I've been banging my head against the wall for 12 hours trying to get these 2 to talk to each other, but nothing I try works. This was the closest I've gotten so far their actually talking albeit not correctly. Has anyone successfully connected SSO with MS Online?

Unraid api output redacted in places if it looks weird to you.

TIA

OIDC Provider Setup | Unraid Docs

[20:10:06 INFO OidcValidationService]: Discovery response metadata: {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:06 INFO OidcValidationService]:   - issuer: https://sts.windows.net/ecccccccccccc1/ {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:06 INFO OidcValidationService]:   - authorization_endpoint: https://login.microsoftonline.com/vvvvvvvvvvvv/oauth2/authorize {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:06 INFO OidcValidationService]:   - token_endpoint: https://login.microsoftonline.com/cxxxxxxxxxxxxxx/oauth2/token {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:06 INFO OidcValidationService]:   - userinfo_endpoint: https://login.microsoftonline.com/xxxxxxxxxxxx/openid/userinfo {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:06 INFO OidcValidationService]:   - jwks_uri: https://login.microsoftonline.com/common/discovery/keys {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:06 INFO OidcValidationService]:   - response_types_supported: code, id_token, code id_token, token id_token, token {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:06 INFO OidcValidationService]:   - scopes_supported: openid {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:33 INFO OidcValidationService]: Starting discovery for provider utraraid {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:33 INFO OidcValidationService]: Discovery URL: https://login.microsoftonline.com/xxxxxxxxxxxxxxx1/.well-known/openid-configuration {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:33 INFO OidcValidationService]: Client ID: xxxxxxxxxxxxx {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:33 INFO OidcValidationService]: Client secret configured: Yes {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]: Discovery successful for utraraid {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]: Discovery response metadata: {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]:   - issuer: https://sts.windows.net/xxxxxxxxxxxx/ {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]:   - authorization_endpoint: https://login.microsoftonline.com/xxxxxxxx/oauth2/authorize {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]:   - token_endpoint: https://login.microsoftonline.com/efde6b80-adec-47bc-a43d-d40a8e5d5d51/oauth2/token {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]:   - userinfo_endpoint: https://login.microsoftonline.com/xxxxxxxopenid/userinfo {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]:   - jwks_uri: https://login.microsoftonline.com/common/discovery/keys {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]:   - response_types_supported: code, id_token, code id_token, token id_token, token {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcValidationService]:   - scopes_supported: openid {"apiVersion":"4.25.2+50d8331","logger":"OidcValidationService","context":"OidcValidationService"}
[20:10:34 INFO OidcService]: Built authorization URL via discovery for provider utraraid {"apiVersion":"4.25.2+50d8331","logger":"OidcService","context":"OidcService"}
[20:10:34 INFO OidcService]: Authorization parameters: {"redirect_uri":"https:/xxxxxxxxxxxmyunraid.net/graphql/api/auth/oidc/callback","scope":"openid profile email","state":"utraraid:xxxxxxxxxxxxxxxxx","response_type":"code"} {"apiVersion":"4.25.2+50d8331","logger":"OidcService","context":"OidcService"}
[20:10:34 INFO OidcRestController]: Redirecting to OIDC provider: https://login.microsoftonline.com/xxxxxxxxxx1/oauth2/authorize?redirect_uri=https%3A%2F%2Fxxxxxxxxxxt%2Fgraphql%2Fapi%2Fauth%2Foidc%2Fcallback&scope=openid+profile+email&state=utraraid%3Aed41ffb3e7ad55a83b11683477c8e05e.1760819013786.1075cb472943e4063393ea6bdcee824363ce89367a6f896d194441479295c490&response_type=code&client_id=715de9d8-7f97-4e75-bf9a-939fc2fa60{"apiVersion":"4.25.2+50d8331","logger":"OidcRestController","context":"OidcRestController"}
[20:10:47 ERROR OidcTokenExchangeService]: Token exchange failed {"apiVersion":"4.25.2+50d8331","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[20:10:47 ERROR OidcTokenExchangeService]: Error type: ClientError {"apiVersion":"4.25.2+50d8331","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[20:10:47 ERROR OidcTokenExchangeService]: Error message: invalid response encountered {"apiVersion":"4.25.2+50d8331","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[20:10:47 ERROR OidcTokenExchangeService]: Error code: OAUTH_INVALID_RESPONSE {"apiVersion":"4.25.2+50d8331","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[20:10:47 ERROR OidcTokenExchangeService]: Error cause chain: {"apiVersion":"4.25.2+50d8331","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[20:10:47 ERROR OidcTokenExchangeService]:   [Cause 1] OperationProcessingError: unexpected "iss" (issuer) response parameter value {"apiVersion":"4.25.2+50d8331","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[20:10:47 ERROR OidcTokenExchangeService]:   [Cause 1] Code: OAUTH_INVALID_RESPONSE {"apiVersion":"4.25.2+50d8331","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[20:10:47 ERROR OidcTokenExchangeService]:   [Cause 2] object: [object Object] {"apiVersion":"4.25.2+50d8331","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[20:10:47 ERROR OidcService]: OAuth callback error: invalid response encountered {"apiVersion":"4.25.2+50d8331","logger":"OidcService","context":"OidcService"}
[20:10:47 ERROR OidcRestController]: OIDC callback error: UnauthorizedException: Authentication failed {"apiVersion":"4.25.2+50d8331","logger":"OidcRestController","context":"OidcRestController"}

Edited October 21, 2025Oct 21 by Fiservedpi

only with using a Microsoft account app password.

https://support.microsoft.com/en-us/account-billing/how-to-get-and-use-app-passwords-5896ed9b-4263-e681-128a-a6f2979a7944

ahhh yes this makes much more sense now, thank you.

54 minutes ago, bmartino1 said:

only with using a Microsoft account app password.

https://support.microsoft.com/en-us/account-billing/how-to-get-and-use-app-passwords-5896ed9b-4263-e681-128a-a6f2979a7944