# Login with EntraID (Azure)

**URL:** <https://speciforum.org/t/login-with-entraid-azure/1373>\
**Category:** Get Help\
**Created:** [October 24, 2023, 9:04am UTC](https://speciforum.org/t/login-with-entraid-azure/1373 "2023-10-24T09:04:31Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [October 24, 2023, 9:04am UTC](https://speciforum.org/t/login-with-entraid-azure/1373/1 "2023-10-24T09:04:31Z")

</div>

Hello!

We are using the latest all in one docker setup and it’s working fine.

I’m just wondering regarding login. Is there a possibility to be able to let users authenticate against Microsoft Entra (aka Azure AD) some way?

I read somewhere that SAML is possible (but i dont find a documentation/howto). It would be great to have a Tutorial like this ones that covers the topic regarding specify7:

> **[App Integration Tutorials for use with Microsoft Entra ID](https://learn.microsoft.com/de-de/entra/identity/saas-apps/tutorial-list)**
>
> Configure Microsoft Entra single sign-on integration with a variety of third-party software as a service applications.

---

<div class="post-metadata">

**Author:** ![Grant](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/grant/32/4255_2.png) [@Grant](https://speciforum.org/u/Grant)\
**Post date:** [November 2, 2023, 6:03pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/2 "2023-11-02T18:03:20Z")

</div>

Hi @dfernandez,

At this time, we only support identity providers (IdPs) that have an OpenID endpoints.

> [@Single Sign-On (SSO) Support](https://speciforum.org/t/single-sign-on-sso-support/537):
>
> Specify 7.7 includes Single Sign-On (SSO) integrates Specify 7 with a campus or institutional identity providers. It supports all identity providers (IdPs) that have an OpenID endpoints. SSO reduces the number of attack surfaces because users only log in once each day and only use one set of credentials. Reducing login to one set of credentials improves institutional security. When users have to use separate passwords for each app, they usually don’t. For the most up-to-date SSO documentation,…

It looks like Azure AD provides an OpenID Connect endpoint that you can use to authenticate users and obtain identity information.

If you need help getting this configured in Specify, just let me know!

---

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [November 6, 2023, 12:11pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/3 "2023-11-06T12:11:56Z")

</div>

Hello @Grant ! Thank you for your reply

> [@Grant](#):
>
> If you need help getting this configured in Specify, just let me know!

In fact, yes. How to configure this (so adding a idP) this mentioned specify\_settings.py in Docker compose or elswhere? I dont find any information about this part. I’m using the “all-in-one” docker template.

---

<div class="post-metadata">

**Author:** ![JimBeach](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/jimbeach/32/2_2.png) [@JimBeach](https://speciforum.org/u/JimBeach)\
**Post date:** [November 7, 2023, 8:30pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/4 "2023-11-07T20:30:10Z")

</div>

Hi Dfernandez –

Thanks for your follow-up. Grant and our back end developer are both out this week, they may chirp in here, but likely it will be next week before we can try to help. Thanks for your patience.

Jim Beach.

---

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [November 8, 2023, 3:51pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/5 "2023-11-08T15:51:01Z")

</div>

Great, thank you!

---

<div class="post-metadata">

**Author:** ![alec.white](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@alec.white](https://speciforum.org/u/alec.white)\
**Post date:** [November 13, 2023, 11:00pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/6 "2023-11-13T23:00:47Z")

</div>

Hey, you’ll need to override the settings file with the SSO information.  
Here is an example from our GitHub repository [https://github.com/specify/specify7/blob/34301626534618aeb4c9e831a12ca87f1eab4f88/specifyweb/settings/specify\_settings.py#L90](https://github.com/specify/specify7/blob/34301626534618aeb4c9e831a12ca87f1eab4f88/specifyweb/settings/specify_settings.py#L90)  
Here is an example nmbe\_settings.py file:

```auto
import os
DATABASE_NAME = os.environ['DATABASE_NAME']
DATABASE_HOST = os.environ['DATABASE_HOST']
DATABASE_PORT = os.environ.get('DATABASE_PORT', '')
MASTER_NAME = os.environ['MASTER_NAME']
MASTER_PASSWORD = os.environ['MASTER_PASSWORD']
DEPOSITORY_DIR = '/volumes/static-files/depository'
REPORT_RUNNER_HOST = os.getenv('REPORT_RUNNER_HOST', '')
REPORT_RUNNER_PORT = os.getenv('REPORT_RUNNER_PORT', '')
WEB_ATTACHMENT_URL = os.getenv('ASSET_SERVER_URL', None)
WEB_ATTACHMENT_KEY = os.getenv('ASSET_SERVER_KEY', None)
WEB_ATTACHMENT_COLLECTION = os.getenv('ASSET_SERVER_COLLECTION', None)
CELERY_BROKER_URL = os.getenv('CELERY_BROKER_URL', None)
CELERY_RESULT_BACKEND = os.getenv('CELERY_RESULT_BACKEND', None)
CELERY_TASK_DEFAULT_QUEUE = os.getenv('CELERY_TASK_QUEUE', DATABASE_NAME)
ANONYMOUS_USER = os.getenv('ANONYMOUS_USER', None)

OAUTH_LOGIN_PROVIDERS = {
    'nmbe': {
        'title': " NMBE",
        'config': " https://login.microsoftonline.com/8605a91a-efbc-4eb5-84c9-0aed78380fa6/v2.0",
        'scope': "openid email",
        'client_id': "your-client-id",
        'client_secret': "your-client-secret",
    },
}

SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

```

In you docker-compose.yml file, add this settings file in the volumes section so that it overwrites the local\_settings.py file:

```auto
...
specify7:
    restart: unless-stopped
    image: specifyconsortium/specify7-service:v7
    init: true
    volumes:
      - "specify6:/opt/Specify:ro"
      - "static-files:/volumes/static-files"
      - "nmbe_settings.py:/opt/specify7/settings/local_specify_settings.py:ro"
...

```

---

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [November 15, 2023, 8:16am UTC](https://speciforum.org/t/login-with-entraid-azure/1373/7 "2023-11-15T08:16:08Z")

</div>

Hi @alec.white !

Thank you for this instruction/example. Im almost there. At login im getting an error now:

> Blockquote  
> The redirect URI ‘[http://myurl.mydomain.ch/accounts/oic\_callback/](http://myurl.mydomain.ch/accounts/oic_callback/)’ specified in the request does not match the redirect URIs configured for the application ‘d008201f-ec04-46cb-873a-de5662b509da’. Make sure the redirect URI sent in the request matches

1. I configured the callbackurl as [https://myurl.mydomain.ch/accounts/oic\_callback/](https://myurl.mydomain.ch/accounts/oic_callback/) (with https)

2. I call [https://myurl.mydomain.ch](https://myurl.mydomain.ch) for login in with the browser

Do im missing something? This piece here:

```auto
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

```

needs to be there or in nginx-config?

---

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [November 15, 2023, 9:22am UTC](https://speciforum.org/t/login-with-entraid-azure/1373/8 "2023-11-15T09:22:53Z")

</div>

Just a little follow up. Specify does not send https as redirect uri in the oauth request atm:

![oauth](https://canada1.discourse-cdn.com/flex029/uploads/specifysoftware/original/2X/7/779935ac35ab0f043a88bbea3575048566186c5c.png)

So maybe i have something missing somewhere in the configuration.

---

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [December 13, 2023, 9:09am UTC](https://speciforum.org/t/login-with-entraid-azure/1373/9 "2023-12-13T09:09:51Z")

</div>

Hi @alec.white, is there maybe a way to allow to configure/ovveride/force the redirect\_uri protocol in the provider configuration? If im right, the composition of the callback\_uri happens here: [specify7/specifyweb/accounts/views.py at 0a47efcd66919958dad31e46bebdbc31b2ff436e · specify/specify7 · GitHub](https://github.com/specify/specify7/blob/0a47efcd66919958dad31e46bebdbc31b2ff436e/specifyweb/accounts/views.py#L108C14-L108C26)

```auto
OAUTH_LOGIN_PROVIDERS = {
    'nmbe': {
        'title': " NMBE",
        'config': " https://login.microsoftonline.com/8605a91a-efbc-4eb5-84c9-0aed78380fa6/v2.0",
        'scope': "openid email",
        'client_id': "your-client-id",
        'client_secret': "your-client-secret",
        'callback_uri_proto': "https", #something like this?
    },
}

```

I dont see a way to fix that otherwise. As mentioned

```auto
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

```

this does nothing in my case

---

<div class="post-metadata">

**Author:** ![alec.white](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@alec.white](https://speciforum.org/u/alec.white)\
**Post date:** [January 19, 2024, 10:07pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/10 "2024-01-19T22:07:05Z")

</div>

Hey, I was able to look into the problem with the redirect\_url not using https. I made a code change on a branch named `sso-https`. I hoping that will work for you. If you are using docker, pull this image `specifyconsortium/specify7-service:sso-https`. Try it with and without `SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')` in your config. Let me know if this fixes your issue and I’ll make sure to add the code to the next release.

---

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [January 31, 2024, 3:48pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/11 "2024-01-31T15:48:29Z")

</div>

Hello @alec.white !

Sorry for the late reply, i tested this branch and now i can confirm that i works (somehow). No matter if i add or not the

```auto
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

```

part. The callback uri is now with https. When i come back from microsoft online, i get following error:

```auto
{"exception": "KeyError", "message": "id_token", "data": "None", "traceback": "Traceback (most recent call last):\n File \"/opt/specify7/ve/lib/python3.8/site-packages/django/core/handlers/base.py\", line 181, in _get_response\n response = wrapped_callback(request, *callback_args, **callback_kwargs)\n File \"/opt/specify7/ve/lib/python3.8/site-packages/django/views/decorators/http.py\", line 40, in inner\n return func(request, *args,**kwargs)\n File \"/opt/specify7/specifyweb/accounts/views.py\", line 183, in oic_callback\n id_token = get_token.json()['id_token']\nKeyError: 'id_token'\n"}

```

It could be because the user is not existent in specify somehow yet? do i need to setup first in specify? I followed the guide here:

1. created a user withou password and send invitation link. Results in same error mentioned.

---

<div class="post-metadata">

**Author:** ![alec.white](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@alec.white](https://speciforum.org/u/alec.white)\
**Post date:** [February 1, 2024, 8:47pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/12 "2024-02-01T20:47:44Z")

</div>

I believe that issue comes when your OAuth provider’s authorized redirect URIs are not setup to allow redirects to Specify. When I did a test setup with Google’s OAuth service, I needed to add `https://sp7test.specifycloud.org/auth/complete/google-oauth2/` to the list of Authorized redirect URIs. Let me know if that doesn’t solve your problem. For you the redirect should be something like `https://nmbe.specifycloud.org/auth/complete/azure-oauth2/`

---

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [February 5, 2024, 3:15pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/13 "2024-02-05T15:15:18Z")

</div>

> [@](#):
>
> something like `https://nmbe.specifycloud.org/auth/complete/azure-oauth2/`

Well, the redirect uri i defined as [https://www.mydomain.ch/accounts/oic\_callback/](https://www.mydomain.ch/accounts/oic_callback/) - then i get the mentioned error

if i call directly [https://www.mydomain.ch/auth/complete/azure-oauth2/](https://www.mydomain.ch/auth/complete/azure-oauth2/) i get a 404 … is there documented somewhere what the possible urls could be?

If i take a look here:

> <https://github.com/specify/specify7/blob/3b4967d1984042da0b73d8661bb90629a3181326/specifyweb/accounts/urls.py#L13>

the [https://www.mydomain.ch/accounts/oic\_callback/](https://www.mydomain.ch/accounts/oic_callback/) is the only that makes sense.

if i go to this endpoint: [https://www.mydomain.ch/accounts/oic\_providers/](https://www.mydomain.ch/accounts/oic_providers/)

i get back

![grafik](https://canada1.discourse-cdn.com/flex029/uploads/specifysoftware/original/2X/1/1e2e0e2fb78bc5afb491b60817558b2f1210f99a.png)

in the logs i see following unspecific error:

`2024-02-05T15:15:30.562964260Z [05/Feb/2024 15:15:30] [ERROR] [django.request:224] Internal Server Error: /accounts/oic_callback/`

---

<div class="post-metadata">

**Author:** ![vinayakjha](https://avatars.discourse-cdn.com/v4/letter/v/b9bd4f/32.png) [@vinayakjha](https://speciforum.org/u/vinayakjha)\
**Post date:** [February 12, 2024, 7:02pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/14 "2024-02-12T19:02:18Z")

</div>

Could you run specify in debug mode so we could get more info?

In .env file, set SP7\_DEBUG=true

---

<div class="post-metadata">

**Author:** ![Heryk](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/heryk/32/5730_2.png) [@Heryk](https://speciforum.org/u/Heryk)\
**Post date:** [May 15, 2024, 6:42pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/15 "2024-05-15T18:42:19Z")

</div>

Hello @dfernandez and @Grant,

Did you finally get authentication to work with EntraID?  
Apparently, to get security clearance at our office, I will also have to use EntraID for user authentication.

Correct me if I’m wrong but, Specify-7 seems to use the OAuth “Resource Owner Password Flow” for authentication. If so, I was informed that, for security concerns, we should not use this method of authentication.

- [Don't use the OAuth password grant type](https://www.scottbrady91.com/oauth/why-the-resource-owner-password-credentials-grant-type-is-not-authentication-nor-suitable-for-modern-applications)

- [Security considerations - OAuth Video Tutorial | LinkedIn Learning, formerly Lynda.com](https://www.linkedin.com/learning/web-security-oauth-and-openid-connect-23016424/security-considerations-22886426?autoSkip=true&resume=false&u=26887642)

Can we use “Authorization code flow” or “Authorization code flow with PKCE” with Specify-7? If not, is there a plan to move to these authorization methods in a near futur?

Thanks  
Héryk

---

<div class="post-metadata">

**Author:** ![dfernandez](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/dfernandez/32/2037_2.png) [@dfernandez](https://speciforum.org/u/dfernandez)\
**Post date:** [May 16, 2024, 6:53am UTC](https://speciforum.org/t/login-with-entraid-azure/1373/16 "2024-05-16T06:53:51Z")

</div>

Hello @Heryk

Not yet, i had to postpone this topic (Other Projects atm). In general, im missing documentation about this topic (Regarding what it does on specify-side etc.). Would be great to have some better ressources / Tutorials for this one. SSO it’s a “must have” topic nowadays.

In my case i suspect that is same problem as i have with calling asset-server over https / nginx config. I will be able to wrap my head around this again in some weeks.

---

<div class="post-metadata">

**Author:** ![vinayakjha](https://avatars.discourse-cdn.com/v4/letter/v/b9bd4f/32.png) [@vinayakjha](https://speciforum.org/u/vinayakjha)\
**Post date:** [May 16, 2024, 9:27pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/17 "2024-05-16T21:27:10Z")

</div>

that’s what specify uses - “Authorization code flow”

---

<div class="post-metadata">

**Author:** ![vinayakjha](https://avatars.discourse-cdn.com/v4/letter/v/b9bd4f/32.png) [@vinayakjha](https://speciforum.org/u/vinayakjha)\
**Post date:** [May 16, 2024, 9:29pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/18 "2024-05-16T21:29:20Z")

</div>

> [@dfernandez](#):
>
> (Regarding what it does on specify-side etc.).

thank you for your feedback! what kind of details would you be interested in? True, we don’t have strong documentation about it yet.

---

<div class="post-metadata">

**Author:** ![vinayakjha](https://avatars.discourse-cdn.com/v4/letter/v/b9bd4f/32.png) [@vinayakjha](https://speciforum.org/u/vinayakjha)\
**Post date:** [May 16, 2024, 9:31pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/19 "2024-05-16T21:31:34Z")

</div>

> In my case i suspect that is same problem as i have with calling asset-server over https / nginx config. I will be able to wrap my head around this again in some weeks.

this may deserve a separate post. see  
[https://speciforum.org/t/file-uploads-error-invalid-response-code-0/1476](https://speciforum.org/t/file-uploads-error-invalid-response-code-0/1476)

> [@Attachment server unavailable in all-in-one Specify-7 docker-compose setup on Windows](https://speciforum.org/t/attachment-server-unavailable-in-all-in-one-specify-7-docker-compose-setup-on-windows/1319):
>
> Hello, I’m working with the [Specify-7 all-in-one docker-compose](https://github.com/specify/docker-compositions/tree/production/all-in-one) setup. I was successful in getting everything to work correctly except for the asset-server. When I try to add an image attachement to a collection object in the Specify-7 portal I get a “Attachment server unavailable” error message. Anyone else has this bug or a solution? Thanks PS. I’m using Windows 10 Entreprise with Docker Desktop

---

<div class="post-metadata">

**Author:** ![Heryk](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/heryk/32/5730_2.png) [@Heryk](https://speciforum.org/u/Heryk)\
**Post date:** [May 17, 2024, 2:53pm UTC](https://speciforum.org/t/login-with-entraid-azure/1373/20 "2024-05-17T14:53:53Z")

</div>

Great news! As soon as our central office IT team gives me access to our Authentication server (Entra ID), I will try it out! Thanks

[Next page](https://speciforum.org/t/login-with-entraid-azure/1373.md?page=2)