Issues - OpenID Connect and AAD

eleightondick

[v11.2.15.15774]

I've successfully gotten OpenID Connect with AAD to authenticate, but I'm having two issues:

* Groups only seem to be able to authenticate if I add the group using its AAD object ID (GUID), rather than its name. Have you found a way to correct this?
* I'm using the "MSP Configuration" - a parent base monitor with child base monitors at each client location. If I set the parent to use OpenID Connect, all of the data from the child base monitors disappears from SQL Monitor, even though it says the child base monitors are still connected. Do I have to use OpenID Connect at all locations if I want to use it?

Thanks,
Ed

Alex B

Hi Ed,

I think that may be a configuration in Azure-  https://blogs.aaddevsup.xyz/2019/03/using-groups-claim-in-azure-active-directory/ says:

There are some limitations…

GUID’s returned only.

By default, GUID’s are returned in the “groups” claim. If your group is synchronized to Azure AD using Azure AD Connect, you can then display the group name.

For more information about configuring the groups claim…
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims

Otherwise, if they are not synchronized, you will only get the GUID. You will need to make a separate call to Microsoft Graph to retrieve another value like its Display Name.

For the MSP Configuration that sounds odd.  To confirm - the user you are viewing as is an administrator according to your OIDC config on the parent and you are logging into the parent after enabling it but cannot see the servers.  If you log into one of the clients web services (presumably using either basic SQL Monitor or AD auth) can you see the servers there then?

Kind regards,
Alex