starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: OIDC issues when trying to use common endpoint with EntraID #3050

New Issue
Open
opened 2026-04-25 00:13:17 +02:00 by adam · 2 comments
adam commented 2026-04-25 00:13:17 +02:00
Owner
Copy Link
Copy Source

Originally created by @Locknes on GitHub (Oct 23, 2025).

What happened?

OIDC login fails when using Entra ID common endpoint (.../common/v2.0/...) with personal Microsoft accounts. The validator expects the iss claim to match the full metadata discovery URL instead of the actual token issuer URL (e.g., the specific tenant ID 9188... for personal accounts).

What did you expect to happen?

Audiobookshelf should correctly validate the iss claim against the issuer base URL derived from the common metadata, allowing logins from both organizational and personal Microsoft accounts configured in Entra ID

Steps to reproduce the issue

  1. Configure Entra ID App Registration for multi-tenant and personal accounts.
  2. Configure Audiobookshelf OIDC with the Entra ID common metadata endpoint URL (.../common/v2.0/.well-known/openid-configuration) as the Issuer URL.
  3. Attempt login using a personal Microsoft account (@outlook.com, etc.).
  4. Observe failure during callback and check logs for the unexpected iss value error.

Audiobookshelf version

2.30.0

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

"[Auth] No data in openid callback - RPError: unexpected iss value, expected https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration, got: https://login.microsoftonline.com/[TenantID]/v2.0"

Additional Notes

No response

Originally created by @Locknes on GitHub (Oct 23, 2025). ### What happened? OIDC login fails when using Entra ID common endpoint (.../common/v2.0/...) with personal Microsoft accounts. The validator expects the iss claim to match the full metadata discovery URL instead of the actual token issuer URL (e.g., the specific tenant ID 9188... for personal accounts). ### What did you expect to happen? Audiobookshelf should correctly validate the iss claim against the issuer base URL derived from the common metadata, allowing logins from both organizational and personal Microsoft accounts configured in Entra ID ### Steps to reproduce the issue 1. Configure Entra ID App Registration for multi-tenant and personal accounts. 2. Configure Audiobookshelf OIDC with the Entra ID common metadata endpoint URL (.../common/v2.0/.well-known/openid-configuration) as the Issuer URL. 3. Attempt login using a personal Microsoft account (@outlook.com, etc.). 4. Observe failure during callback and check logs for the unexpected iss value error. ### Audiobookshelf version 2.30.0 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None ### Logs ```shell "[Auth] No data in openid callback - RPError: unexpected iss value, expected https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration, got: https://login.microsoftonline.com/[TenantID]/v2.0" ``` ### Additional Notes _No response_
adam added the bug label 2026-04-25 00:13:17 +02:00
adam commented 2026-04-25 00:13:18 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (Oct 24, 2025):

Seems Microsoft does not follow specs. There error you see is from node-openid-client:

https://github.com/panva/openid-client/issues/76

@Sapd commented on GitHub (Oct 24, 2025): Seems Microsoft does not follow specs. There error you see is from node-openid-client: https://github.com/panva/openid-client/issues/76
adam commented 2026-04-25 00:13:18 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (Oct 24, 2025):

See also: https://github.com/panva/openid-client/issues/742

@Sapd commented on GitHub (Oct 24, 2025): See also: https://github.com/panva/openid-client/issues/742
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3050
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?