Trying to configure OIDC with ADFS, but having no luck.

[mc1903]

Hi,

I have a manual (package?) install of Semaphore v2.9.37 on Ubuntu 22.04.3 with Nginx providing a reverse https proxy.

I have tried to configure OIDC with ADFS but nothing happens when I click the "Sign in using ADFS" button.

Is there any way of increasing the verbosity of the logging coming out of Semaphore?

Has any one here got an OIDC ADFS config working? I am not 100% confident of my ADFS setup, so it could well be the problem.

Any pointers on fault finding this would be appreciated,

Cheers
M

When I tail/grep the /var/log/syslog, I see a "404 Not Found: " message. But have no idea what URL this is referring to.

semaphore@MC-ANSC-V-201:~$ sudo tail /var/log/syslog | grep semaphore
Nov 29 12:56:19 MC-ANSC-V-201 semaphore[9569]: Loading config
Nov 29 12:56:19 MC-ANSC-V-201 semaphore[9569]: Validating config
Nov 29 12:56:19 MC-ANSC-V-201 semaphore[9569]: Postgres [email protected]:5432 semaphore
Nov 29 12:56:19 MC-ANSC-V-201 semaphore[9569]: Tmp Path (projects home) /home/semaphore
Nov 29 12:56:19 MC-ANSC-V-201 semaphore[9569]: Semaphore v2.9.37
Nov 29 12:56:19 MC-ANSC-V-201 semaphore[9569]: Interface 127.0.0.1
Nov 29 12:56:19 MC-ANSC-V-201 semaphore[9569]: Port :3000
Nov 29 12:56:19 MC-ANSC-V-201 semaphore[9569]: Server is running
Nov 29 12:56:37 MC-ANSC-V-201 semaphore[9569]: time="2023-11-29T12:56:37Z" level=error msg="404 Not Found: "
semaphore@MC-ANSC-V-201:~$

Relevant parts of my config.json looks like this:

~~
        "port": "",
        "interface": "127.0.0.1",
        "tmp_path": "/home/semaphore",
~~
        "web_host": "https://semaphore.momusconsulting.com/",
~~
        "oidc_providers": {
                "msadfs": {
                          "color": "black",
                          "display_name": "Sign in using ADFS",
                          "provider_url": "https://adfs.momusconsulting.com/adfs/.well-known/openid-configuration",
                          "client_id": "0b6e****1b36",
                          "client_secret": "sLZp****QxsS",
                          "redirect_url": "https://semaphore.momusconsulting.com/api/auth/oidc/msadfs/redirect"
                }
        },
~~

My ADFS OIDC provider URL responds with this:

{
    "issuer":  "https://adfs.momusconsulting.com/adfs",
    "authorization_endpoint":  "https://adfs.momusconsulting.com/adfs/oauth2/authorize/",
    "token_endpoint":  "https://adfs.momusconsulting.com/adfs/oauth2/token/",
    "jwks_uri":  "https://adfs.momusconsulting.com/adfs/discovery/keys",
    "token_endpoint_auth_methods_supported":  [
                                                  "client_secret_post",
                                                  "client_secret_basic",
                                                  "private_key_jwt",
                                                  "windows_client_authentication"
                                              ],
    "response_types_supported":  [
                                     "code",
                                     "id_token",
                                     "code id_token",
                                     "id_token token",
                                     "code token",
                                     "code id_token token"
                                 ],
    "response_modes_supported":  [
                                     "query",
                                     "fragment",
                                     "form_post"
                                 ],
    "grant_types_supported":  [
                                  "authorization_code",
                                  "refresh_token",
                                  "client_credentials",
                                  "urn:ietf:params:oauth:grant-type:jwt-bearer",
                                  "implicit",
                                  "password",
                                  "srv_challenge",
                                  "urn:ietf:params:oauth:grant-type:device_code",
                                  "device_code"
                              ],
    "subject_types_supported":  [
                                    "pairwise"
                                ],
    "scopes_supported":  [
                             "aza",
                             "email",
                             "winhello_cert",
                             "profile",
                             "logon_cert",
                             "openid",
                             "allatclaims",
                             "vpn_cert",
                             "user_impersonation"
                         ],
    "id_token_signing_alg_values_supported":  [
                                                  "RS256"
                                              ],
    "token_endpoint_auth_signing_alg_values_supported":  [
                                                             "RS256"
                                                         ],
    "access_token_issuer":  "http://adfs.momusconsulting.com/adfs/services/trust",
    "claims_supported":  [
                             "aud",
                             "iss",
                             "iat",
                             "exp",
                             "auth_time",
                             "nonce",
                             "at_hash",
                             "c_hash",
                             "sub",
                             "upn",
                             "unique_name",
                             "pwd_url",
                             "pwd_exp",
                             "mfa_auth_time",
                             "sid",
                             "nbf"
                         ],
    "microsoft_multi_refresh_token":  true,
    "userinfo_endpoint":  "https://adfs.momusconsulting.com/adfs/userinfo",
    "capabilities":  [
                         "kdf_ver2"
                     ],
    "end_session_endpoint":  "https://adfs.momusconsulting.com/adfs/oauth2/logout",
    "as_access_token_token_binding_supported":  true,
    "as_refresh_token_token_binding_supported":  true,
    "resource_access_token_token_binding_supported":  true,
    "op_id_token_token_binding_supported":  true,
    "rp_id_token_token_binding_supported":  true,
    "frontchannel_logout_supported":  true,
    "frontchannel_logout_session_supported":  true,
    "device_authorization_endpoint":  "https://adfs.momusconsulting.com/adfs/oauth2/devicecode"
}

My NGINX 'default' site config looks like this;

server
{
        listen 80;
        server_name _;
        return 301 https://$host$request_uri;
}

server
{
        listen 443 ssl;
        server_name _;

        add_header Strict-Transport-Security "max-age=31536000" always;

        ssl_certificate /etc/nginx/cert/cert.pem;
        ssl_certificate_key /etc/nginx/cert/privkey.pem;

        ssl_dhparam /etc/nginx/dhparam.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 10.1.1.10 10.1.1.11 valid=300s;
        resolver_timeout 5s;

        chunked_transfer_encoding on;

        location /
        {
                proxy_pass http://127.0.0.1:3000/;
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_buffering off;
                proxy_request_buffering off;
        }

        location /api/ws
        {
                proxy_pass http://127.0.0.1:3000/api/ws;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Origin $http_origin;
        }
}

[s3lph]

"provider_url": "https://adfs.momusconsulting.com/adfs/.well-known/openid-configuration",

Leave out the /.well-known/openid-configuration part of the URL; Semaphore automatically appends this part to the base URL:

"provider_url": "https://adfs.momusconsulting.com/adfs/",

[mc1903]

Thank you @s3lph.

I had to drop the trailing / from the provider URL, as I got this new error message:

semaphore@MC-ANSC-V-201:~$ sudo nano /etc/semaphore/config.json
semaphore@MC-ANSC-V-201:~$ sudo systemctl restart semaphore
semaphore@MC-ANSC-V-201:~$ sudo tail -f /var/log/syslog | grep -i semaphore
Dec 12 15:28:44 MC-ANSC-V-201 systemd[1]: Stopped Ansible Semaphore.
Dec 12 15:28:44 MC-ANSC-V-201 systemd[1]: Started Ansible Semaphore.
Dec 12 15:28:45 MC-ANSC-V-201 semaphore[1817]: Loading config
Dec 12 15:28:45 MC-ANSC-V-201 semaphore[1817]: Validating config
Dec 12 15:28:45 MC-ANSC-V-201 semaphore[1817]: Postgres [email protected]:5432 semaphore
Dec 12 15:28:45 MC-ANSC-V-201 semaphore[1817]: Tmp Path (projects home) /home/semaphore
Dec 12 15:28:45 MC-ANSC-V-201 semaphore[1817]: Semaphore v2.9.37
Dec 12 15:28:45 MC-ANSC-V-201 semaphore[1817]: Interface 127.0.0.1
Dec 12 15:28:45 MC-ANSC-V-201 semaphore[1817]: Port :3000
Dec 12 15:28:45 MC-ANSC-V-201 semaphore[1817]: Server is running
Dec 12 15:28:53 MC-ANSC-V-201 semaphore[1817]: time="2023-12-12T15:28:53Z" level=error msg="oidc: issuer did not match the issuer returned by provider, expected \"https://adfs.momusconsulting.com/adfs/\" got \"https://adfs.momusconsulting.com/adfs\""

But this has moved me forward to another new error.

semaphore@MC-ANSC-V-201:~$ sudo nano /etc/semaphore/config.json
semaphore@MC-ANSC-V-201:~$ sudo systemctl restart semaphore
semaphore@MC-ANSC-V-201:~$ sudo tail -f /var/log/syslog | grep -i semaphore
Dec 12 15:56:13 MC-ANSC-V-201 systemd[1]: Stopped Ansible Semaphore.
Dec 12 15:56:13 MC-ANSC-V-201 systemd[1]: Started Ansible Semaphore.
Dec 12 15:56:14 MC-ANSC-V-201 semaphore[1983]: Loading config
Dec 12 15:56:14 MC-ANSC-V-201 semaphore[1983]: Validating config
Dec 12 15:56:14 MC-ANSC-V-201 semaphore[1983]: Postgres [email protected]:5432 semaphore
Dec 12 15:56:14 MC-ANSC-V-201 semaphore[1983]: Tmp Path (projects home) /home/semaphore
Dec 12 15:56:14 MC-ANSC-V-201 semaphore[1983]: Semaphore v2.9.37
Dec 12 15:56:14 MC-ANSC-V-201 semaphore[1983]: Interface 127.0.0.1
Dec 12 15:56:14 MC-ANSC-V-201 semaphore[1983]: Port :3000
Dec 12 15:56:14 MC-ANSC-V-201 semaphore[1983]: Server is running
Dec 12 15:56:24 MC-ANSC-V-201 semaphore[1983]: time="2023-12-12T15:56:24Z" level=error msg="claim 'email' missing from id_token or not a string"

This looks looks like an ADFS configuration issue. I wish there was more verbosity in these error logs.

I really appreciate your help.

Cheers,
M

[s3lph]

Does it work when adding allatclaims to the list of requested scopes? So "scopes": ["openid", "profile", "email", "allatclaims"]

[mc1903]

Hello @s3lph

Sadly, it does not work even with allatclaims added to the list.

Screen grabs of my 'Semaphore' ADFS (Windows Server 2019) Application Group settings. I am not an ADFS expert, but am now thinking I am missing something in the 'Issuance Transform Rules' tab, but have no idea what.

This is an air gapped system, so showing my Client ID & Client Secret is not a risk

Once again, I really appreciate your help with this.

Cheers,
M