I was trying to integrate MSF OIDC to AWS cognito userpool. Created new app registration in Azure AD with "signInAudience": "AzureADandPersonalMicrosoftAccount" and set "issuer": "https://login.microsoftonline.com/common/v2.0" in cognito federation and other settings. When I try to login with work or personal MSF account it's throwing "invalid_request" error with description "Bad id_token issuer". If, I replace the tenant_id "common" in issuer with specific tenant_id(9188040d-6c67-4c5b-b112-36a304b66dad for example-personal MSF) then the flow is working as expected by sending the authorization code back. Any help would be appreciated!
Integrating Microsoft(both personal and work Azure AD) OIDC to AWS Cognito
Viewed 422
2 Answers
Typically issuer validation is disabled or implemented differently in case of common endpoint.
If you see the metadata document (https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration), the issuer is specified as "https://login.microsoftonline.com/{tenantid}/v2.0", which is not valid for any tenant.
If you want to allow any tenant, issuer validation should be disabled (don't know if this is possible in Cognito). If you only want to allow specific tenants, you should check for specific issuer URIs (again don't know if this is possible in Cognito).
It seems to work for personal accounts with the URL: https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0
I got this URL from https://login.microsoftonline.com/consumers/v2.0/.well-known/openid-configuration Using consumers as the tenant did not work for some reason.
You may need to provide two links - one for each tenant.
Related