Problems setting up Entra ID as OpenID Provider

[RNO-HMRKG]

I cannot get the OpenID Singn-In to work.

I have followed the Docs to the point and have searched all issues and discussions for the error message.

System

• Ubuntu Server 24.04 LTS
• LibreChat running in docker container
• Ollama running barebone
• External Firewall open to all incoming and outgoing connections.
• Server has no DNS name yet and is running as localhost.

What happens?

As soon as I click on the OpenID Provider I get an "Internal Server Error" on the page. There is no log entry corresponding to the request itself in logs/error____.log nor logs/debug_____.log.

When restarting the container via sudo docker restart LibreChat the following error occures in the logs:

# logs/error-2025-06-13.log
{"error":"expected 200 OK, got: 404 Not Found","level":"error","message":"[openidStrategy] expected 200 OK, got: 404 Not Found","name":"OPError","stack":"OPError: expected 200 OK, got: 404 Not Found\n    at processResponse (/app/node_modules/openid-client/lib/helpers/process_response.js:41:11)\n    at Issuer.discover (/app/node_modules/openid-client/lib/issuer.js:151:18)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async setupOpenId (/app/api/strategies/openidStrategy.js:117:20)"}

# logs/debug-2025-06-13.log
...
2025-06-13T13:11:04.686Z error: [openidStrategy] expected 200 OK, got: 404 Not Found

What is wrong and how to get it working?

Full startup logs and config file below.

[RNO-HMRKG]

Restart Log:

# logs/debug-2025-06-13.log
2025-06-13T13:11:02.632Z debug: [indexSync] Clearing sync timeouts before exiting...
2025-06-13T13:11:03.877Z info: [Optional] Redis not initialized.
2025-06-13T13:11:04.375Z info: [Optional] IoRedis not initialized for rate limiters.
2025-06-13T13:11:04.423Z info: Connected to MongoDB
2025-06-13T13:11:04.441Z debug: Existing Token Indexes: [
  {
    "v": 2,
    "key": {
      "_id": 1
    },
    "name": "_id_"
  },
  {
    "v": 2,
    "key": {
      "expiresAt": 1
    },
    "name": "expiresAt_1",
    "background": true,
    "expireAfterSeconds": 0
  }
]
2025-06-13T13:11:04.442Z debug: No unwanted Token indexes found.
2025-06-13T13:11:04.474Z debug: [indexSync] There are 13 messages and 13 indexed
2025-06-13T13:11:04.474Z debug: [indexSync] There are 3 convos and 3 indexed
2025-06-13T13:11:04.488Z info: Custom config file loaded:
2025-06-13T13:11:04.489Z info: {
  "version": "1.1.4",
  "cache": true,
  "endpoints": {
    "custom": [
      {
        "name": "Ollama",
        "apiKey": "ollama",
        "baseU... [truncated]
2025-06-13T13:11:04.489Z debug: Custom config:
{
  version: "1.1.4",
  cache: true,
    // 1 custom(s)
    endpoints.custom: [{"name":"Ollama","apiKey":"ollama","baseURL":"http://host.docker.internal:11434/v1/","models":{"defa... [truncated]],
}
2025-06-13T13:11:04.490Z warn: Default value for CREDS_KEY is being used.
2025-06-13T13:11:04.490Z warn: Default value for CREDS_IV is being used.
2025-06-13T13:11:04.490Z warn: Default value for JWT_SECRET is being used.
2025-06-13T13:11:04.490Z warn: Default value for JWT_REFRESH_SECRET is being used.
2025-06-13T13:11:04.490Z info: Please replace any default secret values.
2025-06-13T13:11:04.490Z info: ​

    For your convenience, use this tool to generate your own secret values:
    https://www.librechat.ai/toolkit/creds_generator

    ​
2025-06-13T13:11:04.493Z info: RAG API is running and reachable at http://rag_api:8000.
2025-06-13T13:11:04.500Z info: No changes needed for 'USER' role permissions
2025-06-13T13:11:04.501Z info: No changes needed for 'ADMIN' role permissions
2025-06-13T13:11:04.501Z info: Outdated Config version: 1.1.4
Latest version: 1.2.5

      Check out the Config changelogs for the latest options and features added.

      https://... [truncated]
2025-06-13T13:11:04.503Z info: Configuring social logins...
2025-06-13T13:11:04.503Z info: Configuring OpenID Connect...
2025-06-13T13:11:04.524Z info: OpenID Connect configured.
2025-06-13T13:11:04.526Z info: Server listening on all interfaces at port 3080. Use http://localhost:3080 to access it
2025-06-13T13:11:04.686Z error: [openidStrategy] expected 200 OK, got: 404 Not Found

[RNO-HMRKG]

.env config

HOST=localhost
PORT=3080
MONGO_URI=mongodb://127.0.0.1:27017/LibreChat
DOMAIN_CLIENT=http://localhost:3080
DOMAIN_SERVER=http://localhost:3080
NO_INDEX=true
TRUST_PROXY=1
CONSOLE_JSON=false
DEBUG_LOGGING=true
DEBUG_CONSOLE=false
PROXY=
DEBUG_PLUGINS=true
CREDS_KEY=f34Whateverf0
CREDS_IV=e234Whateverbfb
SEARCH=true
MEILI_NO_ANALYTICS=true
MEILI_HOST=http://0.0.0.0:7700
MEILI_MASTER_KEY=DrhYWhateverFCt
OPENAI_MODERATION=false
OPENAI_MODERATION_API_KEY=
BAN_VIOLATIONS=false
BAN_DURATION=1000 * 60 * 60 * 2
BAN_INTERVAL=20
LOGIN_VIOLATION_SCORE=1
REGISTRATION_VIOLATION_SCORE=1
CONCURRENT_VIOLATION_SCORE=1
MESSAGE_VIOLATION_SCORE=1
NON_BROWSER_VIOLATION_SCORE=20
LOGIN_MAX=7
LOGIN_WINDOW=5
REGISTER_MAX=5
REGISTER_WINDOW=60
LIMIT_CONCURRENT_MESSAGES=true
CONCURRENT_MESSAGE_MAX=2
LIMIT_MESSAGE_IP=true
MESSAGE_IP_MAX=40
MESSAGE_IP_WINDOW=1
LIMIT_MESSAGE_USER=false
MESSAGE_USER_MAX=40
MESSAGE_USER_WINDOW=1
ILLEGAL_MODEL_REQ_SCORE=5
ALLOW_EMAIL_LOGIN=true
ALLOW_REGISTRATION=false
ALLOW_SOCIAL_LOGIN=true
ALLOW_SOCIAL_REGISTRATION=true
ALLOW_PASSWORD_RESET=false
ALLOW_UNVERIFIED_EMAIL_LOGIN=true
SESSION_EXPIRY=1000 * 60 * 15
REFRESH_TOKEN_EXPIRY=(1000 * 60 * 60 * 24) * 7
JWT_SECRET=16f8cWhatever9ef
JWT_REFRESH_SECRET=eWhatever8418
DISCORD_CLIENT_ID=
DISCORD_CLIENT_SECRET=
DISCORD_CALLBACK_URL=/oauth/discord/callback
FACEBOOK_CLIENT_ID=
FACEBOOK_CLIENT_SECRET=
FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_CALLBACK_URL=/oauth/github/callback
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_CALLBACK_URL=/oauth/google/callback
APPLE_CLIENT_ID=
APPLE_TEAM_ID=
APPLE_KEY_ID=
APPLE_PRIVATE_KEY_PATH=
APPLE_CALLBACK_URL=/oauth/apple/callback
OPENID_CLIENT_ID=64Whatever5c
OPENID_CLIENT_SECRET=CWhateverR
OPENID_ISSUER=https://login.microsoftonline.com/1Whatever37/oauth2/v2.0/
OPENID_SESSION_SECRET="Whatever"
OPENID_SCOPE="openid profile email"
OPENID_CALLBACK_URL=/oauth/openid/callback
OPENID_REQUIRED_ROLE="Whatever_Group"
OPENID_REQUIRED_ROLE_TOKEN_KIND=id
OPENID_REQUIRED_ROLE_PARAMETER_PATH=roles
OPENID_USERNAME_CLAIM=
OPENID_NAME_CLAIM=
OPENID_BUTTON_LABEL=HMRKG
OPENID_IMAGE_URL=
OPENID_AUTO_REDIRECT=false
LDAP_URL=
LDAP_BIND_DN=
LDAP_BIND_CREDENTIALS=
LDAP_USER_SEARCH_BASE=
LDAP_CA_CERT_PATH=
EMAIL_SERVICE=
EMAIL_HOST=
EMAIL_PORT=25
EMAIL_ENCRYPTION=
EMAIL_ENCRYPTION_HOSTNAME=
EMAIL_ALLOW_SELFSIGNED=
EMAIL_USERNAME=
EMAIL_PASSWORD=
EMAIL_FROM_NAME=
[email protected]
FIREBASE_API_KEY=
FIREBASE_AUTH_DOMAIN=
FIREBASE_PROJECT_ID=
FIREBASE_STORAGE_BUCKET=
FIREBASE_MESSAGING_SENDER_ID=
FIREBASE_APP_ID=
AWS_ENDPOINT_URL=
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=
AWS_BUCKET_NAME=
AZURE_STORAGE_CONNECTION_STRING=
AZURE_STORAGE_PUBLIC_ACCESS=false
AZURE_CONTAINER_NAME=files
ALLOW_SHARED_LINKS=true
ALLOW_SHARED_LINKS_PUBLIC=true
APP_TITLE=LibreChat
HELP_AND_FAQ_URL=https://librechat.ai
RAG_API_URL=http://host.docker.internal:8000
EMBEDDINGS_PROVIDER=ollama
OLLAMA_BASE_URL=http://host.docker.internal:11434/
EMBEDDINGS_MODEL=mxbai-embed-large-v1-F16

[RNO-HMRKG]

@danny-avila may you have a look at the problem or a hint where to look for solution? I Guess its pretty simple but I cannot get it by myself. Thanks

[chrismcenteer]

Your OpenID Issuer URL is wrong, it should be:

https://login.microsoftonline.com/<tenand_id>/v2.0

You've got:

https://login.microsoftonline.com/1Whatever37/oauth2/v2.0/

You've got /oauth2/ in there and shouldn't.

[RNO-HMRKG]

Thanks. This was the solution for the Not Found error. However to get it to work I needed to use the AAD Group Object ID in the .env instead of the group name.

OPENID_REQUIRED_ROLE=<AAD-Group Objekt-ID>

[RNO-HMRKG]

Okay, using the localhost settings together with an ssh port forwarding works like it should. However using the fqdn together with a tls terminating reverse proxy yields CORS Errors in the browser, so I am stuck again.

It is even more agonizing since the CORS Error comes from the Azure endpoint. We have set up Gitea with a similar config without any problems. Do you have any idea, what and why this is happening here?

As told, using localhost:3080 with ssh port forwarding works.
I have also checked the app registration in Azure to make sure the target FQDN is set, however it looks like the only possibility to set the FQDN is at the Azure Authentication panel (seen below). Without this being set, there is the (expected) error that the callback URI is not matching the FQDN. But unfortunately this has no effect on the CORS error.

Thank you.

# .env
HOST=localhost
PORT=3080
DOMAIN_CLIENT=https://[FQDN]
DOMAIN_SERVER=https://[FQDN]
OPENID_ISSUER=https://login.microsoftonline.com/<Tennant-ID>/v2.0/

# docker-compose.override.yml no changes