[QUESTION] OIDC Multi-Tenant / Skip issuer verification

[christian--B]

Question

Hey,
i tried to setup Dashy with an EntraID Multi-Tenant Applikation.

For this, the Endpoint is:
https://login.microsoftonline.com/organizations/v2.0/
But the Token returns:
https://sts.windows.net/< Tenant ID >/ or
https://login.microsoftonline.com/< Tenant ID >/

Is there any Setting to disable Issuer Verification or supply a List of Issuers which should be considered Valid?

We are using oath2-Proxy in Front of Dasy for now with enabled Guest access. However, this prevents us from using Dashy's group-Based visibility.

Category

Configuration

Please tick the boxes

• You are using a supported version of Dashy (check the first two digits of the version number)
• You've checked that this question hasn't already been raised
• You've checked the docs and troubleshooting guide
• You agree to the code of conduct

[lissy93]

Heya @christian--B

Yeah, this should be possible. I'd not thought about OIDC providers where the token's iss doesn't match the issuer in the discovery doc.

Disabling the issuer verification would be bad, so I guess the better solution is to let you define a list of allowed tenant issuer(s) you trust, and then only accept tokens where the iss matches one of them. That way signature, auditence and expiry stay verified

Edit: Just getting PR ready, but once in, the updated config will look something like this:

auth:
  oidc:
    clientId: dashy
    endpoint: 'https://login.microsoftonline.com/organizations/v2.0/'
    allowedIssuers:
      - 'https://login.microsoftonline.com/<your-tenant-id>/v2.0'

[liss-bot]

Hey @christian--B, this has now been implemented in #2211, and will be released shortly in 4.3.9 😇
If you're enjoying Dashy, consider sponsoring us on GitHub to help with development 💖