Loading...

XML

Word

Printable

Type: Bug
Resolution: Fixed
Priority: Minor
Fix Version/s: 4.5.5, 5.0.1
Affects Version/s: 4.4.4, 4.5.1
Component/s: Authentication
Labels:

Affected Branches:
MOODLE_404_STABLE, MOODLE_405_STABLE
Fixed Branches:
MOODLE_405_STABLE, MOODLE_500_STABLE
Pull from Repository:
https://github.com/HuongNV13/moodle.git
Pull 4.5 Branch:
~~MDL-84432~~-405
Pull 4.5 Diff URL:
https://github.com/HuongNV13/moodle/compare/7acd85a1aa...MDL-84432-405?w=1
Pull 5.0 Branch:
~~MDL-84432~~-500
Pull 5.0 Diff URL:
https://github.com/HuongNV13/moodle/compare/1260cb24b8...MDL-84432-500?w=1
Pull Main Branch:
~~MDL-84432~~-main
Pull Main Diff URL:
https://github.com/HuongNV13/moodle/compare/c39b737063...MDL-84432-main?w=1
Testing Instructions:
Hide

Setup

Create a new site, but don't install it yet

Check out weekly/on-demand/beta, as we need to test the upgrade in this test

Install your site now

See ~~MDLQA-20111~~ and complete the test. This just confirms we have a working legacy Microsoft OAuth2 setup. (Name it Microsoft)

Testing upgrade

Checkout to the latest branch (Or apply the patch).

Upgrade the site and verify there are no errors.

Go to "Site admin > Server > OAuth 2 services".

Edit the "Microsoft" issuer.

Verify the base URL is set to 'https://login.microsoftonline.com/common/v2.0'

Cancel and go back to the issuers list.

View the endpoints for the issuer.

Verify that you see the following endpoints:

discovery_endpoint: https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration

token_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/token

userinfo_endpoint: https://graph.microsoft.com/oidc/userinfo

authorization_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/authorize

device_authorization_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/devicecode

end_session_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/logout

kerberos_endpoint: https://login.microsoftonline.com/common/kerberos

Verify that you will not see userpicture_endpoint endpoint.

Go back to the issuer list.

View the user field mappings for the issuer

Verify that you see the following fields mappings:

sub: idnumber

givenname: firstname

familyname: lastname

email: email

locale: lang

Log out

Again, from ~~MDLQA-20111~~, run through the "4-7" steps. This just confirms we have a working upgraded Microsoft setup now.

Testing new integrations

From ~~MDLQA-20111~~, run the first step to create another integration with Microsoft but call this one "Microsoft 2" or something to make it clear it's been created after upgrade.

Edit the "Microsoft 2" issuer you just created.

Verify the base URL is set to 'https://login.microsoftonline.com/common/v2.0'

Cancel and go back to the issuers list

View the endpoints for the issuer

Verify that you see the following endpoints:

discovery_endpoint: https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration

token_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/token

userinfo_endpoint: https://graph.microsoft.com/oidc/userinfo

authorization_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/authorize

device_authorization_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/devicecode

end_session_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/logout

kerberos_endpoint: https://login.microsoftonline.com/common/kerberos

Go back to the issuer list.

View the user field mappings for the issuer

Verify that you see the following fields mappings:

sub: idnumber

givenname: firstname

familyname: lastname

email: email

locale: lang

Log out

Again, from ~~MDLQA-20111~~, run through the "4-7" steps. This just confirms we have a working upgraded Microsoft setup now.
Show
Setup Create a new site, but don't install it yet Check out weekly/on-demand/beta, as we need to test the upgrade in this test Install your site now See MDLQA-20111 and complete the test. This just confirms we have a working legacy Microsoft OAuth2 setup. (Name it Microsoft) Testing upgrade Checkout to the latest branch (Or apply the patch). Upgrade the site and verify there are no errors. Go to "Site admin > Server > OAuth 2 services". Edit the "Microsoft" issuer. Verify the base URL is set to 'https://login.microsoftonline.com/common/v2.0' Cancel and go back to the issuers list. View the endpoints for the issuer. Verify that you see the following endpoints: discovery_endpoint: https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration token_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/token userinfo_endpoint: https://graph.microsoft.com/oidc/userinfo authorization_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/authorize device_authorization_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/devicecode end_session_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/logout kerberos_endpoint: https://login.microsoftonline.com/common/kerberos Verify that you will not see userpicture_endpoint endpoint. Go back to the issuer list. View the user field mappings for the issuer Verify that you see the following fields mappings: sub: idnumber givenname: firstname familyname: lastname email: email locale: lang Log out Again, from MDLQA-20111 , run through the "4-7" steps. This just confirms we have a working upgraded Microsoft setup now. Testing new integrations From MDLQA-20111 , run the first step to create another integration with Microsoft but call this one "Microsoft 2" or something to make it clear it's been created after upgrade. Edit the "Microsoft 2" issuer you just created. Verify the base URL is set to 'https://login.microsoftonline.com/common/v2.0' Cancel and go back to the issuers list View the endpoints for the issuer Verify that you see the following endpoints: discovery_endpoint: https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration token_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/token userinfo_endpoint: https://graph.microsoft.com/oidc/userinfo authorization_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/authorize device_authorization_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/devicecode end_session_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/logout kerberos_endpoint: https://login.microsoftonline.com/common/kerberos Go back to the issuer list. View the user field mappings for the issuer Verify that you see the following fields mappings: sub: idnumber givenname: firstname familyname: lastname email: email locale: lang Log out Again, from MDLQA-20111 , run through the "4-7" steps. This just confirms we have a working upgraded Microsoft setup now.
Pre-check results:
Hide

Code verified against automated checks.

Checked ~~MDL-84432~~ using repository: https://github.com/HuongNV13/moodle.git

MOODLE_405_STABLE (0 errors / 0 warnings) [branch: MDL-84432-405 | CI Job]

MOODLE_500_STABLE (0 errors / 0 warnings) [branch: MDL-84432-500 | CI Job]

main (0 errors / 0 warnings) [branch: MDL-84432-main | CI Job]

_{More information about this report}

Built on: Fri May 16 02:21:51 UTC 2025
Show
Code verified against automated checks. Checked MDL-84432 using repository: https://github.com/HuongNV13/moodle.git MOODLE_405_STABLE (0 errors / 0 warnings) [branch: MDL-84432-405 | CI Job ] MOODLE_500_STABLE (0 errors / 0 warnings) [branch: MDL-84432-500 | CI Job ] main (0 errors / 0 warnings) [branch: MDL-84432-main | CI Job ] More information about this report Built on: Fri May 16 02:21:51 UTC 2025
Automated test results:
Hide

Launching automatic jobs for branch ~~MDL-84432~~-405

https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19392/ PHPUnit (sqlsrv / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66334/ Behat (NonJS - boost and classic / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66335/ Behat (Firefox - boost / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66336/ Behat (Firefox - classic / complete)

Launching automatic jobs for branch ~~MDL-84432~~-500

https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19393/ PHPUnit (sqlsrv / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66337/ Behat (NonJS - boost and classic / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66338/ Behat (Firefox - boost / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66339/ Behat (Firefox - classic / complete)

Launching automatic jobs for branch ~~MDL-84432~~-main

https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19394/ PHPUnit (sqlsrv / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66340/ Behat (NonJS - boost and classic / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66341/ Behat (Firefox - boost / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66342/ Behat (Firefox - classic / complete)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66343/ App tests (stable app version) / complete)

Built on: Tue May 20 09:35:00 UTC 2025
Show
Launching automatic jobs for branch MDL-84432 -405 https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19392/ PHPUnit (sqlsrv / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66334/ Behat (NonJS - boost and classic / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66335/ Behat (Firefox - boost / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66336/ Behat (Firefox - classic / complete) Launching automatic jobs for branch MDL-84432 -500 https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19393/ PHPUnit (sqlsrv / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66337/ Behat (NonJS - boost and classic / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66338/ Behat (Firefox - boost / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66339/ Behat (Firefox - classic / complete) Launching automatic jobs for branch MDL-84432 -main https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19394/ PHPUnit (sqlsrv / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66340/ Behat (NonJS - boost and classic / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66341/ Behat (Firefox - boost / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66342/ Behat (Firefox - classic / complete) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/66343/ App tests (stable app version) / complete) Built on: Tue May 20 09:35:00 UTC 2025

Story Points:
6
Sprint:
Team Hedgehogs 2025 Sprint 2.2

STEPS TO REPLICATE

Create a Microsoft Oauth2 single tenant service following the directions here https://docs.moodle.org/404/en/OAuth_2_Microsoft_service

OBSERVED BEHAVIOR

Once the service has been created notice that the "Discovery" column is showing no connection "-". If you navigate to the "Configure Endpoints" setting, you will not see the "discovery-endpoint" listed.

Manually adding the "discovery-endpoint" also does not work, as all this does is place an "X" in the discovery column and does not connect.

EXPECTED BEHAVIOR

Adding the "Service base URL" during the initial Oauth2 Setup, should have triggered the service to add the "discovery-endpoint" and connected successfully.

Notice that if you create a "Custom" Oauth 2 Service and copy the same settings from the Microsoft service created, you will see that the discovery-endpoint is created automatically, and the connection is successful.

The current workaround is for clients to create a Custom service in Moodle using the Microsoft Oauth2 setup documentation.

- - Sort By Name
  - Sort By Date
  - Ascending
  - Descending
  - Thumbnails
  - List
  - Download All

MDLQA-20111.png
28 kB
05/Jun/25 9:46 PM
MDL-84432 verify 4.png
40 kB
05/Jun/25 9:46 PM
MDL-84432 verify 3.png
80 kB
05/Jun/25 9:46 PM
MDL-84432 verify 2.png
83 kB
05/Jun/25 9:46 PM
MDL-84432 verify 1.png
8 kB
05/Jun/25 9:46 PM
image-2025-02-05-14-06-26-149.png
66 kB
06/Feb/25 3:06 AM
image-2025-02-05-14-06-14-324.png
73 kB
06/Feb/25 3:06 AM
image-2025-02-05-14-06-04-907.png
115 kB
06/Feb/25 3:06 AM
image-2025-02-05-14-05-49-638.png
74 kB
06/Feb/25 3:05 AM
image-2025-02-05-14-05-36-762.png
77 kB
06/Feb/25 3:05 AM
image-2025-02-05-14-05-17-385.png
80 kB
06/Feb/25 3:05 AM
comparison.png
309 kB
12/May/25 1:07 PM

has a non-specific relationship to

MDL-85489 Modifying Oauth2 Service base URL won't update URLs of endpoints

Open

will help resolve

MDL-85194 Moodle SMTP XOAUTH2 Authentication

Open

MDL-80380 Fix Microsoft OAuth2 support - Scope & Endpoint

Closed

Assignee:: Huong Nguyen

Reporter:: John Hege

Peer reviewer:: David Woloszyn

Integrator:: Shamim Rezaie

Tester:: Stevani Andolo

Participants:: CiBoT, David Woloszyn, Huong Nguyen, John Hege, Mihail Geshoski, Simey Lameze, Stevani Andolo

Votes:: 1 Vote for this issue

Watchers:: 5 Start watching this issue

Created:: 06/Feb/25 3:03 AM

Updated:: 13/Jun/25 4:14 PM

Resolved:: 05/Jun/25 11:11 PM

Estimated:

Not Specified

Remaining:

Logged:

4d 2h 15m

Details

Setup

Testing upgrade

Testing new integrations

Description

Attachments

Attachments

Issue Links

Activity

People

Dates

Time Tracking

Clockify