ebs Microsoft Entra ID and Google Workspace Integration Troubleshooting

A standard error page is displayed following:

• A delayed loading of an external provider login page

• ebs: ontrack displays a standard error page without redirecting to an external authentication page

Check for a miss-configured Identity Server URL. Review the ontrack log folder to identify the root cause of the error. The following error suggests a problem navigating to the Microsoft Entra ID authentication page.

Back to top

System error messages include:

• System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '[PII is hidden]'. --->

• System.IO.IOException: IDX20804: Unable to retrieve document from: '[PII is hidden]'. --->

• System.Net.Http.HttpRequestException: Response status code does not indicate success: 404 (Not Found)

Confirm the correct URL has been entered for Microsoft Entra ID by browsing to <Identity Server URL>/.well-known/openid-configuration (for example: https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0/.well-known/openid-configuration).

This will now produce a JSON document rather than a 404 error.

Back to top

Successfully login to Microsoft Entra ID account, but the following error message is displayed:

This is a valid error message and will be displayed if trying to use a valid Microsoft Entra ID account to access a tenant that you are not authorised for (for example: a user from College X trying to access ontrack for College Y).

Back to top

Successfully login to a Google account, but the following error message is displayed:

This is a valid error message and will be displayed if trying to use a valid Google account to access a client that you are not authorised for (for example: a user from College X trying to access ontrack for College Y).

Back to top

Successfully login to an Microsoft Entra ID account, but an error message like the following is displayed:

This message is displayed when an administrator has not granted permission for all users to use this application. Either grant permission in Microsoft Entra ID or log in as an administrator and Accept the consent on behalf of all users.

Back to top

Successfully login to an Microsoft Entra ID account, but an error message like the following is displayed.

Confirm the Redirect URL configured in Azure matches your website URL. Also ensure that the website is being accessed directly using https, as this error might be seen if using http (even if redirected to https).

Back to top

Successfully login to an external account, but ontrack shows a standard error page:

Review the ebs: ontrack log folder to identify the root cause of the error.

Back to top

The signed in user '{EmailHidden}' is not assigned to a role for the application.

This error indicates a valid user has tried to log in to an application for which they do not have a role in Microsoft Entra ID (for example: ontrack Hub has been configured in Microsoft Entra ID to only be accessible by named staff members, and a person not in this group has tried to log in).

Back to top

OpenIdConnectMessage.Error was not null, indicating an error. Error: 'unsupported_response_type'. Error_Description (may be empty): '<id>: response_type 'id_token' is not enabled for the application.

In Azure portal, ensure that ID tokens is selected in the Authentication\Implicit grant section.

Back to top

ebs: ontrack Error: Underlying Rest service exception - Unauthorized(401).

If an error like this is shown, then review the Web Services log folder for further details of the underlying REST error.

Back to top

The claim name identified here is the one configured in the OIDC reference data settings. The error suggests that the ebs configuration is incorrect. Check the “Default OIDC issuer” institution setting exactly matches the record created in OIDC Issuers reference data, and that the claim name property is populated.

Back to top

The claim name identified here is the one configured in the OIDC reference data settings. This error means that the IdToken retrieved from the external authentication provider does not contain a property with this name. Note that Microsoft Entra ID will not send a valid property that is not populated (for example: it either means the token does not contain this property, or the user does not have a value in it).

Back to top

Fail to find any user for the following mapping College Email => <forename>.<surname>@ebsTribalCollege.onmicrosoft.com.

This message will be shown if either a user with the matching element does not exist, or if the system matches more than one user back to the specified criteria. (for example: either there is no learner with this college email or there is more than one user with this email address).

Back to top

You are attempting to log in, but the following error message is displayed:

This error message will be displayed if the DatabaseServername is correct in the customer configuration file.

Back to top

You are attempting to log in, but the following error message is displayed:

This error message will be displayed if the DatabaseName or DatabaseType values are incorrect in the customer configuration file or in the shortcut parameters.

Back to top

You are attempting to log in, but the following error message is displayed:

This error message will be displayed if there are missing or incorrect client ID or ID token scope values in institution settings and/or reference data.

Back to top

You are attempting to log in, but the following error message is displayed:

This error message will be displayed if the user does not have the ebs Central User role.

Back to top

You are attempting to log in, but the following error message is displayed:

This error message will be displayed if the OIDC value is incorrect in the customer configuration file.

Back to top

You are attempting to log in, but the following error message is displayed:

This error message will be displayed if the user account is incorrect, not found or if multiple user accounts exist, or if the OIDC Issuer is incorrect in reference data.

Back to top

You are attempting to log in, but the following error message is displayed:

This error message will be displayed if the ebsAuthPwd value is incorrect in the customer configuration file.

Back to top