# Trying use Azure AD B2C for SSO using generic\_oauth and getting vague error when trying to troubleshoot **URL:** \ **Category:** Authentication\ **Tags:** oauth, azure-ad\ **Created:** [April 22, 2022, 7:47pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516 "2022-04-22T19:47:43Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![tyner27](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@tyner27](https://community.grafana.com/u/tyner27)\ **Post date:** [April 22, 2022, 7:47pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/1 "2022-04-22T19:47:43Z")
- What Grafana version and what operating system are you using? Grafana version: 8.4.5 OS: Ubuntu 20.04 - **What** are you trying to achieve? Successful login through Azure AD B2C - **How** are you trying to achieve it? By following instructions laid out by both applications - What happened? after clicking the button to sign in using azure I am taken to the appropriate login page. after the proper credentials are given I am redirected back to the `/login/generic_oauth` endpoint and see the following page: - What did you **expect** to happen? I was hoping for successful login to my Grafana instance - Can you copy/paste the configuration(s) that you are having problems with? here is my setup in the config file: ```auto [auth.generic_oauth] enabled = true name = SSO Provider allow_sign_up = true client_id = client_secret = scopes = openid email profile empty_scopes = false email_attribute_name = email email_attribute_path = emails[0] login_attribute_path = name_attribute_path = id_token_attribute_name = auth_url = https://.b2clogin.com/.onmicrosoft.com/B2C_1_signin1/oauth2/v2.0/authorize token_url = https://.b2clogin.com/.onmicrosoft.com/B2C_1_signin1/oauth2/v2.0/token api_url = https://.b2clogin.com/.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_signin1 teams_url = allowed_domains = team_ids = allowed_organizations = role_attribute_path = role_attribute_strict = false groups_attribute_path = team_ids_attribute_path = tls_skip_verify_insecure = false tls_client_cert = tls_client_key = tls_client_ca = use_pkce = false ``` - Did you receive any errors in the Grafana UI or in related logs? If so, please tell us **exactly** what they were. yes, I see the following vague error in the logs: ```auto logger=context userId=0 orgId=0 uname= t=2022-04-22T05:39:01.71+0000 lvl=eror msg=login.OAuthLogin(NewTransportWithCode) error="oauth2: server response missing access_token" ``` - Did you follow any online instructions? If so, what is the URL? [https://community.grafana.com/t/sso-using-azure-ad-b2c/23454](https://community.grafana.com/t/sso-using-azure-ad-b2c/23454) The suggestions there do not seem to work for me. any help would be greatly appreciated ---
**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\ **Post date:** [April 22, 2022, 8:56pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/2 "2022-04-22T20:56:55Z")
Why you don’t increase log level? ```auto [log] level = debug ``` You didn’t increase log level so you see only info+ logs. Enjoy debug log level. I guess token endpoint response returns error message where you will see what is wrong. BTW: `api_url` is wrong - there should be userinfo endpoint, not a discovery endpoint - but that shouldn’t be a root cause of your current problem. ---
**Author:** ![tyner27](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@tyner27](https://community.grafana.com/u/tyner27)\ **Post date:** [April 22, 2022, 9:15pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/3 "2022-04-22T21:15:05Z")
Ah, now I’m seeing: ```auto DBUG[04-22|14:08:12] Getting user info logger=oauth.generic_oauth DBUG[04-22|14:08:12] Extracting user info from OAuth token logger=oauth.generic_oauth DBUG[04-22|14:08:12] Received id_token logger=oauth.generic_oauth raw_json="{}" data="" DBUG[04-22|14:08:12] Getting user info from API logger=oauth.generic_oauth DBUG[04-22|14:08:12] Error getting user info from API logger=oauth.generic_oauth url= error="Get \"\": unsupported protocol scheme \"\"" DBUG[04-22|14:08:12] Processing external user info logger=oauth.generic_oauth source=token data="Name: , Displayname: , Login: , Username: , Email: , Upn: , Attributes: map[]" DBUG[04-22|14:08:12] Setting user info name from name field logger=oauth.generic_oauth EROR[04-22|14:08:12] Error getting email address logger=oauth.generic_oauth url=/emails error="Get \"/emails\": unsupported protocol scheme \"\"" EROR[04-22|14:08:12] login.OAuthLogin(get info from generic_oauth) logger=context error="Error getting email address: Get \"/emails\": unsupported protocol scheme \"\"" EROR[04-22|14:08:12] Request Completed logger=context method=GET path=/login/generic_oauth status=500 remote_addr=[::1] time_ms=1025 size=1372 referer= ``` > BTW: `api_url` is wrong - there should be userinfo endpoint, not a discovery endpoint - but that shouldn’t be a root cause of your current problem. Would you be able to expand on that? ---
**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\ **Post date:** [April 22, 2022, 9:38pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/4 "2022-04-22T21:38:58Z")
Open your discovery URL: ```auto https://.b2clogin.com/.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_signin1 ``` and there should be `userinfo` endpoint, which you need to configure as `api_url` in your Grafana config. ---
**Author:** ![tyner27](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@tyner27](https://community.grafana.com/u/tyner27)\ **Post date:** [April 22, 2022, 9:52pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/5 "2022-04-22T21:52:15Z")
I only see the following from the discovery endpoint: ```auto issuer: "https://.b2clogin.com//v2.0/", authorization_endpoint: "https://.b2clogin.com/.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_signin1", token_endpoint: "https://.b2clogin.com/.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_signin1", end_session_endpoint: "https://.b2clogin.com/.onmicrosoft.com/oauth2/v2.0/logout?p=b2c_1_signin1", jwks_uri: "https://.b2clogin.com/.onmicrosoft.com/discovery/v2.0/keys?p=b2c_1_signin1", response_modes_supported: [ "query", "fragment", "form_post" ], response_types_supported: [ "code", "code id_token", "code token", "code id_token token", "id_token", "id_token token", "token", "token id_token" ], scopes_supported: [ "openid" ], subject_types_supported: [ "pairwise" ], id_token_signing_alg_values_supported: [ "RS256" ], token_endpoint_auth_methods_supported: [ "client_secret_post", "client_secret_basic" ], claims_supported: [ "name", "sub", "idp", "tfp", "iss", "iat", "exp", "aud", "acr", "nonce", "auth_time" ] } ``` So perhaps this is a configuration mistake I’ve made on the azure side? ---
**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\ **Post date:** [April 22, 2022, 9:59pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/6 "2022-04-22T21:59:02Z")
Probably it is your Azure config issue. Contact your Azure support/doc (maybe [UserInfo endpoint | Microsoft Docs](https://docs.microsoft.com/en-us/azure/active-directory-b2c/userinfo-endpoint?pivots=b2c-user-flow)). I don’t understand why you want to use `api_url`, when refered topic ([SSO using Azure AD B2C - #3 by hnnsj](https://community.grafana.com/t/sso-using-azure-ad-b2c/23454/3)) doesn’t configure `api_url.` ---
**Author:** ![tyner27](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@tyner27](https://community.grafana.com/u/tyner27)\ **Post date:** [April 22, 2022, 10:06pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/7 "2022-04-22T22:06:52Z")
> I don’t understand why you want to use `api_url` , when refered topic ([SSO using Azure AD B2C - #3 by hnnsj](https://community.grafana.com/t/sso-using-azure-ad-b2c/23454/3)) doesn’t configure `api_url.` when I attempt to leave this un-configured I get the following: ```auto EROR[04-22|15:03:24] Error getting email address logger=oauth.generic_oauth url=/emails error="Get \"/emails\": unsupported protocol scheme \"\"" ``` ---
**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\ **Post date:** [April 22, 2022, 10:19pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/8 "2022-04-22T22:19:58Z")
Customize your config based on [OAuth authentication | Grafana Labs](https://grafana.com/docs/grafana/latest/auth/generic-oauth/#email-address) . Grafana must find user email in the `id_token`. You redacted your `id_token` payload, so only you know where is email stored and you need to know what to configure properly (`email_attribute_path/email_attribute_name`). ---
**Author:** ![tyner27](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@tyner27](https://community.grafana.com/u/tyner27)\ **Post date:** [April 22, 2022, 10:30pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/9 "2022-04-22T22:30:52Z")
Oh, I see. ok I quess the email is not being sent properly in the `id_token` payload: ```auto DBUG[04-22|15:22:55] Received id_token logger=oauth.generic_oauth raw_json="{\"exp\":1650669775,\"nbf\":1650666175,\"ver\":\"1.0\",\"iss\":\"https://test2749.b2clogin.com/e836a0a6-3c4e-42f6-8d5c-3ba4ab5db092/v2.0/\",\"sub\":\"de380be7-51a5-45ec-94fa-22d974cfb616\",\"aud\":\"4cb517e1-17ee-425e-b352-187d7db7c13b\",\"iat\":1650666175,\"auth_time\":1650666174,\"name\":\"Fred Fred\",\"tfp\":\"B2C_1_signin1\",\"at_hash\":\"9DEfXno3Hy72ZtBOHr5b_Q\"}" data="Name: Fred Fred, Displayname: , Login: , Username: , Email: , Upn: , Attributes: map[]" ``` ---
**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\ **Post date:** [April 22, 2022, 10:41pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/10 "2022-04-22T22:41:17Z")
Yes, again contact your Azure support and ask why you don’t see email in the `id_token` (maybe only used client need some minor config). You may try to use `https://graph.microsoft.com/oidc/userinfo` as `api_url` (very hackish and advanced solution). It is not OIDC userinfo endpoint, but it is Graph API endpoint, which provides also JSON output. It works for non B2C Azure and it may work (not guaranteed) also for B2C Azure. ---
**Author:** ![tyner27](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@tyner27](https://community.grafana.com/u/tyner27)\ **Post date:** [April 22, 2022, 10:49pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/11 "2022-04-22T22:49:49Z")
GOT IT! It works now. I had manually add email as a user attribute in the application claims section on the azure side. Thank you so much for your help jangaraj. I don’t think I could have solved this without you talking me through it ---
**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\ **Post date:** [April 22, 2022, 10:52pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/12 "2022-04-22T22:52:10Z")
It will be nice from you if you provide here reproducible working (Azure/Grafana) setup for other users, who may have this problem in the future. ---
**Author:** ![tyner27](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@tyner27](https://community.grafana.com/u/tyner27)\ **Post date:** [April 22, 2022, 10:57pm UTC](https://community.grafana.com/t/trying-use-azure-ad-b2c-for-sso-using-generic-oauth-and-getting-vague-error-when-trying-to-troubleshoot/64516/13 "2022-04-22T22:57:25Z")
Will do. Thanks again for the help.