Repository navigation
[BUG] Tinyauth doesn't retrieve groups with AzureAD #496
Description
Describe the bug
Hi,
Tinyauth doesn't retrieve groups with AzureAD.
I success to log in but I can't access to app because tinyauth don't find groups with my account.
TinyAuth logs :
2025-12-04T09:39:14Z DBG internal/controller/oauth_controller.go:188 > No preferred username from OAuth provider, using pseudo username
Email=XXXXXXXX Name=AUBIN Nicolas OAuthGroups= OAuthName=AzureAd Provider=generic TotpPending=false UUID= Username=XXXXXXXX
2025-12-04T09:39:14Z TRC internal/controller/oauth_controller.go:201 > Creating session cookie session_cookie=
OAuthGroups is empty !
My container config:
PROVIDERS_GENERIC_CLIENT_ID: <client_id>
PROVIDERS_GENERIC_CLIENT_SECRET: <client_secret>
PROVIDERS_GENERIC_AUTH_URL: https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/authorize
PROVIDERS_GENERIC_TOKEN_URL: https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token
PROVIDERS_GENERIC_USER_INFO_URL: https://graph.microsoft.com/oidc/userinfo
PROVIDERS_GENERIC_REDIRECT_URL: https://<my_app_host>/api/oauth/callback/generic
PROVIDERS_GENERIC_SCOPES: "openid profile email"
PROVIDERS_GENERIC_NAME: AzureAd
My id_token gets groups:
Device (please complete the following information):
- OS: Debian
- Browser Firefox
- Tinyauth V4.1.0
- Docker 27.4.1 (rootless)
Activity
[-][BUG][/-][+][BUG] Tinyauth doesn't retrieve groups with AzureAD[/+]naub1n commentedon Dec 4, 2025
TinyAuth seems to read groups with
USER_INFO_URL, AzureAd doesn't send groups inhttps://graph.microsoft.com/oidc/userinfo. 😢 . It is right ?steveiliop56 commentedon Dec 8, 2025
Not sure to be honest. If Azure does not return the groups in the user info endpoint, then Tinyauth won't be able to fetch them. From a quick Google search it seems to only return:
{ "sub": "OLu859SGc2Sr9ZsqbkG-QbeLgJlb41KcdiPoLYNpSFA", "name": "Mikah Ollenburg", // all names require the “profile” scope. "family_name": " Ollenburg", "given_name": "Mikah", "picture": "https://graph.microsoft.com/v1.0/me/photo/$value", "email": "mikoll@contoso.com" // requires the “email” scope. }naub1n commentedon Dec 10, 2025
Yes, Tinyauth should use Microsoft Graph API to retrieve Azure AD groups or use groups in id_token.
Perhaps in a future release ! 😉
feat: extract OAuth groups from ID token when userinfo omits them