Wiki source code of OpenID Authentication with Microsoft Entra ID
Last modified by Vor Nach on 2025/08/19 08:45
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | This document presents a configuration guide for the XWiki OpenIDC authenticator with Microsoft Entra ID (formerly known as Microsoft Azure Active Directory or Azure AD). | ||
| 2 | |||
| 3 | {{toc start=2 /}} | ||
| 4 | |||
| 5 | == Microsoft Entra ID == | ||
| 6 | |||
| 7 | 1. You need to register an application in Microsoft Entra ID. (You can use the link for quick access [[Register Application>>https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/CreateApplicationBlade/quickStartType~/null/isMSAApp~/false]]) | ||
| 8 | image:entra-id-1.png | ||
| 9 | |||
| 10 | The redirect_uri should be https://<YOUR XWIKI URL WITH PORT IF NECESSARY>/xwiki/oidc/authenticator/callback | ||
| 11 | |||
| 12 | 2. Create a secret. Go to "Certificates & sercrets", select "Client secrets" and click "New client secret" | ||
| 13 | image:entra-id-2.png | ||
| 14 | |||
| 15 | 3. Copy secret value | ||
| 16 | image:entra-id-3.png | ||
| 17 | |||
| 18 | 4. Go to "Token configuration" and ad "optional" claims. Token type should be "ID". Select "prefered_username" and "upn" from the list | ||
| 19 | image:entra-id-4.png | ||
| 20 | |||
| 21 | 5. Add "group" claims. Select "Security groups" as a type and "Group ID" as ID | ||
| 22 | image:entra-id-5.png | ||
| 23 | |||
| 24 | 6. Go to "API permissions" and make sure email, openid, profile, User.Read are set and granted as delegated | ||
| 25 | image:entra-id-6.png | ||
| 26 | |||
| 27 | == XWiki Configuration == | ||
| 28 | |||
| 29 | First the OpenIDC Authenticator must be enabled in xwiki.cfg: | ||
| 30 | |||
| 31 | {{code}} | ||
| 32 | xwiki.authentication.authclass=org.xwiki.contrib.oidc.auth.OIDCAuthServiceImpl | ||
| 33 | {{/code}} | ||
| 34 | |||
| 35 | And configured in xwiki.properties. Here are the properties to configure: | ||
| 36 | |||
| 37 | {{code}} | ||
| 38 | |||
| 39 | #-# Enpoints | ||
| 40 | oidc.endpoint.authorization=https://login.microsoftonline.com/<REPLACE WITH YOUR DIRECTORY (TENANT) ID>/oauth2/v2.0/authorize | ||
| 41 | oidc.endpoint.token=https://login.microsoftonline.com/<REPLACE WITH YOUR DIRECTORY (TENANT) ID>/oauth2/v2.0/token | ||
| 42 | oidc.endpoint.userinfo=https://graph.microsoft.com/oidc/userinfo | ||
| 43 | oidc.endpoint.logout=https://login.microsoftonline.com/<REPLACE WITH YOUR DIRECTORY (TENANT) ID>/oauth2/v2.0/logout | ||
| 44 | |||
| 45 | #-# User info | ||
| 46 | oidc.endpoint.userinfo.method=GET | ||
| 47 | oidc.scope=openid,profile,email,address | ||
| 48 | #-# Username will be generated based on UPN of the user. It will be converted to lowercase and removed all dots and other symbols | ||
| 49 | oidc.user.nameFormater=${oidc.idtoken.upn._clean._lowerCase} | ||
| 50 | oidc.user.subjectFormater=${oidc.idtoken.upn} | ||
| 51 | oidc.user.preferredUsername:${oidc.idtoken.upn} | ||
| 52 | oidc.user.mail:${oidc.idtoken.upn} | ||
| 53 | |||
| 54 | #-# App Authnetication | ||
| 55 | oidc.endpoint.token.auth_method=client_secret_basic | ||
| 56 | oidc.clientid=<APPLICATION (CLIENT) ID> | ||
| 57 | oidc.secret=<SECRET VALUE> | ||
| 58 | |||
| 59 | #-# Group sync (Example) | ||
| 60 | #-# Group name here in config and in xWiki should match. Spaces in group name are allowed | ||
| 61 | oidc.groups.claim=groups | ||
| 62 | |||
| 63 | oidc.groups.mapping=XWikiAdminGroup=<REPLACE WITH GROUP OBJECT ID> | ||
| 64 | oidc.groups.mapping=Support Team - Read Only=<REPLACE WITH GROUP OBJECT ID> | ||
| 65 | |||
| 66 | |||
| 67 | {{/code}} |
