SSO Login / Entra

[TroRon]

Have I missed something, is it not possible, or am I making a mistake somewhere?

Has anyone managed to restrict the use of Stirling PDF with Entra, or to authenticate the user via Entra?

If so, would anyone have a Docker Compose file as an example?
The container always crashes completely for me.

I have managed to get the app to run, but after authentication I just end up back at the login screen.

Currently the container doesn't even start anymore and I'm wondering why :(

Many thanks for a little help.

Ronny

[TroRon]

Does no one have any ideas on this?

[Frooodle]

Can you share your current settings?

[TroRon]

Sure.

Thanks for your reply and a time.

I have found many examples but want to hang the whole thing Entra, I'm sure I'm doing something wrong ...:
SECURITY_OAUTH2_ENABLED: “true”
SECURITY_OAUTH2_PROVIDER: M365
SECURITY_OAUTH2_ISSUER: https://xxxx.....
SECURITY_OAUTH2_CLIENTSECRET: xxxxxxx
SECURITY_OAUTH2_SCOPES: openid,profile,email
SECURITY_OAUTH2_USEASUSERNAME: email
SECURITY_OAUTH2_AUTOCREATEUSER: “true”

[TroRon]

With this config, the container comes up:

services:
stirling-pdf:
container_name: test-pdf-tool
image: frooodle/s-pdf:latest
deploy:
resources:
limits:
memory: 4G
healthcheck:
test:
- CMD-SHELL
- curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP' &&
curl -fL http://localhost:8080/ | grep -q 'Please sign in'
interval: 5s
timeout: 10s
retries: 16
ports:
- 8075:8080
volumes:
- /docker/pdf_test/data:/usr/share/tessdata:rw
- /docker/pdf_test/config:/configs:rw
- /docker/pdf_test/logs:/logs:rw
environment:
DOCKER_ENABLE_SECURITY: "true"
SECURITY_ENABLELOGIN: "true"
SECURITY_OAUTH2_ENABLED: "true"
SECURITY_OAUTH2_AUTOCREATEUSER: "true" # This is set to true to allow auto-creation of non-existing users in Stirling-PDF
SECURITY_OAUTH2_ISSUER: https://accounts.google.com # Change with any other provider that supports OpenID Connect Discovery (/.well-known/openid-configuration) end-point
SECURITY_OAUTH2_CLIENTID: .apps.googleusercontent.com # Client ID from your provider
SECURITY_OAUTH2_CLIENTSECRET: # Client Secret from your provider
SECURITY_OAUTH2_SCOPES: openid,profile,email # Expected OAuth2 Scope
SECURITY_OAUTH2_USEASUSERNAME: email # Default is 'email'; custom fields can be used as the username
SECURITY_OAUTH2_PROVIDER: AD Login (test Staff) # Set this to your OAuth provider's name, e.g., 'google' or 'keycloak'
PUID: 1002
PGID: 1002
UMASK: "022"
SYSTEM_DEFAULTLOCALE: de-DE
UI_APPNAME: PDF Toolbox
UI_HOMEDESCRIPTION: test - PDF Toolbox
UI_APPNAMENAVBAR: test - PDF Toolbox
SYSTEM_MAXFILESIZE: "100"
METRICS_ENABLED: "true"
SYSTEM_GOOGLEVISIBILITY: "true"
restart: on-failure:5
networks: {}

However, as soon as I make adjustments for Azure, I get the following message:

The Issuer "https://sts.windows.net/xxxxxxxxxxxxxxxx/" provided in the configuration metadata did not match the requested issuer "https://login.microsoftonline.com/xxxxxxx/"

Does anyone here have any tips?

[TroRon]

Ok, I have now found out the Issuer URL at Azure...

Now the redirect URL is probably not yet correct ...

[TroRon]

Works now ;)

Preparations

---

Create an APP in Entra according to the known procedure.

Necessary information from the Entra app, after configuration:

---

Issuer:
https://login.microsoftonline.com/TenantID/v2.0

Client ID
Client Secret

Reverse URL:
https://xxxxxxx.ch/login/oauth2/code/oidc

Working Config;

---

services:
stirling-pdf:
container_name: Test-pdf-tool
image: frooodle/s-pdf:latest
deploy:
resources:
limits:
memory: 4G
healthcheck:
test:
- CMD-SHELL
- curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP' &&
curl -fL http://localhost:8080/ | grep -q 'Please sign in'
interval: 5s
timeout: 10s
retries: 16
ports:
- 8075:8080
volumes:
- /docker/pdf_Test/data:/usr/share/tessdata:rw
- /docker/pdf_Test/config:/configs:rw
- /docker/pdf_Test/logs:/logs:rw
environment:
DOCKER_ENABLE_SECURITY: "true"
SECURITY_ENABLELOGIN: "true"
SECURITY_OAUTH2_ENABLED: "true"
SECURITY_OAUTH2_AUTOCREATEUSER: "true" # This is set to true to allow auto-creation of non-existing users in Stirling-PDF
SECURITY_OAUTH2_ISSUER: Confidential # Change with any other provider that supports OpenID Connect Discovery (/.well-known/openid-configuration) end-point
SECURITY_OAUTH2_CLIENTID: Confidential
# Client ID from your provider
SECURITY_OAUTH2_CLIENTSECRET: Confidential
# Client Secret from your provider
SECURITY_OAUTH2_SCOPES: openid,profile,email # Expected OAuth2 Scope
SECURITY_OAUTH2_USEASUSERNAME: email # Default is 'email'; custom fields can be used as the username
SECURITY_OAUTH2_PROVIDER: AD Login # Set this to your OAuth provider's name, e.g., 'google' or 'keycloak'
PUID: 1002
PGID: 1002
UMASK: "022"
SYSTEM_DEFAULTLOCALE: de-DE
UI_APPNAME: PDF Toolbox
UI_HOMEDESCRIPTION: Test - PDF Toolbox
UI_APPNAMENAVBAR: Test - PDF Toolbox
SYSTEM_MAXFILESIZE: "100"
METRICS_ENABLED: "true"
SYSTEM_GOOGLEVISIBILITY: "true"
restart: on-failure:5
networks: {}

[Frooodle]

Any tips you can give to others with similar issues?

[hanwg]

I had issues configuring OIDC and was able to resolve it myself.
The value of SECURITY_OAUTH2_ISSUER should not end with "/.well-known/openid-configuration". This is because that suffix is automatically added.
Hope it's useful for others who might encounter the same.