Azure Entra ID OAuth Issue – Token Not Present / User Not Authenticated (Kubernetes Helm Deployment)

[subodh624]

I am experiencing an issue with Azure Entra ID (Azure AD) authentication in LibreChat.

Issue Description:
After successful login via Azure Entra ID, LibreChat returns the following error:
"Error in OAuth authentication: token is not present. user not authenticated"

In the browser console, I also see:

BSSO Telemetry: bssoNotSupported
ssoprobe 401 (Unauthorized)

However, Azure login completes successfully and redirects back to LibreChat.

Environment Details

LibreChat deployed on: Kubernetes cluster
Deployment method: Official Helm chart
Ingress: (App Gateway)
TLS enabled: Yes
Domain: https://libre.com
Callback URL configured in Azure:
https://oauth/azure/callback

Image version: v0.8.2

Azure App Registration Configuration
Platform type: Web
Redirect URI: https:///oauth/azure/callback
ID Tokens: Enabled
Access Tokens: Enabled
API Permissions:

• openid
• profile
• email
• offline_access
• Admin consent granted: Yes

values.yaml

configEnv:
    CREDS_KEY: 
    CREDS_IV: ac028c86ba23f
    JWT_SECRET: 16f8c0ef4a5d391
    JWT_REFRESH_SECRET: eaa5191f
    ALLOW_REGISTRATION: "true"
    # ALLOW_EMAIL_LOGIN: "true"
    ALLOW_SOCIAL_LOGIN: "true"

    # Domain configuration
    DOMAIN_SERVER: "https://libre.test.bamgmt.com"
    DOMAIN_CLIENT: "https://libre.test.bamgmt.com"

    # OpenID Connect / EntraID Configuration
    OPENID_LOGIN_ENABLED: "true"
    OPENID_ISSUER: "https://login.microsoftonline.com/a8c3365/v2.0/"
    # OPENID_AUTHORIZATION_ENDPOINT: "https://login.microsoftonline.com/a848c3365/oauth2/v2.0/authorize"
    # OPENID_TOKEN_ENDPOINT: "https://login.microsoftonline.com/b1a8c3365/oauth2/v2.0/token"
    OPENID_CLIENT_ID: "74452ghh"
    OPENID_CLIENT_SECRET: ""
    OPENID_SESSION_SECRET: "SmnVIYxEOyi0Ai69D%TD"
    OPENID_CALLBACK_URL: "/oauth/openid/callback"
    OPENID_SCOPE: "openid profile email api://7ef9e55b-a1209/ibrechat"
    OPENID_REUSE_TOKENS: "true"
    DEBUG_OPENID_REQUESTS: "true"
    OPENID_AUTO_REDIRECT: "false"

    # Enable Entra ID people search in permissions/sharing
    USE_ENTRA_ID_FOR_PEOPLE_SEARCH: "true"
    
    # Include group owners as members when searching groups
    ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS: "true"
    
    # Microsoft Graph API scopes (these are automatically included with the OpenID scopes)
    OPENID_GRAPH_SCOPES: "User.Read,People.Read,GroupMember.Read.All,User.ReadBasic.All"
    # Azure EntraID Claim Mappings

    OPENID_REQUIRED_ROLE_TOKEN_KIND: "id"
    # OPENID_ID_FIELD: "oid"
    # OPENID_EMAIL_FIELD: "email"
    # OPENID_NAME_FIELD: "name"
    # OPENID_USERNAME_FIELD: "preferred_username"
    # OPENID_CLIENT_METHOD: "POST"
    OPENID_BUTTON_LABEL: "Sign in with Microsoft"
    # CONFIG_BYPASS_VALIDATION: "true"  # Uncomment if you need to bypass config validation
    # Caching Configuration
    OPENID_JWKS_URL_CACHE_ENABLED: "true"
    OPENID_JWKS_URL_CACHE_TIME: "600000"  # 10 minutes in milliseconds
    
    # Azure-specific Configuration
    OPENID_ON_BEHALF_FLOW_FOR_USERINFO_REQUIRED: "true"
    OPENID_ON_BEHALF_FLOW_USERINFO_SCOPE: "user.read"
    SESSION_EXPIRY: "600000"
    REFRESH_TOKEN_EXPIRY: "360000000"
    # Logout Configuration
    OPENID_USE_END_SESSION_ENDPOINT: "true"
    # Note: All secrets are now in configEnv for simplicity
    # The existing secret 'librechat-credentials-env' only needs:
    # - MEILI_MASTER_KEY (for MeiliSearch if enabled)
  existingSecretName: "librechat-credentials-env"

Please help me to fix this issue.