Wiki source code of OpenID Authentication with Microsoft Entra ID
Last modified by Vor Nach on 2025/08/19 08:45
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
7.2 | 1 | This document presents a configuration guide for the XWiki OpenIDC authenticator with Microsoft Entra ID (formerly known as Microsoft Azure Active Directory or Azure AD). |
 |
1.1 | 2 | |
| 3 | {{toc start=2 /}} | ||
| 4 | |||
| |
15.2 | 5 | == Microsoft Entra ID == |
| 6 | |||
| 7 | 1. You need to register an application in Microsoft Entra ID. (You can use the link for quick access [[Register Application>>https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/CreateApplicationBlade/quickStartType~/null/isMSAApp~/false]]) | ||
| 8 | image:entra-id-1.png | ||
| 9 | |||
| |
15.4 | 10 | The redirect_uri should be https://<YOUR XWIKI URL WITH PORT IF NECESSARY>/xwiki/oidc/authenticator/callback |
| |
15.2 | 11 | |
| 12 | 2. Create a secret. Go to "Certificates & sercrets", select "Client secrets" and click "New client secret" | ||
| |
15.3 | 13 | image:entra-id-2.png |
| |
15.2 | 14 | |
| |
15.4 | 15 | 3. Copy secret value |
| 16 | image:entra-id-3.png | ||
| 17 | |||
| |
15.6 | 18 | 4. Go to "Token configuration" and ad "optional" claims. Token type should be "ID". Select "prefered_username" and "upn" from the list |
| 19 | image:entra-id-4.png | ||
| |
15.5 | 20 | |
| |
15.6 | 21 | 5. Add "group" claims. Select "Security groups" as a type and "Group ID" as ID |
| 22 | image:entra-id-5.png | ||
| 23 | |||
| |
20.1 | 24 | 6. Go to "API permissions" and make sure email, openid, profile, User.Read are set and granted as delegated |
| 25 | image:entra-id-6.png | ||
| 26 | |||
| |
1.1 | 27 | == XWiki Configuration == |
| 28 | |||
| 29 | First the OpenIDC Authenticator must be enabled in xwiki.cfg: | ||
| 30 | |||
| 31 | {{code}} | ||
| 32 | xwiki.authentication.authclass=org.xwiki.contrib.oidc.auth.OIDCAuthServiceImpl | ||
| 33 | {{/code}} | ||
| 34 | |||
| 35 | And configured in xwiki.properties. Here are the properties to configure: | ||
| 36 | |||
| 37 | {{code}} | ||
| |
1.2 | 38 | |
| |
7.2 | 39 | #-# Enpoints |
| 40 | oidc.endpoint.authorization=https://login.microsoftonline.com/<REPLACE WITH YOUR DIRECTORY (TENANT) ID>/oauth2/v2.0/authorize | ||
| 41 | oidc.endpoint.token=https://login.microsoftonline.com/<REPLACE WITH YOUR DIRECTORY (TENANT) ID>/oauth2/v2.0/token | ||
| 42 | oidc.endpoint.userinfo=https://graph.microsoft.com/oidc/userinfo | ||
| 43 | oidc.endpoint.logout=https://login.microsoftonline.com/<REPLACE WITH YOUR DIRECTORY (TENANT) ID>/oauth2/v2.0/logout | ||
| |
1.2 | 44 | |
| |
7.2 | 45 | #-# User info |
| 46 | oidc.endpoint.userinfo.method=GET | ||
| 47 | oidc.scope=openid,profile,email,address | ||
| 48 | #-# Username will be generated based on UPN of the user. It will be converted to lowercase and removed all dots and other symbols | ||
| 49 | oidc.user.nameFormater=${oidc.idtoken.upn._clean._lowerCase} | ||
| 50 | oidc.user.subjectFormater=${oidc.idtoken.upn} | ||
| 51 | oidc.user.preferredUsername:${oidc.idtoken.upn} | ||
| 52 | oidc.user.mail:${oidc.idtoken.upn} | ||
| |
1.2 | 53 | |
| |
7.2 | 54 | #-# App Authnetication |
| 55 | oidc.endpoint.token.auth_method=client_secret_basic | ||
| 56 | oidc.clientid=<APPLICATION (CLIENT) ID> | ||
| 57 | oidc.secret=<SECRET VALUE> | ||
| |
1.2 | 58 | |
| |
7.2 | 59 | #-# Group sync (Example) |
| 60 | #-# Group name here in config and in xWiki should match. Spaces in group name are allowed | ||
| 61 | oidc.groups.claim=groups | ||
| |
1.2 | 62 | |
| |
7.2 | 63 | oidc.groups.mapping=XWikiAdminGroup=<REPLACE WITH GROUP OBJECT ID> |
| 64 | oidc.groups.mapping=Support Team - Read Only=<REPLACE WITH GROUP OBJECT ID> | ||
| 65 | |||
| 66 | |||
| |
1.1 | 67 | {{/code}} |
