infra
infra copied to clipboard
Azure OIDC Providers client ID and client secret cannot be validated on creation
Describe the bug
An invalid client ID and client secret can be set for an Azure OIDC provider.
Expected behavior
We rely on the OIDC provider returning an error response from the OIDC token endpoint when validating that a provider exists, but Azure returns a 200 OK with some error details in a web page. It does not honor the Accept header either.
Screenshots
Additional context
We will probably have to look at alternative ways to verify Azure, if it is possible.