OIDC with ADFS

[d-sko]

Hello,

I'm trying to set up authentication with ADFS 4.0 (Windows Server 2016). I've set up an an application group in adfs with the required scopes and when I try to authenticate I'm redirected to the ADFS host and back to outline after authentication. But then Outline only shows "Authentication failed – we were unable to sign you in at this time. Please try again.". With docker compose logs I can see the following error:

outline-outline-1   | {"label":"http","level":"info","message":"  <-- GET /auth/oidc"}
outline-outline-1   | {"label":"http","level":"info","message":"  --> GET /auth/oidc 302 4ms 0b"}
outline-outline-1   | {"label":"http","level":"info","message":"  <-- GET /auth/oidc.callback?code=M3_AxfO-LEimZ88ZyGzpjQ.0Pz_iQzR2ggBAPUZCOI00ANxGTo.DtyREN3A2v1XwQLpsmKAsEXsQvZycMgo1Jv-2nswf_JkXysyk7XHmh3pL_6h0thR8aQFmHo1KzhrJeqvAOYd7qhVnAKGSYXVeeJY_szVvxbF-W0RSvTAy1uVU7kOTIxQDlGzZOo5Lx2q-HN5kKZczjkhmIesVT7mn7-kEH4E98Q8XFlX5V91IITVCyX7tZhO3fmF3STBUHrW_l59cRAYiT_ikHc_SOG_d2yQAZRvFCc0ShGBj4Ew-oMSq1Nt4QQFZ8RBudWE9bqSn5i6O_urolAufWhnXhPyVMnsxK4k-b-xG3YhpgpFrgH-INXrPwH5x0ckvQuD1dCKzsfbRxGPjg&state=cc7a1b78b5e43f0d"}
outline-outline-1   | {"error":"invalid json response body at https://<server>/adfs/userinfo reason: Unexpected end of JSON input","stack":"FetchError: invalid json response body at https://<server>/adfs/userinfo reason: Unexpected end of JSON input\n    at /opt/outline/node_modules/node-fetch/lib/index.js:273:32\n    at runMicrotasks (<anonymous>)\n    at processTicksAndRejections (node:internal/process/task_queues:96:5)\n    at async OAuth2Strategy._passportOauth.Strategy.userProfile (/opt/outline/build/server/routes/auth/providers/oidc.js:45:22)","level":"error","message":"Error during authentication"}
outline-outline-1   | {"label":"http","level":"info","message":"  --> GET /auth/oidc.callback?code=M3_AxfO-LEimZ88ZyGzpjQ.0Pz_iQzR2ggBAPUZCOI00ANxGTo.DtyREN3A2v1XwQLpsmKAsEXsQvZycMgo1Jv-2nswf_JkXysyk7XHmh3pL_6h0thR8aQFmHo1KzhrJeqvAOYd7qhVnAKGSYXVeeJY_szVvxbF-W0RSvTAy1uVU7kOTIxQDlGzZOo5Lx2q-HN5kKZczjkhmIesVT7mn7-kEH4E98Q8XFlX5V91IITVCyX7tZhO3fmF3STBUHrW_l59cRAYiT_ikHc_SOG_d2yQAZRvFCc0ShGBj4Ew-oMSq1Nt4QQFZ8RBudWE9bqSn5i6O_urolAufWhnXhPyVMnsxK4k-b-xG3YhpgpFrgH-INXrPwH5x0ckvQuD1dCKzsfbRxGPjg&state=cc7a1b78b5e43f0d 302 150ms 69b"}

The OIDC-Config in Outline looks like this:

OIDC_CLIENT_ID=<redacted>
OIDC_CLIENT_SECRET=<redacted>
OIDC_AUTH_URI=https://<server>/adfs/oauth2/authorize
OIDC_TOKEN_URI=https://<server>/adfs/oauth2/token
OIDC_USERINFO_URI=https://<server>/adfs/userinfo
OIDC_USERNAME_CLAIM=email
OIDC_DISPLAY_NAME=ADFS
OIDC_SCOPES=openid profile email

I'm not sure whats wrong. How can I check why there is an Unexpected end of JSON? Is there any debug option to see the actual userinfo-response? Do I need to add a specific claim transformation? Has someone got it working with ADFS?

I've seen the discussion #2716 with a similar error message, but the solutions there (removing ALLOWED_DOMAINS from env and defining OIDC_SCOPES without quotes) didn't help as I don't have ALLOWED_DOMAINS set at all and OIDC_SCOPES don't have quotes as per example env file.

EDIT:
I've enabled the debug log of ADFS and get the following log entries when trying to log into outline:

Sending response at time: '2022-11-28 13:35:51' with StatusCode: '401' and StatusDescription: 'Unauthorized'.
Response headers set: {"WWW-Authenticate":"Bearer error=\"invalid_token\", error_description=\"MSIS9921: Received invalid UserInfo request. Audience \u0027microsoft:identityserver:ed20c00b-b79c-4447-a264-ca4386b34608\u0027 in the access token is not same as the identifier of the UserInfo relying party trust \u0027urn:microsoft:userinfo\u0027.\"","Content-Type":"text/html; charset=utf-8"}

UserInfoListener.WriteErrorResponse: The UserInfo endpoint meets error when process the requset. Writing error response.

UserInfoListener.ValidateAccessToken: The access token in the request doesn't have required audience 'urn:microsoft:userinfo'. Actual audience 'microsoft:identityserver:ed20c00b-b79c-4447-a264-ca4386b34608'

[ksyblast]

Exactly the same issue with ADFS

[ksyblast]

Could anybody manage outline OIDC working with ADFS? Any help is appreciated. Is there any option to debug OIDC messages?

[Siarhei-Maltsau]

I also have the same issue. I guess the best solution will be detailed wiki page on how to setup OIDC with MS ADFS...

[ksyblast]

Looks like it's something related to https://serverfault.com/questions/1109792/setting-up-oidc-with-adfs-invalid-userinfo-request
However it's unclear how to fix that

[RichardLourens]

Anyone found a solution to this? Banging my head against this problem for a while now.

I'm getting redirected back to outline from ADFS, then the following error:
"Failed to parse response from https://adfs.test.local/adfs/userinfo. Expected JSON, got: "

With an invalid token being send:
Bearer error="invalid_token", error_description="MSIS9921: Received invalid UserInfo request. Audience 'microsoft:identityserver:[client_identifier]' in the access token is not same as the identifier of the UserInfo relying party trust 'urn:microsoft:userinfo'."

I know its caused by the fact that microsoft deviates from the OIDC spec and requires a 'resource' parameter to be passed during authentication. But as far I can see, is not possible to pass this from outline.