This message was deleted.

Hey Johannes, can you show me how the config is supposed to look? Make sure not to post any secrets tho 🙏

@damp-car-18231 maybe the CLI itself “failed the task successfully” 😅 Why don’t you try to 1. Get the config

ory get identity-config {project-id} --format yaml > identity-config.yaml

2. Edit the config. 3. Push updated config to Ory Network

ory update identity-config {project-id} --file identity-config.yaml

Just like it was described in the doc 😉

@User This is how I want the config to look like:

oidc:
  config:
    base_redirect_uri: <https://ory.igniteprocurement.com/>
    providers:
    - client_id: <client_id>
      client_secret: <client_secret>
      id: microsoft
      label: Microsoft
      mapper_url: <url_goes_here>
      microsoft_tenant: common
      provider: microsoft
      subject_source: me
      scope:
      - <https://graph.microsoft.com/User.Read>
      - profile
      - email
      - openid

@User that’s what i tried initially.

<https://graph.microsoft.com/User.Read>

was successfully added to

scope

but

subject_source

was not added.

@damp-car-18231 that looks like a bug 😞 Can you open an issue in the https://github.com/ory/network repo and include all relevant details? We’ll do our best to squash this bug 🐛

Ok, thanks!

@damp-car-18231 hey, I'm wondering, were you able to configure ory with azure ad? We are doing a POC, deploying ory in k8s via ArgoCd and trying to use our azure ad as oidc, but I'm not sure how to create the jssonnet to map the identities.

We built a service that pulls users from azure via microsoft graph and pushes them to ory cloud. Looks something like this in Go:

func (w *worker) createOryIdentity(ctx context.Context, user adclient.User) (*oryclient.Identity, error) {
	identityState := oryclient.IDENTITYSTATE_ACTIVE
	createIdentityBody := oryclient.CreateIdentityBody{
		Credentials: &oryclient.IdentityWithCredentials{
			Oidc: &oryclient.IdentityWithCredentialsOidc{
				Config: &oryclient.IdentityWithCredentialsOidcConfig{
					Providers: []oryclient.IdentityWithCredentialsOidcConfigProvider{
						oryclient.IdentityWithCredentialsOidcConfigProvider{
							Provider: "microsoft",
							Subject:  user.Id,
						},
					},
				},
			},
		},
		SchemaId: w.orySchemaId,
		State:    &identityState,
		Traits: map[string]interface{}{
			"email": user.Mail,
			"name": map[string]string{
				"first": user.GivenName,
				"last":  user.Surname,
			},
		},
		VerifiableAddresses: []oryclient.VerifiableIdentityAddress{
			*oryclient.NewVerifiableIdentityAddress("completed", user.Mail, true, "email"),
		},
	}
	identity, err := w.oryClient.CreateIdentity(ctx, createIdentityBody)
	return identity, err
}

Thanks! We are running the POC in a k8s, but I'm not sure how to add the jsonnet. Eg:

oidc:
                enabled: true
                config:
                  providers:
                    - id: microsoft
                      provider: microsoft
                      client_id: client_id
                      client_secret: client_secret
                      microsoft_tenant: common
                      issuer_url: <https://login.microsoftonline.com>
                      mapper_url: file:///etc/config/oidc.microsoft.jsonnet
                      scope:
                        - openid
                        - profile
                        - email

However, I don't now how to add that file to the directory when the container is run. I wouldn't like to retrieve that file from an urls as the manual indicates, but I've not been able to add it to the directory when instantiating the container.

We’re using this. Think it’s the standard mapping from ory. However we have user registration through ory disabled and handle user creation through our custom service which connects via the admin api. So I don’t think the jsonnet map is ever used.

oidc:
  config:
    base_redirect_uri: <redirect-uri>
    providers:
    - client_id: <azure-client-id>
      client_secret: <azure-client-secret>
      id: microsoft
      label: Microsoft
      mapper_url: <https://storage.googleapis.com/bac-gcs-production/ca2c1bb3278251cd64913563fcff9412253581c821d078016e55761e965f989530a8777852603e571aa19ec09553af1cfdd28ba58489d94e4e2f9b906d04455f.jsonnet>
      microsoft_tenant: common
      provider: microsoft
      scope:
      - <https://graph.microsoft.com/User.Read>
      - profile
      - email
      - openid
      subject_source: me
  enabled: true

I'll check that out, thanks!! It's been a pain doing this POC, so your help is more than welcome

Are you serving kratos on 4455?

Yes, we are