Azure AD login fails with "Invalid email / username or password."

[Jamesits]

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Set up Azure AD auth according to doc
2. Enable self-registration
3. Try to log in with Azure AD

Expected behavior
I should be able to log in

Screenshots
If applicable, add screenshots to help explain your problem.

Host Info (please complete the following information):

• OS: Docker
• Wiki.js version: 2.3.81
• Database engine: MariaDB 10.4.12-MariaDB-1:10.4.12+maria~buster-log

Additional context

JWT claim looks good to me. The email and preferred_username both exist but are different.

Web page log:

Oops, something went wrong...
Invalid email / username or password.
AuthLoginFailed 1002: Invalid email / username or password.
    at /wiki/server/models/users.js:282:38
    at allFailed (/wiki/node_modules/passport/lib/middleware/authenticate.js:107:18)
    at attempt (/wiki/node_modules/passport/lib/middleware/authenticate.js:180:28)
    at Strategy.strategy.fail (/wiki/node_modules/passport/lib/middleware/authenticate.js:302:9)
    at Strategy.failWithLog (/wiki/node_modules/passport-azure-ad/lib/oidcstrategy.js:1498:15)
    at /wiki/node_modules/passport-azure-ad/lib/oidcstrategy.js:662:21
    at /wiki/node_modules/passport-azure-ad/node_modules/async/lib/async.js:52:16
    at Immediate._onImmediate (/wiki/node_modules/passport-azure-ad/node_modules/async/lib/async.js:1206:34)
    at processImmediate (internal/timers.js:456:21)
    at process.topLevelDomainCallback (domain.js:137:15)

Console log:

2020-06-04T09:50:38.011Z [MASTER] info: Authentication Strategy azure: [ OK ]
2020-06-04T09:50:38.012Z [MASTER] info: Authentication Strategy github: [ OK ]
2020-06-04T09:50:38.012Z [MASTER] info: Authentication Strategy local: [ OK ]

[Smankusors]

What do you mean by :

The email and preferred_username both exist but are different.

?

[Jamesits]

@Smankusors There are both email and preferred_username claims but their values are different.

[smg-bg]

Same here...

Somehow it was working the first few times, but then it stopped working after I disabled the self-registration option.However if I return it back it still crashes with the above message.

[Viajaz]

I have the same issue, based on the timestamps on this discussion, I guess I'm out of luck...

[Azayzel]

You need to go back to your Azure App Registration and add those claims to your app.

[Azayzel]

You need to go back to your Azure App Registration and add those claims to your app.

[andrewbadge]

Hi Azayzel,

I have the same issue i believe where our user's UPN differs from their default email. I suspect the token includes the email not the UPN.
However I have both domains in the Allow Domain setting (also tried no restriction on domain); why should it care which URI/UPN is included?

Shouldn't any or either just work as they are both listed?

I also tried creating the users manually with both the UPN and the Email address as the username. Neither helped.

My questions:

1. Do you have what setting you are suggesting in the Azure AD Tokenb Configuration? Is this a adding an "Optional Claim" as type "ID". I assume adding "UPN" (as the username) is correct?
2. Do you know how to debug the server-side error to get more details? the UI displays "Invalid email / username or password." but the Developer Tools show the callback API returning a 500 error. Do you know how to see more info?

[andrewbadge]

PS. any help is very appreciated. Thanks!

[Azayzel]

You need to go back to your Azure App Registration and add those claims to your app. Your app is not providing WikiJS with claims in the response token.

[deeepakkumarthakur16]

I was facing the same issue but later on i notice Azure AD User appearing in Wikijs users list and the i try to login with that user in incognito mode and able to login. Later on while working with wikijs notice issue with on relogin. If everytime i try to login in new incognito mode able to login but if retry to login on same windows after logout getting same screen as above.

Looks like some issue with wikijs not able to get details from existing session from azure ad or etc....

Anyone able to find any fix for this???

[frikyfriky11]

Hey, I'm a bit late to the party, but I've been tinkering with configuring Azure AD with Wiki.js today, and faced the same problem as @deeepakkumarthakur16 highlighted: if you login from an incognito session, everything works fine, but as soon as you try to login with a normal session (especially if there is the "Connected to Windows" text under your user in the profiles list on the Microsoft login page), then it returns that "Invalid email / username or password" error.

I don't know if this is the actual solution, but what worked for me was adding a random 44-char string value in the Cookie Encryption Key String in the Wiki.js provider configuration:

As soon as I added this string, everything started work correctly.

Hope it helps anybody that lands here from Google like I did :)

[mittkkoo]

I believe this was mentioned in the docs when I was doing that job earlier this year, but I can't find it now.

[mjt91]

Had the same propblem and this was the solution as well.

[BRGLLCIT]

Thank you!

[xxweimei]

Try turn on the "Allow self-registration" button. This error means account not exist or wrong password.

[Viajaz]

We never got that feature to work so we wrote an external scheduled batchjob to sync users into Wiki.js via GraphQL.

[jackadam1981]

Maybe we can refer to nextcloud's AD/LDAP setting steps, it is divided into several steps, and each step has a test button to test whether the settings are correct.

[jackadam1981]

It is a good solution to test the set value in stages during the configuration process.

[jackadam1981]

I can't connect to my production environment, and I can't provide you with a complete configuration example for the time being. I should try to provide you with a complete configuration example tomorrow. Of course, after the configuration is completed, there will be a few minutes of delayed synchronization. I also encountered problems when configuring, and it took a few days to configure successfully, so the test button in the configuration process is very helpful.

[SoftimDevOps]

I also dealt with a similar problem.

In my case, the account type for my Azure AD application was "multiple organizations", so I was incorrectly putting to the Identity metadata endpoint
this incorrect value: "https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration"

Of course, you need to insert this value: "https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0/.well-known/openid-configuration"

[rsuk-mb]

I also hit this issue. The eventual fix was to create a "Single-page application" platform configuration with the "ID tokens (used for implicit and hybrid flows)" option ticked. This was not the default platform configuration (web) and the ID tokens option was not ticked through the initial platform configuration created when adding the app registration.