Solved SSO Webclient User Login not working

[fabs]

Hello all,

We have the problem that the SSO does not work for a normal user. But the user is added under User Sign In and its synced with Office365 "Administrator permission required"



But the Administrator Sign in via SSO works.


Do you have any idea?
fabs

 

[ChrisC_3CX]

Just to first get a bit more information on this:

• What exact version of 3CX are you running? Check under "Dashboard >> Information >> License/Version"
• What are you using SSO for? Administrator access to the Management Console or Extension access to the Management Console and Webclient?
• What happens exactly when you try to login using SSO and this user? Do you get an error, what do you see?
• Is this user's extension also synced with 365?

 

[fabs]

Just to first get a bit more information on this:

• What exact version of 3CX are you running? Check under "Dashboard >> Information >> License/Version"
• What are you using SSO for? Administrator access to the Management Console or Extension access to the Management Console and Webclient?
• What happens exactly when you try to login using SSO and this user? Do you get an error, what do you see?
• Is this user's extension also synced with 365?

Hello ChrisC_3CX,

sorry here the information:
18.0 (Build 307)
We use SSO for Administrator Login and Webclient.

When i try to login with the user to the webclient i got the message that Administrator permission required as you can see first picture. (sorry its german language)
The user's extension is synced with 365 and added under User Sign In

Regards
fabs

 

[ChrisC_3CX]

Could you check the following:

1. Access the 365 Administrator Panel and go to Azure Active Directory
2. Navigate to App Registrations.
3. Search the App registration for this PBX and edit it.
4. Go to "Authentication" and make sure that "Access Tokens" is NOT enabled and that "ID Tokens" IS enabled.

5. Then go to "API Permissions" and make sure that you have the following permission in the list and that "Admin Consent Required" is off:

Could you also provide a screenshot of this section?

 

[fabs]

Could you check the following:

1. Access the 365 Administrator Panel and go to Azure Active Directory
2. Navigate to App Registrations.
3. Search the App registration for this PBX and edit it.
4. Go to "Authentication" and make sure that "Access Tokens" is NOT enabled and that "ID Tokens" IS enabled.
View attachment 26635
5. Then go to "API Permissions" and make sure that you have the following permission in the list and that "Admin Consent Required" is off:
View attachment 26636
Could you also provide a screenshot of this section?

Hello Chris,

i see that the permission User.Read was not set, but for some reason i cannot find it?


Regards
fabs

 

[ChrisC_3CX]

That's probably it then, you would have to go to "Delegated permissions" and then "User".

 

[fabs]

Hello Chris,

i see that the permission User.Read was not set, but for some reason i cannot find it?
View attachment 26637

Regards
fabs

Hello,

for some reason i had deleted user.read,
was able to add it again


Regards
fabs

 

[fabs]

Hello,

for some reason i had deleted user.read,
was able to add it again
View attachment 26639

Regards
fabs

Hello Chis,

but its still not working. Maybe it takes some minutes/hour to sync?

Regards
fabs

 

[ChrisC_3CX]

Seems you're still missing some permissions. Here's what you should have, make sure you add them all:

 

[fabs]

Seems you're still missing some permissions. Here's what you should have, make sure you add them all:
View attachment 26640

Hello Chris,

I cannot set the granted status for the app. Do you know how can i do this?

 

[fabs]

Hello Chris,

I cannot set the granted status for the app. Do you know how can i do this?
View attachment 26642

Hello Chris,

i had to click "Grant Admin consent for..."
Its working now, you can set the status to "solved"
Thanks

Regards
fabs

 

[ChrisC_3CX]

Glad to hear you found it!

I'll be marking this as solved since everything now seems to be in order but note that you're actually missing one more permissions so please make sure you've added it and that you've also granted 3CX access:

 

[fabs]

Glad to hear you found it!

I'll be marking this as solved since everything now seems to be in order but note that you're actually missing one more permissions so please make sure you've added it and that you've also granted 3CX access:

View attachment 26644

Hi Chris,

yes i've added these too. Thanks

Regards
fabs

 

[ChrisC_3CX]

You're very welcome!

Feel free to start a new thread should you need anything else!