Hey guys I am fairly new to Kratos so bare with me slightly

Question

Hey guys I am fairly new to Kratos so bare with me slightly smiling face I ve tried looking thru the issues on Github docs and also looked thru this chat for answers but I can t seem to wrap my head around how to solve my issue So I run Kratos in my AKS installed with helm chart and using image tag v0 9 0 alpha 2 and testing it with kratos selfservice ui react nextjs locally Register amp login works perfect but as soon as I add Microsoft OIDC I run into problems when I try to Sign in with Microsoft Error in the UI ``` id 4f4d6d4f 2a2e 4a5a 8b48 c99e3ffdc77a error code 400 debug key ory kratos oidc auth code session does not exist in cookie ory kratos continuity reason The browser does not contain the neccesary cookie to resume the session This is a security violation and was thus blocked Please clear your browser s cookies and cache and try again status Bad Request message no resumable session found created at 2022 03 23T07 37 14 567199Z updated at 2022 03 23T07 37 14 567199Z ``` helm install kratos f values yaml ory kratos values yaml ```kratos autoMigrate true identitySchemas identity default schema json | $id $schema title Person type object properties traits type object properties email type string format email title E Mail minLength 3 credentials password identifier true totp account name true verification via email recovery via email name type object properties first title First Name type string last title Last Name type string role title Role type string default user enum user admin group title Group type array items type string required email additionalProperties true config version v0 9 0 alpha 2 serve public base url cors enabled true dsn courier smtp connection uri identity default schema id default schemas id default url file etc config identity default schema json log level debug format text leak sensitive values true selfservice default browser return url allowed return urls methods oidc enabled true config providers id microsoft this is ` lt provider id gt ` in the Authorization callback URL DO NOT CHANGE IT ONCE SET provider microsoft client id Replace this with the Application ID from the App Registration client secret Replace this with the generated Secret value from the App Registration 0ee5be1e 4071 45a5 b18d 14b6183ee327 microsoft tenant Replace this with the Tenant of your choice see below mapper url file etc config kratos oidc microsoft jsonnet scope profile email password enabled true flows error ui url settings ui url privileged session max age 15m recovery enabled true ui url verification enabled true ui url after default browser return url logout after default browser return url login ui url lifespan 10m registration lifespan 10m ui url after oidc hooks hook session password hooks hook session ciphers algorithm xchacha20 poly1305 hashers algorithm bcrypt bcrypt cost 8 secrets cookie SOME RANDOM VALUE HERE cipher SOME RANDOM VALUE HERE TOO cookies domain same site Lax session cookie domain same site Lax image repository oryd kratos tag v0 9 0 alpha 2 imagePullPolicy Always deployment livenessProbe httpGet path health alive port http admin initialDelaySeconds 60 periodSeconds 10 failureThreshold 5 readinessProbe httpGet path health ready port http admin initialDelaySeconds 60 periodSeconds 10 failureThreshold 5 extraVolumes name oidc microsoft jsonnet secret secretName oidc microsoft jsonnet extraVolumeMounts name oidc microsoft jsonnet mountPath etc config kratos readOnly true ingress admin enabled true className nginx annotations false 0 600 600 true letsencrypt hosts host paths path pathType ImplementationSpecific tls secretName kratosadmin tls hosts public enabled true annotations false 0 600 600 true letsencrypt className nginx hosts host paths path pathType Prefix tls secretName kratos pub tls hosts ```

narrow-kitchen-3944 · Answer

oidc microsoft jsonnet ```apiVersion v1 kind Secret metadata name oidc microsoft jsonnet stringData oidc microsoft jsonnet | local claims = std extVar claims identity traits Allowing unverified email addresses enables account enumeration attacks if the value is used for verification or as a password login identifier If connecting only to your organization one tenant claims email is safe to use if you haven t actively disabled e mail verification during signup The email might be empty if the account isn t linked to an email address For a human readable identifier consider using the preferred username claim if email in claims then email else null claims email ``` AzureAD app registered as Web platform with redirect URIs ``` ``` I see two cookies set with some values in my browser ory kratos continuity and csrf token afc I have tried to clear the cookies in browser but no success Hopefully someone here can help me pointing out where I m going wrong slightly smiling face Thanks