Selft Hosted Azure AD Connect not working

[sbetzin]

User authentication with Azure AD app fails. User Profile info returned from the graph api returns an error:
{"error":"Cannot read properties of undefined (reading '0')","stack":"TypeError: Cannot read properties of undefined (reading '0')\n at Strategy._verify (/opt/outline/build/server/routes/auth/providers/azure.js:76:54)\n at processTicksAndRejections (node:internal/process/task_queues:96:5)","level":"error","message":"Error during authentication"}

• User can log into other applications
• has all necessary app
  
• Graph Explorer returns all needed Info for the user (https://graph.microsoft.com/v1.0/me)
  

To Reproduce
Steps to reproduce the behavior:

1. Install latest docker version with Azure AD Env Configuration.
2. Setup an Azure AD Application
3. Login into Outline using MS Organization Account
4. Show docker console output

Expected behavior
User is logged in.

Screenshots

Outline (please complete the following information):

• Install: self hosted
• Version: outlinewiki/outline latest version

Desktop (please complete the following information):

• OS: Ubuntu 18
• Browser edge
• Version 101.0.1210.39

[tommoor]

Hmm, which error is it – your screenshot and the error in the description are different?

[sbetzin]

The first error in the screenshot is an error which occurs wenn an AD user logs in without an exchange mailbox. That means the email field in the returning json is not there or null. Therefore I changed the user which has an exchange mailbox and an email. After that the other errors occured. These should be the same as in the description

[tommoor]

What is returned for the https://graph.microsoft.com/v1.0/organization endpoint? It seems as though it's not returning the organization details as expected

[N4v41]

Hi @sbetzin,
my api permissions are a little different:

try adding the User.Read permission and remove openid.

[sbetzin]

Hi, ok, changed the permissions and that worked for users with mailboxes!
Originally I took the permissions from:
https://app.getoutline.com/share/770a97da-13e5-401e-9f8a-37949c19f97e/doc/microsoft-azure-UVz6jsIOcv

So, should I open up a separate bug for users without exchange mailbox -> email is missing?

[tommoor]

Weird, the hosted production application does not request this permission.

Re: Users without a mailbox - I don't want to support it at this time, if we build in email management and verification into Outline then we can probably remove the requirement then.

[sbetzin]

Hi Tom,
that is a pity. I am responsible to a large non profit organization (150+ users). We use Azure AD to authenticate these users and an email relay to an external smtp to handle mails to these users.
As a wiki we used wikijs (the auth with these environmet works fine there) but we are not happy with the functionality.

As a work around you could provide a json query where to get the mail from? Because in M365 all the usernames are emails.

[tommoor]

That's interesting. The field is userPrincipalName – could be something we can auto-detect and fallback to using

[guillaumemeyer]

Got the same issue now...

[FelixKLG]

@tommoor Idk if this helps however I believe the 0. at the start of the code is breaking it.