3

As per Access management documentation I tried to configure OpenID Connect identity provider By providing the below details

Client Secret = JKg7Q~XX-XXXXA_Ak Client ID = bd9702f4-e804-4XXX-8f45-bXXXXXb8c OAuth 2 Autharization = https://login.microsoftonline.com/XXXXX-33e8-4670-92a8-XXXX/oauth2/v2.0/authorize

After configuring getting below error

IDX20803: Unable to obtain configuration from: 'https://login.microsoftonline.com/XXXXX-XXXX-4670-92a8-XXXXX/oauth2/v2.0/authorize/.well-known/openid-configuration'.

Can you please suggest how to resolve above issue.

2
  • can you share the parameters that you are using for OpenID connect just to verify its everything is ok
    – Anand NS
    Jan 5 at 9:46
  • The following parameters has been updated "key": "AzureAd", "name": "AzureAd", "isEnabled": true, "description": "AzureAd", "type": "OpenIdConnect", "iconUrl": "/AzureAd.png", "accessControlList": [], "forwardedClaims": [], "parameters": { "$type": "", "clientId": "xxxx", "authority": "login.microsoftonline.com/XXXXX/oauth2/v2.0/authorize", "clientSecret": "xxx", "endSessionEndpoint": "", "sendIdTokenHintDuringLogout": false, "separator": "", "usernameClaim": "upn", "fullNameClaim": "name" } Jan 5 at 16:12
1

Yes, Rick was correct. Authority for Azure AD https://login.microsoftonline.com/<TenentDomian or TenentId>

Here is the sample OpenIdConnect Idp provider JSON example, In case if you want to install and configure the IDP provider config using the PowerShell script.

    {
    "key": "AzureAd",
    "name": "AzureAd",
    "isEnabled": true,
    "description": "AzureAd",
    "type": "OpenIdConnect",
    "iconUrl": "/access-management/ui/idpIcons/AzureAd.png",
    "accessControlList": [
        {
            "applications": [
                {
                    "id": 4,
                    "name": "Access Management"
                },
                {
                    "id": 1,
                    "name": "Add-ons"
                },
                {
                    "id": 3,
                    "name": "Tridion Sites Classic (UI only)"
                },
                {
                    "id": 2,
                    "name": "Tridion Sites Experience Space"
                }
            ],
            "apiResources": [
                {
                    "id": 1,
                    "name": "Access Management API"
                },
                {
                    "id": 2,
                    "name": "Add-ons API"
                },
                {
                    "id": 3,
                    "name": "Tridion Sites Content Manager API"
                }
            ],
            "apiResourceRoles": [
                {
                    "id": 1,
                    "name": "Administrator"
                },
                {
                    "id": 2,
                    "name": "Administrator"
                },
                {
                    "id": 5,
                    "name": "Administrator"
                }
            ]
        }
    ],
    "forwardedClaims": [],
    "parameters": {
        "$type": "",
        "clientId": "xxxx-xxxx-xxxx-xxx-xxxx",
        "authority": "https://login.microsoftonline.com/xxx365.onmicrosoft.com",
        "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "endSessionEndpoint": "",
        "responseType": "",
        "sendIdTokenHintDuringLogout": false,
        "separator": "",
        "usernameClaim": "upn",
        "fullNameClaim": "name"
    }
}

Note: also make sure to configure the access management redirect Url on the azure side.

Updated:

AccessManagement-Service-Install.ps1 PowerShell script only generates the signing certificate and does the installation only for HTTP endpoint.

If you want to Enabling HTTPS for Access Management running as a Windows service, after the service installation install the certificate on the server and update the appsettings.json as mentioned below, and restart the access management service.

Replace "URLs": "http://*:80",

To

"Kestrel":  {
  "EndPoints":  {
 
     "HttpsInlineCertFile": {
        "Url":  "https://*:443",
          "Certificate":  {
              "Subject":  "*.tridiondemo.com",
              "Store":  "Root",
              "Location":  "LocalMachine"
          }
      }
  }      
}

For the Linux system installation, a certificate should be created as a file and a path should be configured. refer to the documentation.

In case if you looking for the script to generate the certificate to update the config for https, R&D provided a script for Add-on service which can also be re-used for Access Management, here is the script: [Installation-Media]\Add-on Service\generateCertificate.ps1

Note: To match the Subject config to your certificate subject which is installed on the server.

13
  • Hi Velu, I have used the PowerShell script for Access Management installation, since I am not aware of sequence after Access Management installation we connected with our Azure team. Your script works great. Small doubt Can I enable HTTPS Access Management directly using your PowerShell script by changing the $setupOptions.PORT_ACESSMANAEMENT_SERVICE value as 443. Jan 6 at 7:31
  • No, Updated my answer, I will extend this script to support HTTPS later
    – Velmurugan
    Jan 6 at 9:59
  • Can the Subject be same Domain as CMS? I am installing Access Management on CMS server. for example if my CMS Url is tridiondemo.com can the Subject also be tridiondemo.com Jan 6 at 11:41
  • @PrasannaKGollamudi yes. if you created a certificate with DNS name tridiondemo.com then that certificate subject become tridiondemo.com, In case if you are using a wildcard certificate then need to use *.tridiondemo.com
    – Velmurugan
    Jan 6 at 12:47
  • Once installed redirect url of access management showed as "localhost:84/access-management/azuread/signout-oidc" after enabling HTTPS should we configure in azure as "localhost:443/access-management/azuread/signout-oidc" or do we need to configure domain name or localhost works? Jan 7 at 15:27
1

The Authority for Azure AD is supposed to look like this: https://login.microsoftonline.com/sdl365.onmicrosoft.com

So, excluding the /oauth2/v2.0/authorize suffix you have in the URL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.