Authenticating with Azure Active Directory using a certificate instead of a client secret

[calvss]

Hi!
I'm trying to set up authentication with Azure AD using a cert instead of a client secret, but I don't know what I'm doing.

My config right now looks like this:

LoadModule auth_openidc_module modules/mod_auth_openidc.so

OIDCProviderMetadataURL https://login.microsoftonline.com/consumers/v2.0/.well-known/openid-configuration
OIDCClientID xxx
OIDCPublicKeyFiles /etc/letsencrypt/live/xxx/cert.pem
OIDCPrivateKeyFiles /etc/letsencrypt/live/xxx/privkey.pem
OIDCRedirectURI xxx/redirect_uri
OIDCCryptoPassphrase xxxxxx

<Location /files>
   AuthType openid-connect
   Require valid-user
</Location>

But I'm getting an error: oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error_description" entry with value: ""AADSTS70002: The provided request must include a 'client_secret' input parameter.

I've uploaded my cert.pem to the Azure dashboard, but I don't know if I'm missing settings on the Azure side or on my server config side.

Thanks

[calvss]

I added OIDCProviderTokenEndpointAuth private_key_jwt to my config and I get Client assertion contains an invalid signature. [Reason - The key was not found., Please visit the Azure Portal, Graph Explorer or directly use MS Graph to see configured keys for app Id 'xxx'. I'm guessing I have to check my settings on the Azure side

[calvss]

Fixed it by switching my distro from Debian Bullseye to Bookworm. Bullseye had mod_auth_openidc v2.4.9 which does not fix #762. It works perfectly after updating to 2.4.11

[zandbelt]

For the record: this Azure AD/private_key_jwt compatibility feature was indeed added in 2.4.11 and packages for various distros - including Bullseye - can be downloaded from the Assets section in the release page at https://github.com/zmartzone/mod_auth_openidc/releases