How to correctly setup Azure AD for Spinnaker?

Question

I'm receiving the following error on the browser when I login to my Azure AD for OAuth with Spinnaker.

{"timestamp":1693330847528,"status":401,"error":"Unauthorized","message":"Unauthorized"}

At the same time the logs on the Spinnaker side says: 2023-08-29 16:25:35.156 WARN 1 --- [0.0-8084-exec-9] c.n.s.gate.filters.FiatSessionFilter : Authenticated user was not present in authenticated request. Check authentication settings.

I can share more information if required. Any help will be much appreciated. Thanks!

Answer 1

@Swaroop I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: How to correctly setup Azure AD for Spinnaker?

receiving the following error on the browser when I login to my Azure AD for OAuth with Spinnaker.

{"timestamp":1693330847528,"status":401,"error":"Unauthorized","message":"Unauthorized"}

At the same time the logs on the Spinnaker side says: 2023-08-29 16:25:35.156 WARN 1 --- [0.0-8084-exec-9] c.n.s.gate.filters.FiatSessionFilter : Authenticated user was not present in authenticated request. Check authentication settings.

Resolution: Resolved by @Swaroop Below are the steps reference links.

This is a new configuration, you were trying to change the Oauth for Spinnaker from GitHub (which works) to Azure AD. I followed the steps mentioned here and here.

this has been resolved. It turns out the client secret wasn't decoded properly (the trailing newline character had to be excluded) in the Kubernetes secret. It should be either

echo -n '<client_secret>' | base64 and then copy the output to a secret

or

kubectl -n spinnaker create secret generic spin-secrets --from-literal=oauth-client-secret-azure=<client_secret>

and not -

echo '<client_secret>' | base64

If you have any other questions or are still running into more issues, please let me know.
Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.