Hi Lennart!

No, I have no experience with OIDC and Sharepoint, but can you maybe share a link to MS documentation (ADFS and Entra)?

Thanks,

S

Hi Sebastijan,

https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/oidc-1-0-authentication, in the bottom of the page there are links for Entra and ADFS

Thanks

/Lennart

Quickly reading through EntraID documentation there is more or less only one thing concertning, everything else should be more or less possible with just changing URLs. And of course a lot of testing 

Concerning part is step 11 in https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/set-up-oidc-auth-in-sharepoint-server-with-msaad#step-1-setup-identity-provider

AFAIK Access Manager does not support wildcard URLs in OAuth/OIDC redirect URIs. On the other hand, maybe wildcard is actually not needed, but this can only be seen by doing some tests.

Regarding SharePoint configuration, I would use "manual" way (https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/set-up-oidc-auth-in-sharepoint-server-with-msaad#configure-sharepoint-to-trust-microsoft-entra-id-as-the-oidc-provider-manually)

AM values for the table below can be read from https://<idpURL>/nidp/oauth/nam/.well-known/openid-configuration

Regarding received attribute in ID token, make sure you have attribute that is in line with this Powershell line:

$emailClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "Email" -SameAsIncoming

If you want to change scope that is requested by Sharepoint, you can do this in this Powershell line (see -Scope parameter):

New-SPTrustedIdentityTokenIssuer -Name "contoso.local" -Description "contoso.local" -ImportTrustCertificate $certificates -ClaimsMappings emailClaimMap -IdentifierClaim $emailClaimMap.InputClaimType -RegisteredIssuerName $registeredissuernameurl -AuthorizationEndPointUri $authendpointurl -SignOutUrl $signouturl -DefaultClientIdentifier $clientIdentifier -Scope "openid profile"

As I've said, I have not done anything with SP and OAuth, but hope what I wrote helps.

Hi Sebasijan,

thanks for the input, will try to test this week.

/Lennart