starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-13 12:50:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] [Entra OIDC] missing code or state parameter / empty OIDC callback params #1144

New Issue
Closed
opened 2025-12-29 02:28:32 +01:00 by adam · 3 comments
adam commented 2025-12-29 02:28:32 +01:00
Owner
Copy Link

Originally created by @acha666 on GitHub (Nov 14, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

Log shows ERR user msg: missing code or state parameter error="empty OIDC callback params" code=400 after user logged in in Entra and redirected to Headscale. Auth failed.

Expected Behavior

See below

Steps To Reproduce

Core OIDC config:

oidc:
  issuer: "https://login.microsoftonline.com/<REDACTED>/v2.0"
  client_id: 
  client_secret: 
  use_expiry_from_token: true
  scope: ["openid"] # see below
  extra_params:
    domain_hint: re.dacted # Tenant Domain UPN
  allowed_groups:
    - <REDACTED GROUP UUID>

Environment

- OS: Debian 13(docker)
- Headscale version: commit=f658a8eacd4d86edc65424b50635afed46ca4b2a version=v0.27.1+dirty
- Tailscale version: 1.90.4

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Debug information

When setting scope to ["openid", "profile", "email", "groups"] (same as document) auth failed with log:

headscale-1  | 2025-11-13T18:52:16-08:00 INF listening and serving HTTP on: 0.0.0.0:8080
headscale-1  | 2025-11-13T18:52:16-08:00 INF listening and serving debug and metrics on: 127.18.0.3:9090
headscale-1  | 2025-11-13T18:52:34-08:00 DBG home/runner/work/headscale/headscale/hscontrol/oidc.go:184 > Redirecting to https://login.microsoftonline.com/<REDACTED>/oauth2/v2.0/authorize?access_type=offline&client_id=<REDACTED>&code_challenge=z-5uclKs6FcdsNvtL1NVYY78-1YLPSD1gw7x-_Em4OE&code_challenge_method=S256&domain_hint=re.dacted&nonce=fvsS3xpIp2Db1Xf4p1iUVGDbCWJgQ2PRODjEZ3btkMXzBXKlfcumNwkhACZzumKi&redirect_uri=https%3A%2F%2Fhs.re.dacted%2Foidc%2Fcallback&response_type=code&scope=openid+profile+email+groups&state=p6jrD6DZNIinwzIOZB45GQwiTmzOFqTwIMwpaiJgj4Embvi-sYaTDiK8T-wiHVq3 for authentication
headscale-1  | 2025-11-13T18:52:38-08:00 ERR user msg: missing code or state parameter error="empty OIDC callback params" code=400

When scope set to only scope: ["openid"], auth success.

headscale-1  | 2025-11-13T18:57:30-08:00 INF listening and serving debug and metrics on: 127.18.0.3:9090
headscale-1  | 2025-11-13T18:57:52-08:00 DBG received register request with no auth, and no existing node machine.key=[5qtWD] node.key=[XO5Kk] unexpected=true
headscale-1  | 2025-11-13T18:57:52-08:00 INF Starting node registration using key: gP8Rc7Mvi8a9C3p2MWPmrxke
headscale-1  | 2025-11-13T18:57:53-08:00 DBG received register request with no auth, and no existing node machine.key=[5qtWD] node.key=[XO5Kk] unexpected=true
headscale-1  | 2025-11-13T18:57:58-08:00 DBG home/runner/work/headscale/headscale/hscontrol/oidc.go:184 > Redirecting to https://login.microsoftonline.com/<REDACTED>/oauth2/v2.0/authorize?access_type=offline&client_id=<REDACTED>&code_challenge=TXvU3zcuzFJRyFja6GIzBxwxFWE8iYWJJuDY2ekh9lU&code_challenge_method=S256&domain_hint=re.dacted&nonce=5ab64hhdi35nFMzP4Mh655o1CC-woMN7TOAhXx9YGOHhC2coHOL_-ccYk-UWkAQY&redirect_uri=https%3A%2F%2Fhs.re.dacted%2Foidc%2Fcallback&response_type=code&scope=openid&state=seBZOnQoG990PZlVlrGLETUWCkuSwnMqj-e6p_fJZ1nTKW5RGb7QEGhiz-VtT-1y for authentication
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/types/users.go:332 > Username  is not valid error="username must be at least 2 characters long"
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1522 > Policy manager user update initiated because user list modification detected user.count=1
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1529 > Policy manager user update completed because SetUsers operation finished policy.changed=false
headscale-1  | 2025-11-13T18:58:01-08:00 INF User created user.name=
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1241 > Registering new node from auth callback expiresAt="2025-11-13 19:58:00 -0800 PST" registrationMethod=oidc registration_id=gP8Rc7Mvi8a9C3p2MWPmrxke user.name=https://login.microsoftonline.com/<REDACTED>/v2.0/<REDACTED>
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=0
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1522 > Policy manager user update initiated because user list modification detected user.count=1
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1529 > Policy manager user update completed because SetUsers operation finished policy.changed=false
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=1
headscale-1  | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=1
headscale-1  | 2025-11-13T18:58:02-08:00 INF Node connected node.id=1 node.name=localhost
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/routes/primary.go:157 > PrimaryRoutes.SetRoutes called node.id=1 prefixes=[]
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/routes/primary.go:49 > updatePrimaryLocked starting
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/routes/primary.go:140 > updatePrimaryLocked completed changed=false finalState="Available routes:\n\n\nCurrent primary routes:\n"
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/routes/primary.go:175 > SetRoutes completed (remove) changed=false newState="Available routes:\n\n\nCurrent primary routes:\n" node.id=1 wasPresent=false
headscale-1  | 2025-11-13T18:58:02-08:00 INF home/runner/work/headscale/headscale/hscontrol/poll.go:383 > node has connected, mapSession: 0xc00039c180, chan: 0xc0001fe1c0 node.id=1 node.name=localhost omitPeers=false stream=true
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:499 > addConnection: waiting for mutex - POTENTIAL CONTENTION POINT chan=0xc0001fe1c0 conn.id=06120ec88d7b5f17 node.id=1
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:507 > Successfully added connection after mutex wait chan=0xc0001fe1c0 conn.id=06120ec88d7b5f17 mutex_wait_time=0.572303 node.id=1 total_connections=1
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:101 > Node connection established in batcher because AddNode completed successfully active.connections=1 node.id=1 total.duration=0.877374
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/poll.go:232 > AddNode succeeded in poll session because node added to batcher node.id=1 node.name=localhost
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher.go:159 > Node change processing started because change notification received change.type=NodeNewOrUpdate node.id=1
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:564 > send: broadcasting to all connections node.id=1 total_connections=1
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:574 > send: attempting to send to connection chan=0xc0001fe1c0 conn.id=06120ec88d7b5f17 connection_index=0 node.id=1
headscale-1  | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:587 > send: successfully sent to connection chan=0xc0001fe1c0 conn.id=06120ec88d7b5f17 connection_index=0 node.id=1
headscale-1  | 2025-11-13T18:58:02-08:00 DBG send: completed broadcast failed_connections=0 node.id=1 remaining_connections=1 successful_sends=1

Entra app conf:

Image Image Image
Originally created by @acha666 on GitHub (Nov 14, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior Log shows `ERR user msg: missing code or state parameter error="empty OIDC callback params" code=400` after user logged in in Entra and redirected to Headscale. Auth failed. ### Expected Behavior See below ### Steps To Reproduce Core OIDC config: ``` yaml oidc: issuer: "https://login.microsoftonline.com/<REDACTED>/v2.0" client_id: client_secret: use_expiry_from_token: true scope: ["openid"] # see below extra_params: domain_hint: re.dacted # Tenant Domain UPN allowed_groups: - <REDACTED GROUP UUID> ``` ### Environment ```markdown - OS: Debian 13(docker) - Headscale version: commit=f658a8eacd4d86edc65424b50635afed46ca4b2a version=v0.27.1+dirty - Tailscale version: 1.90.4 ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [x] Headscale runs in a container ### Debug information When setting scope to `["openid", "profile", "email", "groups"]` (same as document) auth failed with log: ``` headscale-1 | 2025-11-13T18:52:16-08:00 INF listening and serving HTTP on: 0.0.0.0:8080 headscale-1 | 2025-11-13T18:52:16-08:00 INF listening and serving debug and metrics on: 127.18.0.3:9090 headscale-1 | 2025-11-13T18:52:34-08:00 DBG home/runner/work/headscale/headscale/hscontrol/oidc.go:184 > Redirecting to https://login.microsoftonline.com/<REDACTED>/oauth2/v2.0/authorize?access_type=offline&client_id=<REDACTED>&code_challenge=z-5uclKs6FcdsNvtL1NVYY78-1YLPSD1gw7x-_Em4OE&code_challenge_method=S256&domain_hint=re.dacted&nonce=fvsS3xpIp2Db1Xf4p1iUVGDbCWJgQ2PRODjEZ3btkMXzBXKlfcumNwkhACZzumKi&redirect_uri=https%3A%2F%2Fhs.re.dacted%2Foidc%2Fcallback&response_type=code&scope=openid+profile+email+groups&state=p6jrD6DZNIinwzIOZB45GQwiTmzOFqTwIMwpaiJgj4Embvi-sYaTDiK8T-wiHVq3 for authentication headscale-1 | 2025-11-13T18:52:38-08:00 ERR user msg: missing code or state parameter error="empty OIDC callback params" code=400 ``` When scope set to only `scope: ["openid"]`, auth success. ``` headscale-1 | 2025-11-13T18:57:30-08:00 INF listening and serving debug and metrics on: 127.18.0.3:9090 headscale-1 | 2025-11-13T18:57:52-08:00 DBG received register request with no auth, and no existing node machine.key=[5qtWD] node.key=[XO5Kk] unexpected=true headscale-1 | 2025-11-13T18:57:52-08:00 INF Starting node registration using key: gP8Rc7Mvi8a9C3p2MWPmrxke headscale-1 | 2025-11-13T18:57:53-08:00 DBG received register request with no auth, and no existing node machine.key=[5qtWD] node.key=[XO5Kk] unexpected=true headscale-1 | 2025-11-13T18:57:58-08:00 DBG home/runner/work/headscale/headscale/hscontrol/oidc.go:184 > Redirecting to https://login.microsoftonline.com/<REDACTED>/oauth2/v2.0/authorize?access_type=offline&client_id=<REDACTED>&code_challenge=TXvU3zcuzFJRyFja6GIzBxwxFWE8iYWJJuDY2ekh9lU&code_challenge_method=S256&domain_hint=re.dacted&nonce=5ab64hhdi35nFMzP4Mh655o1CC-woMN7TOAhXx9YGOHhC2coHOL_-ccYk-UWkAQY&redirect_uri=https%3A%2F%2Fhs.re.dacted%2Foidc%2Fcallback&response_type=code&scope=openid&state=seBZOnQoG990PZlVlrGLETUWCkuSwnMqj-e6p_fJZ1nTKW5RGb7QEGhiz-VtT-1y for authentication headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/types/users.go:332 > Username is not valid error="username must be at least 2 characters long" headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1522 > Policy manager user update initiated because user list modification detected user.count=1 headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1529 > Policy manager user update completed because SetUsers operation finished policy.changed=false headscale-1 | 2025-11-13T18:58:01-08:00 INF User created user.name= headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1241 > Registering new node from auth callback expiresAt="2025-11-13 19:58:00 -0800 PST" registrationMethod=oidc registration_id=gP8Rc7Mvi8a9C3p2MWPmrxke user.name=https://login.microsoftonline.com/<REDACTED>/v2.0/<REDACTED> headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=0 headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1522 > Policy manager user update initiated because user list modification detected user.count=1 headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1529 > Policy manager user update completed because SetUsers operation finished policy.changed=false headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=1 headscale-1 | 2025-11-13T18:58:01-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=1 headscale-1 | 2025-11-13T18:58:02-08:00 INF Node connected node.id=1 node.name=localhost headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/routes/primary.go:157 > PrimaryRoutes.SetRoutes called node.id=1 prefixes=[] headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/routes/primary.go:49 > updatePrimaryLocked starting headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/routes/primary.go:140 > updatePrimaryLocked completed changed=false finalState="Available routes:\n\n\nCurrent primary routes:\n" headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/routes/primary.go:175 > SetRoutes completed (remove) changed=false newState="Available routes:\n\n\nCurrent primary routes:\n" node.id=1 wasPresent=false headscale-1 | 2025-11-13T18:58:02-08:00 INF home/runner/work/headscale/headscale/hscontrol/poll.go:383 > node has connected, mapSession: 0xc00039c180, chan: 0xc0001fe1c0 node.id=1 node.name=localhost omitPeers=false stream=true headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:499 > addConnection: waiting for mutex - POTENTIAL CONTENTION POINT chan=0xc0001fe1c0 conn.id=06120ec88d7b5f17 node.id=1 headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:507 > Successfully added connection after mutex wait chan=0xc0001fe1c0 conn.id=06120ec88d7b5f17 mutex_wait_time=0.572303 node.id=1 total_connections=1 headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:101 > Node connection established in batcher because AddNode completed successfully active.connections=1 node.id=1 total.duration=0.877374 headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/poll.go:232 > AddNode succeeded in poll session because node added to batcher node.id=1 node.name=localhost headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher.go:159 > Node change processing started because change notification received change.type=NodeNewOrUpdate node.id=1 headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:564 > send: broadcasting to all connections node.id=1 total_connections=1 headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:574 > send: attempting to send to connection chan=0xc0001fe1c0 conn.id=06120ec88d7b5f17 connection_index=0 node.id=1 headscale-1 | 2025-11-13T18:58:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/mapper/batcher_lockfree.go:587 > send: successfully sent to connection chan=0xc0001fe1c0 conn.id=06120ec88d7b5f17 connection_index=0 node.id=1 headscale-1 | 2025-11-13T18:58:02-08:00 DBG send: completed broadcast failed_connections=0 node.id=1 remaining_connections=1 successful_sends=1 ``` Entra app conf: <img width="1053" height="333" alt="Image" src="https://github.com/user-attachments/assets/8058be5a-2bdf-4259-9cab-709e5700758f" /> <img width="1744" height="661" alt="Image" src="https://github.com/user-attachments/assets/207c9d72-47b5-4c84-a88b-106bfab740f0" /> <img width="1097" height="1083" alt="Image" src="https://github.com/user-attachments/assets/50819227-ac4f-4ab1-952d-dd19ae14a0d6" />
adam added the bug label 2025-12-29 02:28:32 +01:00
adam closed this issue 2025-12-29 02:28:32 +01:00
adam commented 2025-12-29 02:28:32 +01:00
Author
Owner
Copy Link

@acha666 commented on GitHub (Nov 14, 2025):

I tried scope: ["openid", "profile", "email"] and scope: ["openid", "profile", "email", "User.Read"]

Both configurations above allow for successful authentication, and group restrictions are applied correctly.

Seems this issue is caused by Entra does not provide group scope. Instead, they are using group claim

I may leave this issue open for now, as it could be mentioned in the documentation.

logs below

headscale-1  | 2025-11-13T19:18:43-08:00 DBG received register request with no auth, and no existing node machine.key=[5qtWD] node.key=[uGg3T] unexpected=true
headscale-1  | 2025-11-13T19:18:43-08:00 INF Starting node registration using key: NDnkbDq4xIN3g5F4cdiNIe0O
headscale-1  | 2025-11-13T19:18:43-08:00 DBG received register request with no auth, and no existing node machine.key=[5qtWD] node.key=[uGg3T] unexpected=true
headscale-1  | 2025-11-13T19:18:54-08:00 DBG home/runner/work/headscale/headscale/hscontrol/oidc.go:184 > Redirecting to https://login.microsoftonline.com/<REDACTED>/oauth2/v2.0/authorize?access_type=offline&client_id=<REDACTED>&code_challenge=dEchOwQsj9xhQ-7dz7DNp5RPFAGBukn4bVdeybdEXNg&code_challenge_method=S256&domain_hint=acha.top&nonce=P2q5jZva8gaXa-kh83ugGkYjkK658G1MeDiwynUu1eHMX0BNa4qyHbKPJe8vE9R6&redirect_uri=https%3A%2F%2Fhs.re.dacted%2Foidc%2Fcallback&response_type=code&scope=openid+profile+email&state=WsX2O41TwpjdhIuC24oICYRwJuHmbwl_MBYnL84zq1rpWE8PnNsSzlIibKjX83UO for authentication
headscale-1  | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1522 > Policy manager user update initiated because user list modification detected user.count=1
headscale-1  | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1529 > Policy manager user update completed because SetUsers operation finished policy.changed=false
headscale-1  | 2025-11-13T19:18:59-08:00 INF User created user.name=user@re.dacted
headscale-1  | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1241 > Registering new node from auth callback expiresAt="2025-11-13 20:18:58 -0800 PST" registrationMethod=oidc registration_id=NDnkbDq4xIN3g5F4cdiNIe0O user.name=user@re.dacted
headscale-1  | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=0
headscale-1  | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1522 > Policy manager user update initiated because user list modification detected user.count=1
headscale-1  | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1529 > Policy manager user update completed because SetUsers operation finished policy.changed=false
headscale-1  | 2025-11-13T19:19:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=1
headscale-1  | 2025-11-13T19:19:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=1
headscale-1  | 2025-11-13T19:19:03-08:00 INF Node connected node.id=1 node.name=localhost
@acha666 commented on GitHub (Nov 14, 2025): I tried `scope: ["openid", "profile", "email"]` and `scope: ["openid", "profile", "email", "User.Read"]` Both configurations above allow for successful authentication, and group restrictions are applied correctly. Seems this issue is caused by Entra does not provide `group` **scope**. Instead, they are using `group` **claim** I may leave this issue open for now, as it could be mentioned in the documentation. logs below ``` headscale-1 | 2025-11-13T19:18:43-08:00 DBG received register request with no auth, and no existing node machine.key=[5qtWD] node.key=[uGg3T] unexpected=true headscale-1 | 2025-11-13T19:18:43-08:00 INF Starting node registration using key: NDnkbDq4xIN3g5F4cdiNIe0O headscale-1 | 2025-11-13T19:18:43-08:00 DBG received register request with no auth, and no existing node machine.key=[5qtWD] node.key=[uGg3T] unexpected=true headscale-1 | 2025-11-13T19:18:54-08:00 DBG home/runner/work/headscale/headscale/hscontrol/oidc.go:184 > Redirecting to https://login.microsoftonline.com/<REDACTED>/oauth2/v2.0/authorize?access_type=offline&client_id=<REDACTED>&code_challenge=dEchOwQsj9xhQ-7dz7DNp5RPFAGBukn4bVdeybdEXNg&code_challenge_method=S256&domain_hint=acha.top&nonce=P2q5jZva8gaXa-kh83ugGkYjkK658G1MeDiwynUu1eHMX0BNa4qyHbKPJe8vE9R6&redirect_uri=https%3A%2F%2Fhs.re.dacted%2Foidc%2Fcallback&response_type=code&scope=openid+profile+email&state=WsX2O41TwpjdhIuC24oICYRwJuHmbwl_MBYnL84zq1rpWE8PnNsSzlIibKjX83UO for authentication headscale-1 | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1522 > Policy manager user update initiated because user list modification detected user.count=1 headscale-1 | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1529 > Policy manager user update completed because SetUsers operation finished policy.changed=false headscale-1 | 2025-11-13T19:18:59-08:00 INF User created user.name=user@re.dacted headscale-1 | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1241 > Registering new node from auth callback expiresAt="2025-11-13 20:18:58 -0800 PST" registrationMethod=oidc registration_id=NDnkbDq4xIN3g5F4cdiNIe0O user.name=user@re.dacted headscale-1 | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=0 headscale-1 | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1522 > Policy manager user update initiated because user list modification detected user.count=1 headscale-1 | 2025-11-13T19:18:59-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/state.go:1529 > Policy manager user update completed because SetUsers operation finished policy.changed=false headscale-1 | 2025-11-13T19:19:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=1 headscale-1 | 2025-11-13T19:19:02-08:00 DBG home/runner/work/headscale/headscale/hscontrol/state/maprequest.go:44 > node sent update but has no NetInfo in request or database node.hostname=localhost node.id=1 headscale-1 | 2025-11-13T19:19:03-08:00 INF Node connected node.id=1 node.name=localhost ```
adam commented 2025-12-29 02:28:32 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Nov 15, 2025):

I may leave this issue open for now, as it could be mentioned in the documentation.

There's a section about Entra if you're up to submitting a PR.

@nblock commented on GitHub (Nov 15, 2025): > I may leave this issue open for now, as it could be mentioned in the documentation. There's a [section about Entra](https://github.com/juanfont/headscale/blob/main/docs/ref/oidc.md#microsoft-entra-id) if you're up to submitting a PR.
adam commented 2025-12-29 02:28:32 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Nov 15, 2025):

Fixed via e0c9e18e22

@nblock commented on GitHub (Nov 15, 2025): Fixed via e0c9e18e222a3f6f71d1d49d62386a51173ae69f
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1144
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?