URL=https://example.com - DB_HOST=bookstack_db - DB_PORT=3306 - DB_USER=bookstack - DB_PASS=123456 - DB_DATABASE=bookstackapp - VIRTUAL_HOST=example.com - VIRTUAL_PORT=80 - AUTH_METHOD=oidc - AUTH_AUTO_INITIATE=false - OIDC_NAME=SSO - OIDC_DISPLAY_NAME_CLAIMS=preferred_username - OIDC_CLIENT_ID=client_id - OIDC_CLIENT_SECRET="password" - OIDC_ISSUER="https://login.microsoftonline.com/{tenant}/v2.0" - OIDC_ISSUER_DISCOVER=true - OIDC_DUMP_USER_DETAILS=true - APP_DEBUG=true - CURL_CA_BUNDLE=/certs/cacert.pem volumes: - app:/config - /local/home/app1/docker-compose/bookstack/cacert:/certs networks: - default restart: unless-stopped depends_on: - bookstack_db bookstack_db: image: lscr.io/linuxserver/mariadb container_name: bookstack_db environment: - PUID=1000 - PGID=1000 - MYSQL_ROOT_PASSWORD=123456 - TZ=Europe/London - MYSQL_DATABASE=bookstackapp - MYSQL_USER=bookstack - MYSQL_PASSWORD=123456 volumes: - db:/config networks: - default restart: unless-stopped networks: default: external: true name: bookstack ``` But when I try to connect I am getting this error production.ERROR: invalid_request {"exception":"[object] (League\\OAuth2\\Client\\Provider\\Exception\\IdentityProviderException(code: 400): invalid_request at /app/www/app/Auth/Access/Oidc/OidcOAuthProvider.php:104) With no further information. The tenant, client and secret are correct, only the secret and the issuer are in quotes, and I tried without quotes as well, and encoding. I know I have connectivity to Azure AD because I could set the Azure AD as a third party login, but I don't want the users to be able to register themselves, instead I would give them access directly in Azure AD. I've been the whole day here and I have no clue. Does anyone know why this is happening? Thanks in advance. ### Exact BookStack Version v23.05.2 ### Log Content production.ERROR: invalid_request {"exception":"[object] (League\\OAuth2\\Client\\Provider\\Exception\\IdentityProviderException(code: 400): invalid_request at /app/www/app/Auth/Access/Oidc/OidcOAuthProvider.php:104) ### PHP Version 8.2.7 ### Hosting Environment RHEL 8 server, but inside docker containers.

OVERLORD added the 🐕 Support label 2026-02-05 07:44:58 +03:00

OVERLORD closed this issue

2026-02-05 07:45:01 +03:00

OVERLORD commented

2026-02-05 07:45:05 +03:00

@ssddanbrown commented on GitHub (Jun 22, 2023):

Nothing obvious to me based on the provided config.
invalid_request is an azure AD error, so I'd imagine the request is reaching AzureAD, unless being throw off by coincidence.

Using my video here, can you ensure you've gone down the exact same path as I do in that video? Maybe create a new AzureAD app, following the video, just to be sure so there's no chance of variance on that side of things.

@ssddanbrown commented on GitHub (Jun 22, 2023): Nothing obvious to me based on the provided config. `invalid_request` is an [azure AD error](https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-error-codes), so I'd imagine the request is reaching AzureAD, unless being throw off by coincidence. [Using my video here](https://www.youtube.com/watch?v=CL5kMFkopHY), can you ensure you've gone down the exact same path as I do in that video? Maybe create a new AzureAD app, following the video, just to be sure so there's no chance of variance on that side of things.

OVERLORD commented

2026-02-05 07:45:07 +03:00

@ccy1ju commented on GitHub (Jun 22, 2023):

Hi Dan,
Sadly I am behind a corporate network and takes like 2 weeks to have a new app registration approved.
Is there any way I can see the request that BookStack is sending?
I cannot see it in Azure due to privileges, again, corporate network

@ccy1ju commented on GitHub (Jun 22, 2023): Hi Dan, Sadly I am behind a corporate network and takes like 2 weeks to have a new app registration approved. Is there any way I can see the request that BookStack is sending? I cannot see it in Azure due to privileges, again, corporate network

OVERLORD commented

2026-02-05 07:45:13 +03:00

@ssddanbrown commented on GitHub (Jun 22, 2023):

Within the vendor/league/oauth2-client/src/Provider/AbstractProvider.php file you could insert:

dd($request, $response);

After line 635 (Before the line if (false === is_array($response)) {), which would dump both the request and full response, hopefully in a way that shows full details.

The redirect_uri is most common thing to be wrong, but could also be the client_id/secret, especially in AzureAD where there's a lot of variation in displayed ids and different options for secrets.

@ssddanbrown commented on GitHub (Jun 22, 2023): Within the `vendor/league/oauth2-client/src/Provider/AbstractProvider.php` file you could insert: ```php dd($request, $response); ``` After line 635 (Before the line `if (false === is_array($response)) {`), which would dump both the request and full response, hopefully in a way that shows full details. The `redirect_uri` is most common thing to be wrong, but could also be the client_id/secret, especially in AzureAD where there's a lot of variation in displayed ids and different options for secrets.

OVERLORD commented

2026-02-05 07:45:16 +03:00

@ccy1ju commented on GitHub (Jul 4, 2023):

Hi @ssddanbrown ,
I finally got my new app registration and I followed every step from the video and I had no luck :c
I managed to get some logs about the error and I found that is this one:
"error":"invalid_request","error_description":"AADSTS900144: The request body must contain the following parameter: 'client_id'.
When is getting the token from the token endpoint, it is not placing the option "client_id" in the request body, the request is "redirect_uri=https%3A%2F%2Fexample.com%2Foidc%2Fcallback&grant_type=authorization_code&code=0.ASEAGR7lCsg....", and that's it, no more params.
I know that the client_id is valid because the authorization endpoint is being reached and getting the code, but something happens when it gets to the token endpoint, but I cannot find why is not placing it in the request body

This is the response to the dd($request)

GuzzleHttp\Psr7\Request {#201 ▼ // vendor/league/oauth2-client/src/Provider/AbstractProvider.php:740
  -method: "POST"
  -requestTarget: null
  -uri: GuzzleHttp\Psr7\Uri {#759 ▼
    -scheme: "https"
    -userInfo: ""
    -host: "login.microsoftonline.com"
    -port: null
    -path: "/{tenant}/oauth2/v2.0/token"
    -query: ""
    -fragment: ""
    -composedComponents: "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token"
  }
  -headers: array:3 [▼
    "Host" => array:1 [▼
      0 => "login.microsoftonline.com"
    ]
    "content-type" => array:1 [▼
      0 => "application/x-www-form-urlencoded"
    ]
    "Authorization" => array:1 [▼
      0 => "Basic ZGY3OTIxZmUtY2U4MC00ZmMzLTllYjUtYTk...="
    ]
  ]
  -headerNames: array:3 [▼
    "content-type" => "content-type"
    "authorization" => "Authorization"
    "host" => "Host"
  ]
  -protocol: "1.1"
  -stream: GuzzleHttp\Psr7\Stream {#761 ▼
    -stream: stream resource @617 ▶}
    -size: 1061
    -seekable: true
    -readable: true
    -writable: true
    -uri: "php://temp"
    -customMetadata: []
  }
}

@ccy1ju commented on GitHub (Jul 4, 2023): Hi @ssddanbrown , I finally got my new app registration and I followed every step from the video and I had no luck :c I managed to get some logs about the error and I found that is this one: "error\":\"invalid_request\",\"error_description\":\"AADSTS900144: The request body must contain the following parameter: 'client_id'. When is getting the token from the token endpoint, it is not placing the option "client_id" in the request body, the request is "redirect_uri=https%3A%2F%2Fexample.com%2Foidc%2Fcallback&grant_type=authorization_code&code=0.ASEAGR7lCsg....", and that's it, no more params. I know that the client_id is valid because the authorization endpoint is being reached and getting the code, but something happens when it gets to the token endpoint, but I cannot find why is not placing it in the request body This is the response to the dd($request) ``` GuzzleHttp\Psr7\Request {#201 ▼ // vendor/league/oauth2-client/src/Provider/AbstractProvider.php:740 -method: "POST" -requestTarget: null -uri: GuzzleHttp\Psr7\Uri {#759 ▼ -scheme: "https" -userInfo: "" -host: "login.microsoftonline.com" -port: null -path: "/{tenant}/oauth2/v2.0/token" -query: "" -fragment: "" -composedComponents: "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token" } -headers: array:3 [▼ "Host" => array:1 [▼ 0 => "login.microsoftonline.com" ] "content-type" => array:1 [▼ 0 => "application/x-www-form-urlencoded" ] "Authorization" => array:1 [▼ 0 => "Basic ZGY3OTIxZmUtY2U4MC00ZmMzLTllYjUtYTk...=" ] ] -headerNames: array:3 [▼ "content-type" => "content-type" "authorization" => "Authorization" "host" => "Host" ] -protocol: "1.1" -stream: GuzzleHttp\Psr7\Stream {#761 ▼ -stream: stream resource @617 ▶} -size: 1061 -seekable: true -readable: true -writable: true -uri: "php://temp" -customMetadata: [] } } ```

OVERLORD commented

2026-02-05 07:45:21 +03:00

@ssddanbrown commented on GitHub (Jul 4, 2023):

When is getting the token from the token endpoint, it is not placing the option "client_id" in the request body, the request is "redirect_uri=https%3A%2F%2Fexample.com%2Foidc%2Fcallback&grant_type=authorization_code&code=0.ASEAGR7lCsg....", and that's it, no more params.

The data to the token endpoint call is not expected to include a client_id at all, so that's fine.
The client_id is used in the authorization step, which is the first step, long before the token request.
It's strange that you'd get that particular client_id error since it's clear you're going beyond that step in the authentication.

Are you sure that error message is current and relevant to whatever error you're currently getting?
If you are still getting the originally reported error, then dumping the response as per my last comment would be helpful to maybe get more detail in regard to what's going wrong.

@ssddanbrown commented on GitHub (Jul 4, 2023): > When is getting the token from the token endpoint, it is not placing the option "client_id" in the request body, the request is "redirect_uri=https%3A%2F%2Fexample.com%2Foidc%2Fcallback&grant_type=authorization_code&code=0.ASEAGR7lCsg....", and that's it, no more params. The data to the token endpoint call is not expected to include a `client_id` at all, so that's fine. The `client_id` is used in the authorization step, which is the first step, long before the token request. It's strange that you'd get that particular `client_id` error since it's clear you're going beyond that step in the authentication. Are you sure that error message is current and relevant to whatever error you're currently getting? If you are still getting the originally reported error, then dumping the response as per my last comment would be helpful to maybe get more detail in regard to what's going wrong.

OVERLORD commented

2026-02-05 07:45:24 +03:00

@ccy1ju commented on GitHub (Jul 4, 2023):

Yes, I modified the AbstractProvider with this

public function getParsedResponse(RequestInterface $request)
    {
        try {
            $response = $this->getResponse($request);
            // Get the response body as a string
            $body = (string) $response->getBody();

            // Log the response
            \Log::info('OAuth response', [
                'status' => $response->getStatusCode(),
                'headers' => $response->getHeaders(),
                'body' => $body
            ]);
        } catch (BadResponseException $e) {
            $response = $e->getResponse();
            $body = (string) $response->getBody();
            $logRequest = (string) $request->getBody();
            // Log the response
            \Log::info('OAuth response', [
                'status' => $response->getStatusCode(),
                'headers' => $response->getHeaders(),
                'body' => $body,
                'request' => $logRequest
            ]);
            dd($request, $response);
        }

        $parsed = $this->parseResponse($response);

        $this->checkResponse($response, $parsed);
        return $parsed;
    }

So every time the request fails I am seeing that error

    [2023-07-04 12:21:51] production.INFO: OAuth response {"status":400,"headers":{"Cache-Control":["no-store, no-cache"],"Pragma":["no-cache"],"Content-Type":["application/json; charset=utf-8"],"Expires":["-1"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains"],"X-Content-Type-Options":["nosniff"],"P3P":["CP=\"DSP CUR OTPi IND OTRi ONL FIN\""],"x-ms-request-id":["8dd935c4-23dc-4f2f-91c0-b9a3bcf80c00"],"x-ms-ests-server":["2.1.15723.5 - FRC ProdSlices"],"X-XSS-Protection":["0"],"Date":["Tue, 04 Jul 2023 12:21:50 GMT"],"Content-Length":["502"],"Connection":["keep-alive"],"Set-Cookie":["fpc=Akn25Q8L5SRCtfLk_r0OHiY; expires=Thu, 03-Aug-2023 12:21:51 GMT; path=/; secure; HttpOnly; SameSite=None","x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly","stsservicecookie=estsfd; path=/; secure; samesite=none; httponly"]},"body":"{\"error\":\"invalid_request\",\"error_description\":\"AADSTS900144: The request body must contain the following parameter: 'client_id'.\\r\\nTrace ID: 8dd935c4-23dc-4f2f-91c0-b9a3bcf80c00\\r\\nCorrelation ID: e479c4c6-5f07-43b5-9e61-db6deb6ea7f6\\r\\nTimestamp: 2023-07-04 12:21:51Z\",\"error_codes\":[900144],\"timestamp\":\"2023-07-04 12:21:51Z\",\"trace_id\":\"8dd935c4-23dc-4f2f-91c0-b9a3bcf80c00\",\"correlation_id\":\"e479c4c6-5f07-43b5-9e61-db6deb6ea7f6\",\"error_uri\":\"https://login.microsoftonline.com/error?code=900144\"}","request":"redirect_uri=https%3A%2F%2Fexample.comidc%2Fcallback&grant_type=authorization_code&code=0.ASEAGR7lCsgHS067bWSO5YQQ9P4hed-AzsNPnrWpiSSP0Q8hAAA.AgABAAIAAAD--DLA3VO7QrddgJg7WevrAgDs_wUA9P_QExAjmpVajJykAhK5KPztJVXOrfpLQOXiXn2LX8i5AhfOlRT3XcuvxzRo-PHJKkNwJM0zCfLCVJY2BLOtLnvhAHLj5htbqsM6saUhS6kZv9bhqoa5ScCLf35DS2XQDeQ-Yub3-ylfHYue0dR3Wc8ktbvMbQTkz3gfYROTBcto5gAX1OTzeAON4_Ht14Ntqkfo-kQpc6v0ENikOPtGv9R9RThzDJOzwLZpriBykQCE5ebnF1AJV1hK84Z4hnfD88jWfmFI15JDKcTxTimbz0GLdtME4ewkqz70u40wG6WqhhC_zPL2Aq4q8rukL7rl2Z0Kj6sd3y8eZOGa1yg1rndOEtOfJY3QMwoOrRkcCmesWBdRlUwAKvZcdQ6BEL1V666WPXKxmGCrYYYda7pp03Vy-djRvCHAbKKj15eA87KujO-rTkSEq7MzEKJ9l-1hPoOwKytDfR5uiqYs1lX71cpwxfJG4b_FAvMYO3uIrD0AhQuoBbYnHuEssivcG1rQ_3YxgqRpVtQPYpYXOT16nJwo14P-qrQGPQnNW5j9XFXOsSZPJHMB7LBCLcAOBhG7R8leNPZZppAxBIP5WhlUOC3f8qCXSo8iZKBB1gtaG82mT2UW4TZgwlUAqGSkwwFW5X5zM4IzP4LqNSSrG85xp5-JxrjzSjqTGHRyo7w7juRay4QnEiy70R4IEVVNK9DWxBikM1WUu03m0w4Mcpp_yelfrph6yRsx2NnKkZkxjB-qvdZiDpidzKXvaMN0T6TpZYpnzNoqnmtTUpc8XI52ICTxth5A1XLwiOHJdVdrdlgIoOSNdtNCHpxLE1lOhoYI5vlnzqArSwhAN09jJRvAxjUg1bikzI4"}

@ccy1ju commented on GitHub (Jul 4, 2023): Yes, I modified the AbstractProvider with this ```php public function getParsedResponse(RequestInterface $request) { try { $response = $this->getResponse($request); // Get the response body as a string $body = (string) $response->getBody(); // Log the response \Log::info('OAuth response', [ 'status' => $response->getStatusCode(), 'headers' => $response->getHeaders(), 'body' => $body ]); } catch (BadResponseException $e) { $response = $e->getResponse(); $body = (string) $response->getBody(); $logRequest = (string) $request->getBody(); // Log the response \Log::info('OAuth response', [ 'status' => $response->getStatusCode(), 'headers' => $response->getHeaders(), 'body' => $body, 'request' => $logRequest ]); dd($request, $response); } $parsed = $this->parseResponse($response); $this->checkResponse($response, $parsed); return $parsed; } ``` So every time the request fails I am seeing that error ``` [2023-07-04 12:21:51] production.INFO: OAuth response {"status":400,"headers":{"Cache-Control":["no-store, no-cache"],"Pragma":["no-cache"],"Content-Type":["application/json; charset=utf-8"],"Expires":["-1"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains"],"X-Content-Type-Options":["nosniff"],"P3P":["CP=\"DSP CUR OTPi IND OTRi ONL FIN\""],"x-ms-request-id":["8dd935c4-23dc-4f2f-91c0-b9a3bcf80c00"],"x-ms-ests-server":["2.1.15723.5 - FRC ProdSlices"],"X-XSS-Protection":["0"],"Date":["Tue, 04 Jul 2023 12:21:50 GMT"],"Content-Length":["502"],"Connection":["keep-alive"],"Set-Cookie":["fpc=Akn25Q8L5SRCtfLk_r0OHiY; expires=Thu, 03-Aug-2023 12:21:51 GMT; path=/; secure; HttpOnly; SameSite=None","x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly","stsservicecookie=estsfd; path=/; secure; samesite=none; httponly"]},"body":"{\"error\":\"invalid_request\",\"error_description\":\"AADSTS900144: The request body must contain the following parameter: 'client_id'.\\r\\nTrace ID: 8dd935c4-23dc-4f2f-91c0-b9a3bcf80c00\\r\\nCorrelation ID: e479c4c6-5f07-43b5-9e61-db6deb6ea7f6\\r\\nTimestamp: 2023-07-04 12:21:51Z\",\"error_codes\":[900144],\"timestamp\":\"2023-07-04 12:21:51Z\",\"trace_id\":\"8dd935c4-23dc-4f2f-91c0-b9a3bcf80c00\",\"correlation_id\":\"e479c4c6-5f07-43b5-9e61-db6deb6ea7f6\",\"error_uri\":\"https://login.microsoftonline.com/error?code=900144\"}","request":"redirect_uri=https%3A%2F%2Fexample.comidc%2Fcallback&grant_type=authorization_code&code=0.ASEAGR7lCsgHS067bWSO5YQQ9P4hed-AzsNPnrWpiSSP0Q8hAAA.AgABAAIAAAD--DLA3VO7QrddgJg7WevrAgDs_wUA9P_QExAjmpVajJykAhK5KPztJVXOrfpLQOXiXn2LX8i5AhfOlRT3XcuvxzRo-PHJKkNwJM0zCfLCVJY2BLOtLnvhAHLj5htbqsM6saUhS6kZv9bhqoa5ScCLf35DS2XQDeQ-Yub3-ylfHYue0dR3Wc8ktbvMbQTkz3gfYROTBcto5gAX1OTzeAON4_Ht14Ntqkfo-kQpc6v0ENikOPtGv9R9RThzDJOzwLZpriBykQCE5ebnF1AJV1hK84Z4hnfD88jWfmFI15JDKcTxTimbz0GLdtME4ewkqz70u40wG6WqhhC_zPL2Aq4q8rukL7rl2Z0Kj6sd3y8eZOGa1yg1rndOEtOfJY3QMwoOrRkcCmesWBdRlUwAKvZcdQ6BEL1V666WPXKxmGCrYYYda7pp03Vy-djRvCHAbKKj15eA87KujO-rTkSEq7MzEKJ9l-1hPoOwKytDfR5uiqYs1lX71cpwxfJG4b_FAvMYO3uIrD0AhQuoBbYnHuEssivcG1rQ_3YxgqRpVtQPYpYXOT16nJwo14P-qrQGPQnNW5j9XFXOsSZPJHMB7LBCLcAOBhG7R8leNPZZppAxBIP5WhlUOC3f8qCXSo8iZKBB1gtaG82mT2UW4TZgwlUAqGSkwwFW5X5zM4IzP4LqNSSrG85xp5-JxrjzSjqTGHRyo7w7juRay4QnEiy70R4IEVVNK9DWxBikM1WUu03m0w4Mcpp_yelfrph6yRsx2NnKkZkxjB-qvdZiDpidzKXvaMN0T6TpZYpnzNoqnmtTUpc8XI52ICTxth5A1XLwiOHJdVdrdlgIoOSNdtNCHpxLE1lOhoYI5vlnzqArSwhAN09jJRvAxjUg1bikzI4"} ```

OVERLORD commented

2026-02-05 07:45:26 +03:00

@ssddanbrown commented on GitHub (Jul 4, 2023):

@ccy1ju Okay, I've spent a couple of hours on this, and have been able to emulate this error manually based upon guesses/theory about what's going on.

When calling the token endpoint, BookStack authorises the request via client credentials (id and secret) passed as a header using basic auth. OAuth providers support this authorization (client_secret_basic) as standard but there's also the option of using the client id/secret in the body (client_secret_post).
I was able to emulate this by force removing the expected header used for client_secret_basic, in which case Azure appears to assume client_secret_post is in use and therefore complains about the missing client_id in the request.

In your environment, I'd guess this is arising due to one of the following:

You have some kind of proxies/firewalls in play that are stripping Authorization (Or more specifically basic auth) headers from requests.
Microsoft disables client_secret_basic support on specific accounts for some reason.

For looking into (2), can you go to the URL:

<OIDC_ISSUER_URL>/.well-known/openid-configuration

Then confirm the values under the token_endpoint_auth_methods_supported property.

@ssddanbrown commented on GitHub (Jul 4, 2023): @ccy1ju Okay, I've spent a couple of hours on this, and have been able to emulate this error manually based upon guesses/theory about what's going on. When calling the token endpoint, BookStack authorises the request via client credentials (id and secret) passed as a header using basic auth. OAuth providers support this authorization (`client_secret_basic`) as standard but there's also the option of using the client id/secret in the body (`client_secret_post`). I was able to emulate this by force removing the expected header used for `client_secret_basic`, in which case Azure appears to assume `client_secret_post` is in use and therefore complains about the missing `client_id` in the request. In your environment, I'd guess this is arising due to one of the following: 1. You have some kind of proxies/firewalls in play that are stripping `Authorization` (Or more specifically basic auth) headers from requests. 2. Microsoft disables `client_secret_basic` support on specific accounts for some reason. For looking into (2), can you go to the URL: ``` <OIDC_ISSUER_URL>/.well-known/openid-configuration ``` Then confirm the values under the `token_endpoint_auth_methods_supported` property.

OVERLORD commented

2026-02-05 07:45:31 +03:00

@ccy1ju commented on GitHub (Jul 4, 2023):

@ssddanbrown ,
The supported methods are these

But maybe it is the proxy, because indeed I am running all this behind a corporate proxy
Is there a way I can change the basic auth to post?

@ccy1ju commented on GitHub (Jul 4, 2023): @ssddanbrown , The supported methods are these ![image](https://github.com/BookStackApp/BookStack/assets/137389323/1762e015-522a-468b-b6bf-571bd06df16a) But maybe it is the proxy, because indeed I am running all this behind a corporate proxy Is there a way I can change the basic auth to post?

OVERLORD commented

2026-02-05 07:45:33 +03:00

@ssddanbrown commented on GitHub (Jul 5, 2023):

Is there a way I can change the basic auth to post?

That's not an option we provide.
It's something hardcoded here:

295cd01605/app/Access/Oidc/OidcService.php (L115)

You could change HttpBasicAuthOptionProvider to \League\OAuth2\Client\OptionProvider\PostAuthOptionProvider but I have not tested that.

I'd probably not look to make the auth method configurable either, since the existing basic auth is the more significant/spec-required option of the two, and I don't want to grow our options based upon external arbitrary corporate environment rules.

@ssddanbrown commented on GitHub (Jul 5, 2023): > Is there a way I can change the basic auth to post? That's not an option we provide. It's something hardcoded here: https://github.com/BookStackApp/BookStack/blob/295cd0160525125bbd7756d7ad07392ae7201cb8/app/Access/Oidc/OidcService.php#L115 You could change `HttpBasicAuthOptionProvider` to `\League\OAuth2\Client\OptionProvider\PostAuthOptionProvider` but I have not tested that. I'd probably **_not_** look to make the auth method configurable either, since the existing basic auth is the more significant/spec-required option of the two, and I don't want to grow our options based upon external arbitrary corporate environment rules.

OVERLORD commented

2026-02-05 07:45:36 +03:00

@ccy1ju commented on GitHub (Jul 5, 2023):

@ssddanbrown Thank you very much!!
Changing the HttpBasicAuthOptionProvider() for PostAuthOptionProvider() worked like a charm!!

@ccy1ju commented on GitHub (Jul 5, 2023): @ssddanbrown Thank you very much!! Changing the HttpBasicAuthOptionProvider() for PostAuthOptionProvider() worked like a charm!!

OVERLORD commented

2026-02-05 07:45:38 +03:00

@ssddanbrown commented on GitHub (Jul 10, 2023):

Good to hear you got something working! Just keep in mind that code edits may interfer upon updates.
Since the cause was likely found, and there are likely external influences here causing the issue, I'll go ahead and close this off.

@ssddanbrown commented on GitHub (Jul 10, 2023): Good to hear you got something working! Just keep in mind that code edits may interfer upon updates. Since the cause was likely found, and there are likely external influences here causing the issue, I'll go ahead and close this off.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3877