Integrating Kasm with MS Azure Internal OIDC

Recently, I faced issues integrating Kasm with Microsoft Azure Internal OIDC due to outdated documentation. After some trial and error, I got it to work.

Here's the list of inaccuracies in the documentation.

  1. Step 17 is no longer required. sid will be automatically included in the token. You will not be able to find it in the dropdown menu.
  2. For Step 18, add User.Read to the scope. The full scope should include openid profile email User.Read, with each in its own line. I also added these attributes as delegated type under the API permissions tab on the Azure Entra application.
  3. If you get an OIDC login rejected: Non OIDC user error, the OIDC authentication is working correctly. This error indicates that you have a local user that has the same email as the OIDC account you are trying to login with, you will need to change the email address of your local user.