SSO ( with EntraID ) works only with firefox

[AABDELHAKIM]

Hello ,
We are running an instance of seq and we updated the underlying windows host and after the upgrade we are unable to login using SSO . it is configured to use Azure Active Directory , we get the error as shown in this pic

We re-did the App registration on Azure and all settings seem to be fine .

and digging in the logs to see what could be the issue i found the below entry

{"@t":"2024-11-07T08:24:47.4708494Z","@sp":"df61f1c2c272483b","@tr":"fe9bae4f4931fcf4ec29d8y8704af4df","@mt":"OpenID Connect authentication failed with {Error} / {ErrorDescription}","@l":"Error","@x":"Microsoft.AspNetCore.Authentication.AuthenticationFailureException: Correlation failed.","Error":"No error provided","ErrorDescription":"No extended description available","RequestId":"40003ade-0001-f400-b63f-84710c7967bb","RequestPath":"/aad"}

what is even more strange is that it works fine with Firefox but fails on Edge and chrome . any help would be appreciated

[nblumhardt]

Hi!

First, if you're not running the latest version of Seq (2024.3) you should update, as changes were made to support Chrome's cookie handling requirements a few versions ago.

Otherwise, this issue is most likely because the address you use to access Seq, the canonical URI configured in Seq, and the app registration's allowed reply URLs don't match exactly in every detail - host, port, path, and scheme.

To check the Seq side you can run:

seq config get -k api.canonicalUri

If this is blank, or not the exact address you see in the browser when using Seq, you can update it with:

seq config set -k api.canonicalUri -v <your uri>
seq service restart

The URI should look something like https://my-seq-server.example.com. For Entra ID to work it must also be an HTTPS URL (and you need to be accessing Seq via HTTPS when you log in).

If this doesn't narrow down the cause, check cookie settings in Chrome to make sure they're not set to something too strict to allow third-party authentication (i.e. third party cookies are required for it).

Let me know if this helps,
Nick

[AABDELHAKIM]

Thanks for answer Nick ,
i am afraid i have updated already to the latest version

and i have enabled 3rd party cookies on chrome

also i have set the canonical URL to the correct value using seq commands but still ending up in the same situation

feel free to ask for logs if needed and will be happy to help

Regards,
Amr

[nblumhardt]

Thanks for the update Amr. I think sending a diagnostic report (from Settings > Diagnostics > Download a full diagnostic report) through to Support (please don't post it here) is our best chance at narrowing it down from here.

Regards,
Nick