# Designer Authentication with OpenID from Microsoft Entra **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [August 29, 2025, 8:10pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286 "2025-08-29T20:10:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Spencer\_Lommel1](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/spencer_lommel1/32/78679_2.png) [@Spencer\_Lommel1](https://forum.inductiveautomation.com/u/Spencer_Lommel1)\ **Post date:** [August 29, 2025, 8:10pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286/1 "2025-08-29T20:10:17Z")
I am trying to setup MS Entra with Open ID as an Identity Provider. I got Gateway login working successfully but when I try to sign into our gateway with **`Designer Authentication Strategy`** set to `Identity Provider` it redirects me to my organizations login page but then upon attempting to log in I get an `Internal Server Error`. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/9/491a5f7eb61852c1d942507cfcb185afa806979a.jpeg) I am trying to set this up on a local gateway first so my redirect URI is just `localhost:8088`. This works with the gateway but not with the designer and I’m not sure if this is part of the issue. I double checked the Role requirements and those show up in the `Test Login` on the gateway so I do have the correct permissions when I sign in on the gateway so I don’t think that is the issue. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/e/ee41cd9590d2aa6b1f0df4d2ce0b175c87e19920.png) ---
**Author:** ![ben.truby](https://avatars.discourse-cdn.com/v4/letter/b/7bcc69/32.png) [@ben.truby](https://forum.inductiveautomation.com/u/ben.truby)\ **Post date:** [November 26, 2025, 3:38pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286/2 "2025-11-26T15:38:24Z")
I am having this same issue, did you ever find a resolution? Ignition 8.1.50 - Using Entra and ODIC as the identity provider works great for the gateway, but the designer does not work. The login process works, and the callback URL from Entra is to the gateway.. that then redirects to localhost, which shows the same error. This seems like a local designer client issue. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 26, 2025, 3:43pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286/3 "2025-11-26T15:43:19Z")
What URL are you using to connect the designer to the gateway? That base URL must be listed in the allowed redirect URLs, it would seem. (You should strongly consider **not** ever using localhost as your gateway. Install in a VM with a DNS name or a named container.) ---
**Author:** ![ben.truby](https://avatars.discourse-cdn.com/v4/letter/b/7bcc69/32.png) [@ben.truby](https://forum.inductiveautomation.com/u/ben.truby)\ **Post date:** [November 26, 2025, 3:51pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286/4 "2025-11-26T15:51:00Z")
I am using a subdomain from our main domain, proxied through our nginx traffic router. localhost is only in play from the designer launcher. Designer launches the auth flow, which works correctly, it’s the redirect that happens back to localhost when the error shows ![ignition-designer-launcher](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/f/5f1e182e804da9384bee84d44a79c6b49eab843d.png) ![igntion-auth-box](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/c/2cfb1262c606878a7ffb8b651552ff5c9ac93b3b.png) ![ignition-designer-redirects](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/d/cd2bd47314a3f8c21fb00cf12af74068faab9587.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 26, 2025, 3:54pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286/5 "2025-11-26T15:54:35Z")
What are the gateway's public name settings? Automatic? Under Config =\> Networking =\> Web Server =\> Public HTTP Address (You may need to explicitly set it to the DNS name.) Can you temporarily **not** use the proxy? (The redirect port looks suspicious.) ---
**Author:** ![Spencer\_Lommel1](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/spencer_lommel1/32/78679_2.png) [@Spencer\_Lommel1](https://forum.inductiveautomation.com/u/Spencer_Lommel1)\ **Post date:** [November 26, 2025, 4:22pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286/6 "2025-11-26T16:22:52Z")
I just tested this again on my local gateway (8.3.0) and was able to log in with Entra using my designer launcher (v1.3.0) Try adding “[http://localhost:8088](http://localhost:8088)” in your designer launcher and make sure in Entra you also setup “[http://localhost:8088/data/federate/callback/oidc”](http://localhost:8088/data/federate/callback/oidc%E2%80%9D) as a Redirect URI ---
**Author:** ![ben.truby](https://avatars.discourse-cdn.com/v4/letter/b/7bcc69/32.png) [@ben.truby](https://forum.inductiveautomation.com/u/ben.truby)\ **Post date:** [November 26, 2025, 5:06pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286/7 "2025-11-26T17:06:21Z")
Based on that, I’m going to try with an 8.3 install. ---
**Author:** ![ben.truby](https://avatars.discourse-cdn.com/v4/letter/b/7bcc69/32.png) [@ben.truby](https://forum.inductiveautomation.com/u/ben.truby)\ **Post date:** [November 26, 2025, 7:46pm UTC](https://forum.inductiveautomation.com/t/designer-authentication-with-openid-from-microsoft-entra/110286/8 "2025-11-26T19:46:07Z")
I was not able to replicate the issue with an 8.3 install. All configuration was the same.