Groups info issue with OAuth using Microsoft AD

Affected versions: 2.14.2 and previous

Fixed in: 2.15.0 and above

Issue Description

If you have configured OAuth using Microsoft AD in Portainer and trying to use Automatic Team membership you may run into an issue where group membership information is not returned correctly and users are not populated into the correct teams in Portainer.

Fix

Update Portainer to 2.15.0 or above.

Workaround

In OAuth Config, use the following URL for Resource URL (replace the existing graph.windows.net URL)

https://login.microsoftonline.com/<tenant ID>/openid/userinfo

User Identifier: unique_name Scopes: openid profile

You will also need to have following permissions on your App Registration in Azure: