Integrating BookStack and Azure Active Directory with OpenID Connect

[@TomWhi]

I continue to be blown away by the features and supporting documentation and videos. I was thinking to myself when I saw the OIDC option if it’d work with azure, then I get a recommendation from KZbin that you’d got a video on it. And again not only helped me understand the bookstack side, but more on app registration and what data is passed. Thank you!

[@BookStackApp]

Great to hear all the effort put into those elements is found useful! Thanks for the kind feedback!

[@wiljotiele7565]

Excellent video

[@BookStackApp]

Thanks!

[@wiljotiele7565]

@@BookStackApp It would be nice if these settings would be accessible through the web interface tho. Modifying them inside docker is not so easy

[@BookStackApp]

​@@wiljotiele7565 Depends on what docker image is being used, but usually you can just define these options as env options, or edit the `.env` via volume files. I know the linuxserver image provides the `.env` file in the mounted `/config` volume for easy instant editing.

[@wiljotiele7565]

@@BookStackApp i just figured that out from your docker / bookstack video, brilliant, thanks!

[@DanFoxley]

I'm currently using Azure AD SAML with Bookstack, I'd like to move over to using OIDC with Bookstack. I'm guessing it is either / or? To move over to OIDC, I'll need to update the .env file and turn off SAML and configure / enable OIDC. Does that sound mostly correct?

[@BookStackApp]

Yeah, that's all correct. I can't exactly remember if azure provides different user ID values between SAML and OIDC though (this can also depend on configuration since the properties used for ID in both auth options is configurable). If Azure OIDC provides the same ID values as SAML for your users, it should be pretty smooth. If not, then you may have to update the "External Authentication ID" value for users (can be done in bulk via the database or API, otherwise editable per-user in BookStack).

[@DanFoxley]

@@BookStackApp Thx. On Azure my intent is to just create a new Enterprise Application and build it wil OIDC instead off SAML, I won't try and update or change the existing.

[@LarsSchretlen]

after the config of OpenID Connect i lost the option to login with the default login from the admin account ? how do i make it so that i still able to login with the default admin account. because my SSO user is no admin?

[@BookStackApp]

You can't run email login alongside OIDC, but you can temporary change the auth method back to login via an email-based account. You could then maybe give admin privilieges to a SSO user account to allow future admin without swapping auth method.