Hello Team... We are trying to configure SSO with AzureAD. We added below environment variables to frontend-react. - AUTH_OIDC_ENABLED=true - AUTH_OIDC_CLIENT_ID=xxxxx - AUTH_OIDC_CLIENT_SECRET=xxxx - AUTH_OIDC_DISCOVERY_URI=https://login.microsoftonline.com/xxxx/v2.0/.well-known/openid-configuration - AUTH_OIDC_BASE_URL=https://xxxxx - AUTH_OIDC_SCOPE="openid profile email" And we configured the application in AzureAD as documented in https://datahubproject.io/docs/authentication/guides/sso/configure-oidc-react-azure We are receiving below error. What are we missing? Any lead to troubleshoot this issue is highly appriciated. datahub-frontend-react | 2023-02-09 181854,210 [application-akka.actor.default-dispatcher-19] ERROR controllers.AuthenticationController - Caught exception while attempting to redirect to SSO identity provider! It's likely that SSO integration is mis-configured datahub-frontend-react | org.pac4j.core.exception.TechnicalException: com.nimbusds.oauth2.sdk.ParseException: The scope must include an "openid" value

CC: @echoing-airport-49548, any thoughts here?

Hey @stocky-apple-7404 have you examined your discovery URI to see what fields are declared in the OIDC scope?

@echoing-airport-49548 Yes.

Okay that looks good to me

Hmm... Thanks. I'll check the Client ID and client secret one more time (but I'm positive that those are correct). When it comes to configuration on the OIDC provider side (Azure AD in our case) - we followed https://login.microsoftonline.com/xxxx/v2.0/.well-known/openid-configuration. Anything specific that you'd advice us to check? Is there any kind of debug flag that we can enable to get additional details in datahub logs?

Is there anything else we can do to troubleshoot this?

CC: @bulky-soccer-26729 here

okay so I'm not the SSO expert, but after perusing some other similar issues talked about here on slack, I see a thing you all could try. Could you change

AUTH_OIDC_SCOPE="openid profile email"

to

AUTH_OIDC_SCOPE="openid email profile"

instead? Not sure if that will do the trick, but this thread talking about google sso calls that out: https://datahubspace.slack.com/archives/C029A3M079U/p1660236526704199?thread_ts=1660090628.120349&cid=C029A3M079U

Just to close this thread - This is what worked for me. I was setting the AUTH_* variables using the environment: section in docker-compose and that did not work. I moved the same values to an .env file and referenced it using env_file section in docker-compose and IT WORKS!

Thank you Arun for this. I just started exploring datahub via docker quickstart and came across the same problem. Moving the AUTH_* variables from the environment section to an .env file made it work!