Receiving OAuthCallbackError with Microsoft Entra ID Provider

[carlohoanguyen]

Hello!

I've been following the official doc about implementing entra id authentication for my app without any luck. I'm pretty sure that I have correct client id, secret, issuer and redirect uri (in my App Reg). But for some reason I will keep getting OAuthCallbackError: OAuth Provider returned an error: invalid_client.

Has anyone been able to implement Auth.js v5 on Next.js 15 with Entra ID?

[WillemDeGroef]

I'm having the same issue.

MicrosoftEntraID({
			clientId: env.AUTH_MICROSOFT_ENTRA_ID_ID,
			clientSecret: env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
			issuer: "https://login.microsoftonline.com/common/v2.0",
			authorization: {
				params: {
					scope: "openid profile email User.Read",
					prompt: "select_account",
				},
			},
		}),

[carlohoanguyen]

This is my provider config:

providers: [
    MicrosoftEntraID({
      clientId: env.AUTH_MICROSOFT_ENTRA_ID_ID,
      clientSecret: env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
      issuer: `https://login.microsoftonline.com/${env.AUTH_MICROSOFT_ENTRA_ID_TENANT}/v2.0`,
      authorization: {
        params: {
          scope: `openid profile email offline_access`,
        },
      },
    }),
  ],

Have you tried to include your tenant id in as part of the issuer? Still not working for me, but maybe it works for you? 🤞

[WillemDeGroef]

Yes, same error with my tenant id
I'm using version 5.0.0-beta.26

[carlohoanguyen]

I gave up on next-auth v5, and just went for the v4 which worked.

Also I had to use Web and not SPA platform.

[jermwormza]

Same(ish) issue here.... I did also add some debugging and despite adding the ISSUER as per doc when I had The Entra App setup for only my tenant I did see a log that the common interface was used which was denied, not that I wanted to, but I did change the setting to All Tenants, but still no luck.

In my case using Auth.js via sveltekit so:
@auth/sveltekit: version 1.9.2

[jermwormza]

Ok After noticing @carlohoanguyen comment I added the web platform and moved the callback url to that in the Azure App Config and that resolved my issue.

[carlohoanguyen]

Nevermind.

It actually worked for me now using Web platform in v5.

@WillemDeGroef You could try that.