Designer Authentication with OpenID from Microsoft Entra

Ignition
1

I am trying to setup MS Entra with Open ID as an Identity Provider. I got Gateway login working successfully but when I try to sign into our gateway with Designer Authentication Strategy set to Identity Provider it redirects me to my organizations login page but then upon attempting to log in I get an Internal Server Error.

image
image1532×927 133 KB

I am trying to set this up on a local gateway first so my redirect URI is just localhost:8088. This works with the gateway but not with the designer and I’m not sure if this is part of the issue. I double checked the Role requirements and those show up in the Test Login on the gateway so I do have the correct permissions when I sign in on the gateway so I don’t think that is the issue.

image
image1383×731 50.9 KB

2

I am having this same issue, did you ever find a resolution?

Ignition 8.1.50 - Using Entra and ODIC as the identity provider works great for the gateway, but the designer does not work.

The login process works, and the callback URL from Entra is to the gateway.. that then redirects to localhost, which shows the same error. This seems like a local designer client issue.

3

What URL are you using to connect the designer to the gateway? That base URL must be listed in the allowed redirect URLs, it would seem.

(You should strongly consider not ever using localhost as your gateway. Install in a VM with a DNS name or a named container.)

4

I am using a subdomain from our main domain, proxied through our nginx traffic router.
localhost is only in play from the designer launcher. Designer launches the auth flow, which works correctly, it’s the redirect that happens back to localhost when the error shows

ignition-designer-launcher
ignition-designer-launcher371×256 9.75 KB

igntion-auth-box
igntion-auth-box588×372 46 KB

ignition-designer-redirects
ignition-designer-redirects1171×558 37.4 KB

5

What are the gateway's public name settings? Automatic?

Under Config => Networking => Web Server => Public HTTP Address

(You may need to explicitly set it to the DNS name.)

Can you temporarily not use the proxy? (The redirect port looks suspicious.)

6

I just tested this again on my local gateway (8.3.0) and was able to log in with Entra using my designer launcher (v1.3.0)

Try adding “http://localhost:8088” in your designer launcher and make sure in Entra you also setup “http://localhost:8088/data/federate/callback/oidc” as a Redirect URI

7

Based on that, I’m going to try with an 8.3 install.

8

I was not able to replicate the issue with an 8.3 install. All configuration was the same.

1 Like