# How To configure Okteto with Azure OpenID Connect?

**URL:** <https://community.okteto.com/t/how-to-configure-okteto-with-azure-openid-connect/281>\
**Category:** Okteto Self-Hosted\
**Created:** [October 4, 2022, 1:39pm UTC](https://community.okteto.com/t/how-to-configure-okteto-with-azure-openid-connect/281 "2022-10-04T13:39:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarcinS](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@MarcinS](https://community.okteto.com/u/MarcinS)\
**Post date:** [October 4, 2022, 1:39pm UTC](https://community.okteto.com/t/how-to-configure-okteto-with-azure-openid-connect/281/1 "2022-10-04T13:39:57Z")

</div>

Just like in title if you could provide me with instructions how to configure auth: section in Okteko config file and, a service principle on Azure side it self. So far with configuration below I got “Service unavailable error” although all pods are working.

auth:  
openid:  
enabled: true  
clientId: 246d00c0-2b7c-41f5-a943-986480981e9e  
clientSecret: ???  
endpoints:  
issuer: [https://login.microsoftonline.com/100b3c99-f3e2-4da0-9c8a-b9d345742c36](https://login.microsoftonline.com/100b3c99-f3e2-4da0-9c8a-b9d345742c36)  
authorization: [Sign in to your account](https://login.microsoftonline.com/100b3c99-f3e2-4da0-9c8a-b9d345742c36/oauth2/authorize)

 ![image](https://us1.discourse-cdn.com/flex019/uploads/okteto/original/1X/cfc1c5917730657cb78f34fede3e0331fbc20782.png)

---

<div class="post-metadata">

**Author:** ![gabriel](https://avatars.discourse-cdn.com/v4/letter/g/9de0a6/32.png) [@gabriel](https://community.okteto.com/u/gabriel)\
**Post date:** [October 4, 2022, 2:10pm UTC](https://community.okteto.com/t/how-to-configure-okteto-with-azure-openid-connect/281/2 "2022-10-04T14:10:29Z")

</div>

Hey there,

When I was setting this up and getting the auth online the main issues were the endpoint and endpoint.mapping entries

```auto
    endpoints:
      issuer: https://sts.windows.net/<YOUR_TENENT_ID>/
      authorization: https://login.microsoftonline.com/<YOUR_TENENT_ID>/oauth2/v2.0/authorize
    mapping:
      externalIDKey: email

```

For a complete config based on one of our sample domains ‘[picoserver.io](http://picoserver.io)’ :

```auto
email: <YOUR_EMAIL_ADDRESS>
subdomain: dev.<YOUR_DNS_ZONE>
cluster:
  endpoint: "https://<YOUR_CLUSTER_ADDRESS>:443"
auth:
  openid:
    enabled: true
    clientId: <YOUR_CLIENT_ID>
    clientSecret: <YOUR_CLIENT_SECRET>
    endpoints:
      issuer: https://sts.windows.net/<YOUR_TENENT_ID>/
      authorization: https://login.microsoftonline.com/<YOUR_TENENT_ID>/oauth2/v2.0/authorize
    mapping:
      externalIDKey: email
cloud:
  provider:
    azure:
      enabled: true
      storage:
        container: "<YOUR_CONTAINER_NAME>"
        accountName: "<YOUR_STORAGE_ACCOUNT_NAME>"
buildkit:
  ingress:
    enabled: false
  service:
    type: LoadBalancer

```

The tenant Id is labeled “Directory (tenant) ID” and auth.clientId is labeled “Application (client) ID” from the “App registrations” page:

 ![Screen Shot 2022-10-04 at 16.05.49](https://us1.discourse-cdn.com/flex019/uploads/okteto/original/1X/c33f16e059250c93fa89fa8957afae54e9a7b24b.jpeg)

The auth.clientSecret is the “Value” from the “Certificates & secrets” tab of the “App registrations” page:

 ![Screen Shot 2022-10-04 at 16.06.01](https://us1.discourse-cdn.com/flex019/uploads/okteto/original/1X/ddad6e57d378d43abf0c861b93f6f8a1bac6083c.jpeg)

---

<div class="post-metadata">

**Author:** ![MarcinS](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@MarcinS](https://community.okteto.com/u/MarcinS)\
**Post date:** [October 5, 2022, 7:59am UTC](https://community.okteto.com/t/how-to-configure-okteto-with-azure-openid-connect/281/3 "2022-10-05T07:59:49Z")

</div>

> [@gabriel](#):
>
> `UR_C`

Could you also share the Authentication blade for App registration ? Platform configuration (WEB or SPA), Redirect uris and which tokens to use (Access tokens or ID tokens ). ?

---

<div class="post-metadata">

**Author:** ![gabriel](https://avatars.discourse-cdn.com/v4/letter/g/9de0a6/32.png) [@gabriel](https://community.okteto.com/u/gabriel)\
**Post date:** [October 5, 2022, 8:24am UTC](https://community.okteto.com/t/how-to-configure-okteto-with-azure-openid-connect/281/4 "2022-10-05T08:24:09Z")

</div>

Hey there,

On the Authentication configuration this was configured with the platform ‘Web’ and there is a single entry under Redirect URIs set to https://okteto.dev.\<YOUR\_DNS\_ZONE\>/auth/callback  
Front-channel logout URL is empty.  
Neither of the Implicit grant and hybrid flows options checked.

 ![Screen Shot 2022-10-05 at 10.20.52](https://us1.discourse-cdn.com/flex019/uploads/okteto/original/1X/f96a44675070ea29bb56dfd0cc2508c9bf994442.jpeg)