Creating an OIDC Connection Fails with "options.issuer is required" Error

When trying to create an Azure Active Directory (AD) or Google Workspace Open ID Connect (OIDC) connections via CLI or Dashboard, different discovery URLs throw the same error: 

Bad Request: "options.issuer" is required

The discovery URL returns the "issuer" field.

• OIDC Connection

Azure AD Connections

• The URL https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration  is invalid because it contains an invalid issuer ("issuer":"https://login.microsoftonline.com/{tenantid}/v2.0") (the {tenantid} is causing the Issue)
  • Use the well-known URL with the specific Azure tenant ID, e.g., https://login.microsoftonline.com/8eaef023-2b34-4da1-9baa-8bc8c9d6a490/v2.0/.well-known/openid-configuration.
  • Refer to the Microsoft article on OpenID configuration document URI. 

Google Workspace

• The URL https://accounts.google.com/.well-known/openid-configuration endpoint does not advertise response_modes_supported.

Azure AD Connections

Using the Microsoft Common URL (https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration) is not something the custom OIDC connection supports. The {tenantid} within the issuer is indeed considered invalid.

• Instead, a built-in: waad connection set with the OpenID Connection protocol (waad_protocol: “openid-connect”) should be used. From the manage dashboard UI, this is known as a Microsoft Azure AD connection.
• Connect Your App to Microsoft Azure Active Directory provides a high level intro to the connection type and Choose a Connection Type for Azure AD provides a detailed comparison of connection types.

Google Workspace

• Use options.type: "back_channel" when creating a Google Workspace OIDC Connection.