Search code examples
azure-active-directoryopenid-connectkratos

OIDC connect with Microsoft and ORY Kratos returns CORS issue

I am using ORY kratos v1.0.0 self-hosted. I am trying to get oidc connect to work with microsoft azure (Sign in with mircosoft). I completed the app registration on Azure B2C, have the correct redirect URL, a client secret and have a green check for PKCE. I then set this up in my kratos.yml like this at providers.config

      - id: microsoft
        microsoft_tenant: common
        provider: microsoft
        client_id: xxxxxxxxxx
        client_secret: xxxxxxxxxxxxxx
        mapper_url: file:///etc/config/kratos/oidc.jsonnet
        scope:
          - email

The login always fails and I get this CORS issue returned by kratos:

"Unable to complete OpenID Connect flow because the OpenID Provider returned error "invalid_request": Proof Key for Code Exchange is required for cross-origin authorization code redemption."

(My other OIDC configs with google and github work.)

My kratos server lives on auth.mydomain.com my login screen lives on accounts.mydomain.com.

Any hints what could be the issue here?

Solution

  • The error might occur if you configured the redirect URL under Single-page application platform like this:

    enter image description here

    Note that, the redirect_uri of the External SSO / IDP should be registered as a "Web" instead of SPA.

    To resolve the error, remove SPA redirect URI and add it in Web platform of your app registration:

    enter image description here

    Reference: How to fix AADSTS9002325: Proof Key for Code Exchange is required for cross-origin authorization code redemption - Microsoft Q&A by Camille