# Bug OP-13342 - Internal server error upon login via Microsoft Entra ID (AzureAD)

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-13342

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 13.0.8 |
| Observed in versions | 13.0.0 |
| Sprint | 13.0.8 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 13.0.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Before filing a report

### Steps to reproduce

1.  Configure a new Entra ID application in the Azure Portal and configure it in OpenProject
2.  Try to log in

### What is the buggy behavior?

  - internal server error
      - logs reveal: expired or invalid access token

### What is the expected behavior?

1.  the login should work

**OpenProject version**

*v13.0.3*

### Implementation notes

  - New Azure application require the use of the API v2 endpoints
  - currently we use `/:tenant_id/oauth2/token` and `/:tenant_id/oauth2/authorize`
  - but it must be `/:tenant_id/oauth2/v2.0/token` and `/:tenant_id/oauth2/v2.0/authorize`
  - **there are** still environments using v1. Perhaps it is safe to assume that we should use v2 when the user configures a tenant ID, and v1 when they don't (which is the case for many existing installations)
  - this must not affect existing installations
  - **Bonus**: It would be great if we could show the internal errors, like "invalid or expired access token" or "invalid secret" to the users - at the very least admins - when an error like this occurs so people (and we) don't have to dig through logs to find out what the issue is

### Workaround

Users can fix this issue themselves in the meantime by setting the correct endpoints by hand.  
For this they need to start the rails console, e.g. via `sudo openproject run console`, and execute the following code.

``` ruby
config = Setting.plugin_openproject_openid_connect
azure = config["providers"]["azure"]
azure["authorization_endpoint"] = "/#{azure['tenant']}/oauth2/v2.0/authorize"
azure["token_endpoint"] = "/#{azure['tenant']}/oauth2/v2.0/token"
Setting.plugin_openproject_openid_connect = config
```