Unable to login via OAuth (Microsoft / Azure)

[need4swede]

Describe the Bug

I followed these steps: https://www.bookstackapp.com/docs/admin/third-party-auth/#azuread-microsoft

I see the 'Login with Microsoft' on the login page.
After logging in with MS account, I get back to BookStack and see this error:

An Error Occurred
An unknown error occurred

I don't see any other errors in the logs. Keys, Permissions and Callback settings are all correct from what I can tell.
The env variables are passed in directly to my docker-compose. The docs mentions putting it in .env - maybe this is why?
How can I bind my .env file? Not sure what the container path is...

My instance of BookStackApp is accessible via reverse proxy. Here is the relevant part in my Caddyfile:

sub.domain.net {
    reverse_proxy <ip>:<port>
}

Steps to Reproduce

1. Registered app in Azure AD
2. Setup 'User.read' permissions (even tried granting admin consent)
3. Pass in credentials via docker-compose
4. Try to login via Microsoft account in running instance of BookStack
5. Face error after logging in via MS account

Expected Behaviour

Allow OAuth login via MS / Azure

Screenshots or Additional Context

Browser Details

No response

Exact BookStack Version

v24.12.1-ls192

[ssddanbrown]

Hi @need4swede,

I don't see any other errors in the logs.

Errors via the view should be logged to the log/bookstack/laravel.log within your mounted /config volume path.
Alternatively you could enable the debug view as detailed here: https://www.bookstackapp.com/docs/admin/debugging/#debug-view

The env variables are passed in directly to my docker-compose. The docs mentions putting it in .env - maybe this is why?

Either would work. Docker-compose env options will override any .env file options.
It might be breaking due to special characters being handled via specific means in the compose file, but that's just a guess.

How can I bind my .env file? Not sure what the container path is...

You should already find it at www/.env your mounted /config volume path.

---

If all users are expected to login via Azure, then OIDC/SAML2 auth options will generally provide a much better user experience and easier management, albeit with a potentially more involved setup process.