Recently, I faced issues integrating Kasm with Microsoft Azure Internal OIDC due to outdated documentation. After some trial and error, I got it to work.
Here's the list of inaccuracies in the documentation.
- Step 17 is no longer required. sid will be automatically included in the token. You will not be able to find it in the dropdown menu.
- For Step 18, add User.Read to the scope. The full scope should include
openid profile email User.Read
, with each in its own line. I also added these attributes as delegated type under the API permissions tab on the Azure Entra application. - If you get an
OIDC login rejected: Non OIDC user
error, the OIDC authentication is working correctly. This error indicates that you have a local user that has the same email as the OIDC account you are trying to login with, you will need to change the email address of your local user.