Troubleshooting

Authentication fails and the user is not redirected back to ESKM

Redirect URI mismatch between Microsoft Entra ID and ESKM

Verify that the Redirect URI configured in Microsoft Entra ID exactly matches the callback URL configured in ESKM.

User is not redirected to Microsoft Entra ID after clicking Sign In using OpenID

OpenID authentication is not enabled or the OpenID Server configuration is incorrect

Verify that OpenID Authentication is enabled and that the OpenID Server configuration has been saved successfully.

Authentication fails with an "Invalid Client" error

Incorrect Client ID or Client Secret configured in ESKM

Verify that the Client ID and Client Secret values in ESKM match those configured in Microsoft Entra ID.

User successfully authenticates with Microsoft Entra ID but cannot access ESKM

OpenID administrator account is not configured or username mapping is incorrect

Verify that an OpenID administrator account exists in ESKM and that the username matches the configured user attribute returned in the OIDC token.

Authentication fails after renewing the client secret

Expired or updated client secret has not been updated in ESKM

Generate a new client secret in Microsoft Entra ID and update the value in the ESKM OpenID Server Configuration.

Authentication fails with token validation or token expiry errors

Time synchronization issue between ESKM and Microsoft Entra ID

Verify that the ESKM server date, time, and timezone are correctly configured and synchronized with a reliable NTP source.

Authentication succeeds but the user is not authorized to access ESKM

The OpenID administrator username does not match the configured OIDC claim value

Verify that the username configured for the OpenID administrator exactly matches the value returned in the claim configured by the Username Attribute Name parameter. In this guide, the email claim is used.

ESKM cannot reach Microsoft Entra ID endpoints or authentication fails during redirection

DNS resolution failure on the ESKM server

Verify that the ESKM server can resolve Microsoft Entra ID endpoints such as login.microsoftonline.com. Check the DNS server configuration and confirm successful name resolution before retrying authentication.