# ZAC OIDC Login Fails: "discovery\_document\_validation\_error" with Entra ID **URL:** \ **Category:** Ziti Administration Console\ **Created:** [May 20, 2025, 1:42pm UTC](https://openziti.discourse.group/t/zac-oidc-login-fails-discovery-document-validation-error-with-entra-id/4582 "2025-05-20T13:42:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jamesfear](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@jamesfear](https://openziti.discourse.group/u/jamesfear)\ **Post date:** [May 20, 2025, 1:42pm UTC](https://openziti.discourse.group/t/zac-oidc-login-fails-discovery-document-validation-error-with-entra-id/4582/1 "2025-05-20T13:42:44Z")
Hi Ziti Team, I'm encountering an issue specifically with OIDC login for the Ziti Admin Console (ZAC) when using Azure Entra ID as the OIDC provider. ZAC is being served by my Ziti Controller. **Current Setup:** - **Controller Version:** v1.5.4 - **Controller Listener:** Single listener on [my-controller.example.com:1280](http://my-controller.example.com:1280) (actual FQDN masked) using alt\_server\_certs. - **ZAC Access:** Accessed via browser at [https://public-api.example.com:1280/ziti-console](https://public-api.example.com:1280/ziti-console) (served by the LE cert). - **Entra ID App Registration for ZAC:** - **Ziti Desktop Edge (ZDE) OIDC Enrollment:** Works correctly using Entra ID. This confirms the controller's core OIDC client configuration (AuthPolicy and ExtJwtSigner for Entra ID) for its own interaction with Entra ID is functional. **Problem Specific to ZAC OIDC Login:** When attempting to log into ZAC using OIDC (targeting Entra ID): 1. The browser successfully fetches Entra ID's discovery document: GET "[https://login.microsoftonline.com/{my-tenant-id}/v2.0/.well-known/openid-configuration](https://login.microsoftonline.com/%7Bmy-tenant-id%7D/v2.0/.well-known/openid-configuration)" returns 200 OK. 2. Immediately after, ZAC's JavaScript client logs the following errors in the browser console: - error validating authorization\_endpoint in discovery document ['Every url in discovery document has to start with …o see property strictDiscoveryDocumentValidation.'] - Growler Msg: error Error Login Error Unable to initialize OAuth login: discovery\_document\_validation\_error **This indicates that ZAC's internal OIDC client library is failing to validate Entra ID's discovery document, even though the document is fetched successfully.** **Question:** 1. How is ZAC's OIDC client (the JavaScript running in the browser) configured when ZAC is served by the Ziti controller? Specifically, where does it get its authority (Issuer URL for Entra ID) and client\_id to use for its direct OIDC flow with Entra ID? 2. Is there a known issue or specific configuration required for ZAC's OIDC client library regarding strictDiscoveryDocumentValidation when used with Entra ID's v2.0 endpoints? 3. Given that ZDE OIDC enrollment (where the Ziti controller is the OIDC client to Entra ID) works, what could be different about ZAC's client-side OIDC initialization that leads to this validation error? I'm trying to understand how to ensure ZAC's OIDC client is correctly initialized to work with Entra ID, especially concerning the discovery document validation. Thanks for any guidance! ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [May 20, 2025, 3:27pm UTC](https://openziti.discourse.group/t/zac-oidc-login-fails-discovery-document-validation-error-with-entra-id/4582/2 "2025-05-20T15:27:57Z")
Hi @jamesfear, In my experience, Entra can sometimes be a pain. I'll see if I can confirm (or deny) Entra working on my side and follow up in a bit... ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [May 20, 2025, 4:15pm UTC](https://openziti.discourse.group/t/zac-oidc-login-fails-discovery-document-validation-error-with-entra-id/4582/3 "2025-05-20T16:15:47Z")
Oh and as to why it would error, it's not clear. If you are able to auth using a tunneler (ZDEW) then I would expect adding the callback uri to entra would allow you to use Entra for ZAC auth. I was able to validate that Entra will indeed work when properly configured. However, I ran into an issue possibly similar to yours where the ZDEW works fine, but logging into the ZAC failed beause my identity wasn't an admin. The identity you're authenticating as, is it perhaps not an admin? I had similar problems with my first attempt at logging into ZAC but it was due to my identity not having the admin permission. Other than that, can you run `ziti edge list ext-jwt-signers -j 'name = "entra"' | jq -r '.data[] | [.externalAuthUrl, .jwksEndpoint] | @csv'` and make sure the externalAuthUrl looks right along with the jwks uri? for example from my controller: ```auto ziti edge list ext-jwt-signers -j 'name = "entra"' | jq -r '.data[] | [.externalAuthUrl, .jwksEndpoint] | @csv' "https://login.microsoftonline.com/25445e86-2ae6-4434-b116-25c66c27168d/v2.0","https://login.microsoftonline.com/25445e86-2ae6-4434-b116-25c66c27168d/discovery/v2.0/keys" ``` ---
**Author:** ![gmat98](https://avatars.discourse-cdn.com/v4/letter/g/958977/32.png) [@gmat98](https://openziti.discourse.group/u/gmat98)\ **Post date:** [June 11, 2025, 7:21pm UTC](https://openziti.discourse.group/t/zac-oidc-login-fails-discovery-document-validation-error-with-entra-id/4582/4 "2025-06-11T19:21:17Z")
Hey, I'm facing the same issue with entra, did you find any solution? @jamesfear Linux and Windows edge tunneleres are working fine. After a little digging I found that it's the angular-oauth2-oidc lib that's being "too secure", there is an option to turn this off called `strictDiscoveryDocumentValidation`, but as I understand correctly it should be set at build time. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 11, 2025, 7:44pm UTC](https://openziti.discourse.group/t/zac-oidc-login-fails-discovery-document-validation-error-with-entra-id/4582/5 "2025-06-11T19:44:06Z")
Did you Mark your identify as an admin? That was the problem i had. Once i resolved that, logging in was fine ---
**Author:** ![gmat98](https://avatars.discourse-cdn.com/v4/letter/g/958977/32.png) [@gmat98](https://openziti.discourse.group/u/gmat98)\ **Post date:** [June 11, 2025, 7:53pm UTC](https://openziti.discourse.group/t/zac-oidc-login-fails-discovery-document-validation-error-with-entra-id/4582/6 "2025-06-11T19:53:07Z")
Yes, it is admin, I'll give it a try with the newest docker image, my current zac is 3.10.0. Update: No luck, 1.6.2 had the same zac version Update 2: My browser cached the previous zac, after reloading it correctly now it's version 3.12.3, and oidc login is working fine 🥳 ---
**Author:** ![jamesfear](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@jamesfear](https://openziti.discourse.group/u/jamesfear)\ **Post date:** [June 15, 2025, 4:03pm UTC](https://openziti.discourse.group/t/zac-oidc-login-fails-discovery-document-validation-error-with-entra-id/4582/7 "2025-06-15T16:03:41Z")
I am sorry to you both as I belived I had replyed to you but it seems I can not just reply to the emails that I recive from discourse when there is a update on the topic. I have not had a lot of time to look at this issue yet. I just updated to 1.6.0 as indicated by gmat98, which gets past the frist error but now just have a spining zac logo.