AADSTS90013: “Invalid input received from the user”

[Jaske19]

Hello.

Users are experiencing intermittent failures when authenticating with Azure AD (OIDC) using the glpi-singlesignon plugin. Microsoft Entra ID returns:

AADSTS90013: Invalid input received from the user.

The same account may succeed after 1–2 retries or when switching browser/device. This occurs across multiple environments.

GLPI version: 10.0.19

Plugin: glpi-singlesignon (version ?)

Question: Has anyone else encountered this issue? Any known causes or workarounds?

Thanks!

[q-lng]

Hello,

This issue is happening because of the GLPI URL you try to access after login, for example this is an URL that causes the issue at login :

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=xxxxx-xxxxx-xxxxx-xxxxx-xxxx&scope=User.Read&state=[redacted]&redirect=/front/savedsearch.php?action=load&id=40&response_type=code&approval_prompt=auto&redirect_uri=https://support.example.com/plugins/singlesignon/front/callback.php/provider/1

The problem here is that PHP parameters on the GLPI URL (/front/savedsearch.php?action=load&id=40) are interpreted by the Microsoft SSO page as user inputs, and are invalid.

Workaround : Remove whatever parameters you have behind the .php on the redirect parameter :
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=xxxxx-xxxxx-xxxxx-xxxxx-xxxx&scope=User.Read&state=[redacted]&redirect=/front/savedsearch.php?action=load&id=40&response_type=code&approval_prompt=auto&redirect_uri=https://support.example.com/plugins/singlesignon/front/callback.php/provider/1
into :
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=xxxxx-xxxxx-xxxxx-xxxxx-xxxx&scope=User.Read&state=[redacted]&redirect=/front/savedsearch.php&response_type=code&approval_prompt=auto&redirect_uri=https://support.example.com/plugins/singlesignon/front/callback.php/provider/1