CS

Configuring user login via MS Entra

Home / Documentation / Administrator guide /

Configuring user login via MS Entra

CS

1. General information

NET Genium supports user login using accounts managed in Microsoft Entra ID (formerly Azure Active Directory). To use this functionality, manual configuration in the Microsoft Entra ID environment is required. The configuration consists of two parts that build on each other — authorization requires authentication, but not the other way round:

  • Authentication (chapters 2 and 3) verifies who the user is and signs them in to NET Genium. On its own it neither creates nor changes any accounts: the user must already exist in NET Genium and their rights are set manually.
  • Authorization (chapter 4) additionally takes the user's roles over from MS Entra on every login and uses them to set the user's rights group and user groups in NET Genium. Optionally it can also create the user on first login according to their role (chapter 4.5), so that accounts do not have to be created manually by an administrator and come into existence according to the roles assigned in MS Entra.

2. Microsoft Entra ID configuration

  • Application registration “NET Genium” at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredApps
    • portal.azure.com / App registrations
    • NET Genium as the application name
    • Supported account types: Accounts in this organizational directory only (single tenant)
    • Finding Application (client) ID which is automatically created when the application is registered
      • Application (client) ID
    • Setting NET Genium URL to “https://{netgenium_url}/LoginByMicrosoft.aspx”
      • portal.azure.com / App registrations / NET Genium / Authentication / Redirect URIs
      • If NET Genium runs on a non-standard port, the address is entered including the port number (for example “https://{netgenium_url}:8443/LoginByMicrosoft.aspx”) – NET Genium sends it to Microsoft with the port on which the browser opened it
    • Implicit grant (access tokens or ID tokens) does not need to be enabled – NET Genium uses the authorization code flow and retrieves the token on the server
    • Creating a client secret
      • portal.azure.com / App registrations / NET Genium / Certificates & secrets / New client secret
    • Setting API permissions for Microsoft Graph
      • portal.azure.com / App registrations / NET Genium / API permissions / Add a permission / Microsoft Graph
      • API name “Microsoft Graph – User.Read”, type “Delegated”
      • This permission is sufficient for signing users in; taking roles over from MS Entra is described in chapter 4

Obrázek.png

3. NET Genium configuration

  • Create a configuration file “NETGenium\Config\MicrosoftOAuth.json”
    • Set the contents of the file to: “{"web":{"client_id":"Application (client) ID","auth_uri":"https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize","token_uri":"https://login.microsoftonline.com/organizations/oauth2/v2.0/token","client_secret":"client secret code","tenant_id":"directory (tenant) ID"}}”
    • The key “tenant_id” holds the directory (tenant) ID in the form of a GUID – NET Genium then accepts only sign-ins of users of that tenant and replaces “organizations” or “common” with this ID in the “auth_uri” and “token_uri” addresses. Users of other organizations who are invited to the tenant as guests can therefore sign in as well. A value that is not a GUID switches the tenant check off and leaves the addresses unchanged. Users are matched by e-mail, so the key is essential for an application registered for multiple tenants. It is essential also for an application registered for its own organizational directory only (single tenant, chapter 2) – for such an application registered after 15 October 2018, Microsoft rejects a sign-in through addresses with “organizations” or “common” with the error “AADSTS50194”.
    • Optionally, the key “discovery_uri” with the address of the “openid-configuration” document, from which NET Genium obtains the keys for verifying the token signature, can be added to the “web” object, for example “https://login.microsoftonline.com/directory ID/v2.0/.well-known/openid-configuration”. Without this key, NET Genium derives the address from “auth_uri” if it has the form “https://login.microsoftonline.com/tenant/oauth2/v2.0/authorize” as shown above – with any tenant designation, for example “organizations”, “common” or the directory ID, including the ID filled in from the “tenant_id” key; “organizations” is replaced with “common” in the derived address. With any other address in “auth_uri”, the “discovery_uri” key is mandatory, otherwise the sign-in is refused.
    • The e-mail is taken from the “email” or “mail” item of the token received from Microsoft and is looked up in the “email” column of the “susers” table. Exactly one user must have it – if no user is found, or if more users are found, the sign-in is refused with the message “The account ... could not be matched to a single NET Genium user. Contact your system administrator.” The e-mail is compared by the database according to the collation of the column, so on a Firebird database with the default collation, which is case sensitive, the e-mail in the “Email” field has to match the e-mail from the token including letter case.
  • Create an empty file “NETGenium\Config\LoginByMicrosoft.txt”
    • Its existence enables the Microsoft sign-in option on the login page – the “Auto-login with Microsoft account” checkbox; without it the checkbox is not offered even when the “MicrosoftOAuth.json” configuration file is filled in
    • Checking the box makes the browser remember the choice and signs the user in through Microsoft; the next time the portal is opened in the same browser, the user is signed in automatically. If the user checks the box after logging out, after an unsuccessful sign-in through Microsoft or in the window opened by the address with the “go=sal” parameter, NET Genium asks “Do you want to log on with the same Microsoft account, or choose a different account?” and offers the options “Same account” and “Different account”. Unchecking the box turns the automatic login off.
    • Without the file, the Microsoft sign-in is neither offered on the login page nor used for automatic login, and the ERP library does not perform the authorization by roles (chapter 4) – NET Genium calls the external function “NETGenium.OnBeforeLogin” even without the file, so it does call a custom implementation of the authorization (chapter 4.6); the Microsoft sign-in itself on the “LoginByMicrosoft.aspx” page still works whenever the “MicrosoftOAuth.json” file is filled in. The Microsoft sign-in is switched off completely only by deleting or emptying the “MicrosoftOAuth.json” file.
    • The contents of the file may carry optional authorization parameters, see chapter 4.5

4. Authorization — taking roles over from MS Entra

Evaluating the roles is not part of NET Genium. When a user signs in via Microsoft, NET Genium calls the external function “NETGenium.OnBeforeLogin” and leaves the work with the roles to it:

  • NET Genium instances based on the ERP product have a ready-made implementation available in the “ERP.dll” library — it is enough to plug it into the “ngef” project (chapter 4.4) and to set up the rights groups (chapter 4.3).
  • All other NET Genium instances implement the authorization themselves. Key passages from the source code of the ERP library that can be used as a starting point are in chapter 4.6.

For the authorization to run at all, all of the following prerequisites must be met at the same time:

  • The external function “NETGenium.OnBeforeLogin” is registered in the “ngef.cs” file of the “ngef” project (chapter 4.4)
  • On NET Genium instances based on the ERP product, the “ERP.dll” library is placed in the “NETGenium\bin” directory next to the “ngef.dll” library
  • On NET Genium instances based on the ERP product, the configuration file “NETGenium\Config\LoginByMicrosoft.txt” has been created (chapter 3)
  • The “Rights group” edit form has a control named “ng_memberof” and the “User” edit form has a control named “ng_originalnirole” (chapter 4.3)
  • At least one rights group has the “Member of” field filled in (chapter 4.3)
  • The user exists in NET Genium, or automatic user creation is enabled (chapter 4.5)

The only way to notice that the first prerequisite is not met is that nothing changes for the user after login. NET Genium calls the external function on every login but does not evaluate its return value — a missing registration therefore ends neither with an error nor with an entry in the log.

4.1. How the authorization works

After the user has been successfully verified by Microsoft and before the actual login to NET Genium, NET Genium calls the external function “NETGenium.OnBeforeLogin” and passes it the user's e-mail received in the token. The implementation in the ERP library:

  • Loads the rights groups that have the Member of field filled in (the “ng_memberof” column of the “srightsgroups” table). If no rights group has it filled in, the user's rights do not change and stay set manually in NET Genium. The roles are nevertheless read from the token, so if there is no role in the token, the call to the Microsoft Graph service described below is made as well and any error of it is written to the log (chapter 4.8).
  • Takes the user's roles from the token received from Microsoft — the “roles” (app roles) and “GroupsName” items.
  • Only if there is no role in the token, it asks the Microsoft Graph service for the user's groups at “https://graph.microsoft.com/v1.0/me/transitiveMemberOf” and uses the display names of the returned groups.
  • Compares each role found against the “Member of” field of every rights group for an exact match of the whole string, including letter case.
  • Looks the user up by e-mail in the “email” column of the “susers” table. A user who does not exist in NET Genium is created only if automatic user creation is enabled (chapter 4.5); otherwise it does not create the user and NET Genium refuses the login, because the e-mail cannot be matched to any user (chapter 4.8).
  • For the user found it sets:
    • The rights group — but only if exactly one rights group matches the roles. If none matches, or if two or more match, the rights group is cleared.
    • The user groups — they are overwritten with the user groups of all matching rights groups.
    • The original role (the “ng_originalnirole” column of the “susers” table) — the list of roles received from MS Entra, separated by commas.

The new setting always takes effect on the user's next login — a role change in MS Entra is not reflected in a session that is already running.

Warning: when the user groups are overwritten, the user's favourite items and portlet layout on the main page are deleted as well. Later in the very same login, NET Genium then copies the default settings from the Administrator account (the user with ID 1) to a user who has no favourite items and no portlets — so the main page does not stay empty, but the user loses their own customization. If no role is found for the user, they additionally lose all their user groups and their rights group. Try the authorization on a test account first.

4.2. App roles in MS Entra

The recommended way is to use the app roles of the registered NET Genium application. The role is then passed directly in the token and NET Genium does not communicate with the Microsoft Graph service at all — no permission beyond “Microsoft Graph – User.Read” from chapter 2 is therefore needed.

  • Creating an app role
    • portal.azure.com / App registrations / NET Genium / App roles / Create app role
    • The Value of the role is the text that appears in the token and that is compared against the “Member of” field of a rights group in NET Genium — not the display name of the role
    • Set Allowed member types to “Users/Groups”
  • Assigning users or groups to the role
    • portal.azure.com / Enterprise applications / NET Genium / Users and groups

An alternative we do not recommend — reading the groups from the Microsoft Graph service. It is used automatically when there is no role in the token, and it requires:

  • the delegated permission “GroupMember.Read.All” (or “Directory.Read.All”) with administrator consent
    • portal.azure.com / App registrations / NET Genium / API permissions
  • extending the scope in the “MicrosoftOAuth.json” configuration file — a “scope” item is added to the “web” object, for example “"scope":"openid email profile GroupMember.Read.All"”; if the item is not present, NET Genium uses the scope “openid email profile”

The drawback of this variant is that all groups the user is a member of are compared, including indirect membership — typically dozens of groups that have nothing to do with the application. App roles, on the other hand, are created for this application only.

4.3. Rights groups in NET Genium

  • Add a text control with the identifier “ng_memberof” to the “Rights group” edit form (for example with the name “Member of”)
  • Add a text control with the identifier “ng_originalnirole” to the “User” edit form (for example with the name “Original role”) — the roles received from MS Entra are written into it
  • For every rights group that is to correspond to a role from MS Entra, fill the value of the app role into the “Member of” field; with the Microsoft Graph variant, the display name of the group
  • Assign user groups to the rights groups — these are exactly the groups that are set for the user on login

Both controls must exist, otherwise the authorization ends with an error. The value in the “Member of” field must match exactly, including letter case and spaces (for a Windows login with an LDAP server, see chapter 4.6), and the field must be long enough to hold the whole value of the role.

4.4. The NETGenium.OnBeforeLogin external function

NET Genium instances based on the ERP product have a ready-made implementation in the “ERP.dll” library and plug it in as follows:

  • Add a reference to the “ERP.dll” library to the “ngef” project
  • Register the call in the “ngef.cs” file:
case "NETGenium.OnBeforeLogin": ERP.Login.OnBeforeLogin(args, conn); return "";
  • Upload both the compiled “ngef.dll” library and the “ERP.dll” library to the “NETGenium\bin” directory — uploading a new library restarts the web application automatically

Without this registration the authorization does not run. The login behaves as in chapters 2 and 3 and the user's rights do not change.

4.5. Automatic user creation

By default a user who does not exist in NET Genium is not created — their login is refused and the account has to be created by an administrator.

Creation is enabled by a parameter in the “NETGenium\Config\LoginByMicrosoft.txt” configuration file. The following is written on a line of its own:

CreateUsers

The file may contain more parameters, always one per line; letter case does not matter and empty lines are ignored.

When the parameter is enabled, the user is created on first login, and only if at least one rights group corresponds to one of their roles. Without this condition an account in NET Genium would be granted to anyone able to sign in to the MS Entra tenant, even if nobody assigned them any role there.

The new user gets the following filled in:

  • Full name, first name and surname — by splitting the “name” item from the token; if the name does not consist of two words, the whole of it is stored in the surname field
  • Login name — derived from the surname and the first letter of the first name, without spaces and diacritics; if the token does not contain the “name” item, the e-mail is used instead. If it collides with an existing user, a sequence number is appended
  • E-mail — the e-mail received from MS Entra
  • Language — the language of the session in which the user signed in, that is the language of the login page
  • Rights group, user groups and original role — according to the roles from MS Entra, the same way as for an existing user

The e-mail is deliberately not truncated. If the “Email” field in NET Genium is shorter than the e-mail received from MS Entra, the creation ends with an error written into the log (chapter 4.8) — a truncated e-mail would not find the user on their next login and the account would be created again on every login.

4.6. Custom implementation of authorization

NET Genium instances that are not based on the ERP product do not have the “ERP.dll” library available and implement the authorization themselves — as their own external function registered under the “NETGenium.OnBeforeLogin” key in the way described in chapter 4.4. The following passages from the source code of the ERP library serve as a starting point; they assume the “NETGenium”, “System.Collections.Generic”, “System.Data” and “System.Security.Claims” namespaces.

The entry point — loading the rights groups, evaluating the roles from the token and writing the result to the user:

public static void OnBeforeLogin(string[] args, DbConnection conn)
{
    string loginby = args[0], s;
    if (loginby.Length == 0 || conn.HttpContext.Session["microsoft_access_token"] == null)
    {
        return;
    }

    DataTable srightsgroups = Data.Get("SELECT id, ng_memberof FROM srightsgroups WHERE NOT ng_memberof = ''", conn);
    if (srightsgroups.Rows.Count == 0)
    {
        return; // No rights group is mapped to a role - the authorization stays with NET Genium
    }

    List<int> rightsgroups = new List<int>(), usergroups = new List<int>();
    List<string> roles = new List<string>();
    int rightsgroup = 0;

    if (conn.HttpContext.Session[s = "microsoft_claims"] != null)
        foreach (Claim claim in (Claim[])conn.HttpContext.Session[s])
            if (claim.Type == "GroupsName" || claim.Type == "roles")
            {
                MatchGroups(s = claim.Value, rightsgroups, usergroups, srightsgroups, conn);
                roles.Add(s);
            }

    if (rightsgroups.Count == 1)
    {
        rightsgroup = rightsgroups[0];
    }

    DbRow user = new DbRow("SELECT id, rightsgroup, ng_originalnirole FROM susers WHERE email = " + conn.Format(loginby), conn);
    if (user.Read())
        using (DbCommand cmd = new DbCommand(conn))
        {
            UpdateUser(user, usergroups, rightsgroup, string.Join(", ", roles.ToArray()), cmd, conn);
        }
}

Comparing a role against the rights groups and looking up their user groups:

private static void MatchGroups(string memberOf, List<int> rightsgroups, List<int> usergroups, DataTable srightsgroups, DbConnection conn)
{
    int n;

    foreach (DataRow row in srightsgroups.Rows)
        if (row["ng_memberof"].ToString() == memberOf)
        {
            if (!rightsgroups.Contains(n = (int)row["id"]))
            {
                rightsgroups.Add(n);
            }

            foreach (int usergroup in Data.GroupsInRightsGroup(n, conn))
                if (!usergroups.Contains(usergroup))
                {
                    usergroups.Add(usergroup);
                }
        }
}

Writing the rights group and the user groups to the user. Along with the user groups, the ERP library also deletes the favourite items and the portlet layout of that user:

private static void UpdateUser(DbRow user, List<int> usergroups, int rightsgroup, string memberOf, DbCommand cmd, DbConnection conn)
{
    int userid = (int)user["id"];

    if (Parser.ToInt32(user["rightsgroup"]) != rightsgroup || user["ng_originalnirole"].ToString() != memberOf)
    {
        DataSaverSynchro ds = new DataSaverSynchro("susers", userid, conn);
        ds.Add("rightsgroup", rightsgroup);
        ds.Add("ng_originalnirole", memberOf);
        ds.Save(cmd);
    }

    List<int> sorted = new List<int>(usergroups);
    sorted.Sort();

    if (memberOf == "" || Sql.Ids("SELECT groupid FROM susers_rights WHERE userid = " + userid + " ORDER BY groupid", conn) != Sql.Ids(sorted.ToArray()))
    {
        foreach (string table in new string[] { "sfavorites", "sportlets", "susers_rights" })
        {
            cmd.CommandText = "DELETE FROM " + table + " WHERE userid = " + userid;
            cmd.ExecuteNonQuery();
        }

        foreach (int usergroup in usergroups)
        {
            DataSaver ds = new DataSaver("susers_rights", 0, cmd);
            ds.Add("userid", userid);
            ds.Add("groupid", usergroup);
            ds.Execute();
        }
    }
}

Beyond these passages, the ERP library also handles reading the groups from the Microsoft Graph service (chapter 4.2), automatic user creation (chapter 4.5), login through Active Directory and writing to the log (chapter 4.8). On a Windows login in an instance with the LDAP server filled in the ERP settings, the ERP library creates every user whose Windows account it does not find in NET Genium and does find in Active Directory, regardless of the “CreateUsers” parameter and of whether any rights group corresponds to their groups in Active Directory. At a Windows login, the “Member of” field of a rights group is compared as a part of the value of the user's “memberOf” attribute in Active Directory, including letter case.

4.7. Testing the authorization

  1. Assign exactly one app role to a test user in MS Entra.
  2. In NET Genium, verify that a user with the same e-mail exists and that some rights group has the value of that role in its “Member of” field.
  3. Sign in as the test user through Microsoft.
  4. Open the user's record in NET Genium (Settings / Users) and check that: #* the “Rights group” field corresponds to the role from MS Entra #* the “Original role” field contains the value of the role received from MS Entra #* the user groups correspond to the user groups of that rights group
  5. Change the user's role in MS Entra, sign in again and verify that the setting in NET Genium has changed.

If the “Original role” field stays empty after the login, no role was found — proceed according to chapter 4.8.

The result can also be checked without logging to disk: NET Genium writes a successful sign-in into the “Logs\Auth-year-month.log” log file as the line “... was successfully logged on to ... using auto-login by Microsoft” and, if the user's “Original role” field is filled in, appends its content in parentheses.

4.8. Debugging the authorization

  • Enable logging “To disk” or “To database and disk”
  • Test the login process
  • Analyze the content of the log file “NETGenium\Logs\Anonymous\{yyyy-MM-dd}\loginbymicrosoft.log” — both the login and the evaluation of the roles write into the same file

What to look for in the log file:

  • The list of token items in the form “name: value”. Each app role is written as a separate line “roles: value of the role”. If the “roles” lines are missing, the role was not passed in the token at all — check in MS Entra that the role is assigned to the user (Enterprise applications / NET Genium / Users and groups).
  • The line “OnBeforeLogin: no role found, claim types in session” — it is written whenever no role was found, and it lists which item types the token actually contained. The value “none” means that no items arrived from the login at all.
  • Lines with the address “https://graph.microsoft.com/v1.0/me/transitiveMemberOf” and with the response of that service — they appear only with the variant without app roles. If the call fails, only the line with the address remains in the log file and the line with the response is missing – typically because of a missing permission or administrator consent. The cause is then given by the error “OnBeforeLogin(e-mail)” in the daily log file (see the next point), whose text contains “Uploader.UploadJSon(...)” and possibly the response of the service after the word “ERROR”.
  • Errors of the function itself are written in the form “OnBeforeLogin(e-mail)” into the daily log file “NETGenium\Logs\{yyyy-MM-dd}.log” at the “Error” level.

The most frequent situations:

Symptom Cause
The role is in the log but the user has no rights group The “Member of” field does not match the value of the role exactly — a typo, different letter case, an extra space, the display name of the role instead of its value, or a “Member of” field that is too short
The user has user groups but an empty rights group Two or more rights groups correspond to the user's roles; assign the user a single role
The role is in the log but nothing changed for the user The external function “NETGenium.OnBeforeLogin” is not registered in the project (chapter 4.4)
The Microsoft sign-in page displays the error “AADSTS50194” The application is registered in MS Entra for its own organizational directory only (single tenant) and the “tenant_id” key is missing in the “MicrosoftOAuth.json” file (chapter 3)
The sign-in ends with the message “Login failed!” and the “Auth” log contains “invalid id_token: tid ... != tenant_id ...” The user signed in with an account of a tenant other than the one filled in “tenant_id”. A user of another organization has to be invited to the tenant as a guest, and “auth_uri” and “token_uri” have to keep “organizations”, “common” or the tenant ID so that the token is issued by the tenant from “tenant_id”
The sign-in ends with the message “Login failed!” and the “Auth” log contains “invalid id_token: email = null” The token received from Microsoft contains neither the “email” nor the “mail” item – the account has no e-mail address filled in in MS Entra, or the “scope” item in the “MicrosoftOAuth.json” file does not contain “email”. The sign-in name of the account is not used for matching a NET Genium user
The sign-in ends with the message “The account ... could not be matched to a single NET Genium user.” No user in NET Genium has the e-mail received in the token in the “Email” field, or more users have this e-mail; the e-mail must be unique in the table of users and on a Firebird database with the default collation it has to match including letter case. If more users have the e-mail and some rights group has the “Member of” field filled in, the ERP library updates one of them according to the roles from the token before NET Genium rejects the login
The sign-in ends with the message “Login failed!” and the “Auth” log contains “because the nonce cookie was not found” The sign-in was completed in a browser other than the one in which it started, the browser does not store cookies, or more than 10 minutes have passed since the sign-in started; the sign-in has to be started again in the same browser
The sign-in ends with the message “Login failed!” and the “Auth” log contains “invalid id_token: nonce != originalnonce” Another sign-in was started in the same browser in the meantime (another tab, a repeated click on the Microsoft sign-in), which invalidated the sign-in in progress; the sign-in has to be started again and completed without a concurrent sign-in in another tab
The sign-in ends with an error message and the “Auth” log contains no record of the attempt The error occurred when obtaining the token from Microsoft, when verifying the token in NET Genium or in the “NETGenium.OnBeforeLogin” external function – proceed according to chapter 5.2
The user was not created even though the CreateUsers parameter is enabled No rights group corresponds to any of their roles, or the “Email” field is shorter than the e-mail from MS Entra — in that case the daily log contains the error “OnBeforeLogin(e-mail)”
The user lost all their user groups No role was found — proceed according to the previous points of this chapter
The daily log file contains the error “OnBeforeLogin(e-mail)” and the user lost their favourite items, portlet layout or user groups The evaluation of the roles ended with an error only after the user had been found. The ERP library then clears the user's “Original role” field, deletes the favourite items, the portlet layout and the user groups, and assigns again only the user groups and the rights group according to the roles evaluated up to the moment of the error
Nothing changes for the user and no rights group has the “Member of” field filled in The authorization is deliberately switched off and the rights stay set manually in NET Genium

5. Debugging errors or in case of broken login

5.1. General

  • Enable logging “To disk” or “To database and disk”
  • Test the login process
  • Analyze the content of the log file “NETGenium\Logs\Anonymous\{yyyy-MM-dd}\loginbymicrosoft.log”
  • Proceed according to the type of error described in the “loginbymicrosoft.log” file
    • Change the contents of the configuration file “MicrosoftOAuth.json”
    • Change settings in Azure (typically client_secret expiration)
  • After an unsuccessful sign-in through Microsoft, the next opening of the portal in the same browser session displays the login window instead of redirecting to Microsoft again; this does not apply when NET Genium requires cookies through the “DenyCookieless.txt” file. The sign-in through Microsoft is attempted again as soon as the user ticks the automatic sign-in with the Microsoft account in the login window again. The login window can also be opened without the automatic login by the address of the portal with the “go=sal” parameter, for example “https://{netgenium_url}/default.aspx?go=sal”.

5.2. Response status code does not indicate success: 401 (Unauthorized)

  • Search for the login attempt in the “Logs\Auth-year-month.log” log file by user account and the date and time of the login.
  • If there is no login attempt record in the “Auth-year-month.log” file, the login has not been completed in NET Genium. The cause is then in one of these places:
    • An error returned by Microsoft during the sign-in or when obtaining the token (typically an expired client_secret) – NET Genium displays its text on the sign-in page; with logging to disk enabled, it also writes an error in obtaining the token into the “loginbymicrosoft.log” file.
    • An error in verifying the token in NET Genium (a wrong or unavailable “openid-configuration” document, keys or token signature) or an error of the “NETGenium.OnBeforeLogin” external function – NET Genium displays its text on the sign-in page and writes it into the “Logs\Errors.log” log file as the line “Login.ByJwt (IP = ...) ERROR ...”.
    • If the error is in neither of these places, the user authentication on Microsoft’s web services was not successful. In this case, the issue must be resolved with the company responsible for configuring Microsoft Entra ID, which should go through the login process step by step with the user.
  • If there is a login attempt record in the “Auth-year-month.log” file, proceed according to the error message in the log.

5.3. Sorry, but we're having trouble with signing you in

  • Verify that all redirect endpoint variants (with www and without www) are specified in the MS Entra configuration.
  • Check the exact match of URL addresses, including case.
  • If no login attempt record is found in the “Auth-year-month.log” file, the user authentication on Microsoft’s web services was not successful. In this case, the issue must be resolved with the company responsible for configuring Microsoft Entra ID, which should go through the login process step by step with the user.