EntraID doesn't work after update to version later than 2.4.14

[qds-soft]

Hi everyone,
thank you for providing this module!

I have a rather strange problem. Currently I run an Apache 2.4.65 as a container based on Debian bookworm. I modified the image and installed this module. Now I wanted to update my containers with a newer Apache and oidc module. But as soon as I use the module version 2.4.14 and later I get a blank site with the words "Looged Out" right after I login. The browser developer tools show that no cookies are set.

The odd thing: I use another OIDC provider for an app and it still works.

Does anyone else have the same issue?

[zandbelt]

please use the latest 2.4.19.2 and set the server log level to `auth_openidc:debug" to see what is going on in the server error log

[qds-soft]

Hi zendbelt,
thank you for your rapid reply.

In fact I do use the latest module version, the problem occurs in all versions later than 2.4.14.

After days of research I was able to fix it:

On the Microsoft identity platform (requests made to the v2.0 endpoint), your app must explicitly request the offline_access scope, to receive refresh tokens.

Source: https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc

So I set OIDCScope "openid profile email offline_access" and it works! I still cannot see why an old module version worked without this directive.

Maybe it'll be helpful to document this in the auth_openidc.conf file?

[zandbelt]

see also #1349 (comment) (probably...)

[qds-soft]

This is it indeed.

What is more advisable and save?

Removing the OIDCRefreshAccessTokenBeforeExpiry or
Adding OIDCScope "openid profile email offline_access"
?
I've gotten the suggestion to set OIDCRefreshAccessTokenBeforeExpiry from an EntraID admin but I don't know wether it's good advice since the same admin couldn't resolve the issue.

Thank you for the help, much appreciated.