Entra ID SSO Setup

• YEKE side. The Enterprise license's sso item must be enabled. YEKE_PUBLIC_URL must be set — the redirect URI is derived from it.
• Entra roles. At least Application Developer to register the app. Groups Administrator or User Administrator to create the group. Cloud Application Administrator as well, if you will require assignment.

1. Go to entra.microsoft.com. If you have more than one tenant, switch with the Settings icon in the top menu.
2. Entra ID → App registrations → New registration.
3. Enter a Name, and for Supported account types choose Single tenant only.
4. For Redirect URI, pick Web from the platform selector and enter https://<yeke-address>/api/auth/oidc/callback. <yeke-address> is the core's YEKE_PUBLIC_URL value; if you open YEKE at a different address in the browser, YEKE_PUBLIC_URL is the one that counts.
5. Click Register. On the Overview page that opens, note down the Application (client) ID and Directory (tenant) ID.

1. In the application, go to Certificates & secrets → Client secrets → New client secret.
2. Enter a description, set Expires to at most 24 months, click Add.
3. Copy the Value column from the row that appears — it is never shown again once you leave the page.

When the secret expires, sign-in stops with the same error (AADSTS7000222 on Entra's side); local accounts are unaffected. Put the expiry date on a calendar — renewal steps are at the end of this page.

1. Entra ID → Groups → All groups → New group.
2. For Group type choose Security, and give it a Group name such as YEKE Admins.
3. For Membership type choose Assigned, add people with Members, then click Create.
4. Note the group's Object ID on its Overview page.

The same rule applies to the Kubernetes group mapping — that also takes a Security group's Object ID.

1. In the application, go to Token configuration → Add groups claim.
2. Check Security groups.
3. Under Customize token properties by type, select Group ID for ID.
4. Emit groups as role claims should not be checked; save.

Check

Open the application's Manifest page and look for these two values.

"groupMembershipClaims": "SecurityGroup"

"optionalClaims": {
  "idToken": [
    { "name": "groups", "source": null, "essential": false, "additionalProperties": [] }
  ]
}

additionalProperties has to stay empty. If emit_as_roles is present, groups go into the roles claim instead and YEKE never sees them; if sam_account_name or cloud_displayname is present, a name arrives instead of the GUID and the Object ID stops matching.

Groups assigned to the application is only needed for a user in more than 200 groups (requires Entra ID P1/P2, and does not flatten nested groups) — most setups can skip it.

1. Open the application from Entra ID → Enterprise apps → All applications.
2. Under Properties, set Assignment required? to Yes, and save.
3. Under Users and groups → Add user/group, pick people and click Assign.
4. When assignment is required, the permissions also need admin approval: in the app registration, API permissions → Grant admin consent.

Assigning a group requires Entra ID P1/P2; on the free tier you assign people one at a time. An unassigned person stops on Microsoft's sign-in page with AADSTS50105.

Click Add a provider, run Test discovery on the card, and once it succeeds click Enable.

With an admin group set, the role is derived from the group on every sign-in; it cannot be changed from the Users screen. To make someone admin or remove admin, add them to or remove them from the group in Entra.

Kubernetes groups (optional)

On the cluster's identity screen, in the Directory group mapping section, put the group's Object ID on the left and the group's name in Readable name (optional); details on the Permissions and RBAC page. Security groups are used there too.

1. Sign out, then click the SSO button on the sign-in screen (e.g. Sign in with Microsoft).
2. Go through Microsoft's own sign-in.
3. Back in YEKE, check that your account's Role column reads admin on the Menu → Administration → Users screen.

The role is only computed at sign-in — after adding someone to the group, they need to sign out and back in. Keep the local admin account around; it is the emergency access path.

You'll find Entra's own error code in the core's log:

docker compose logs core 2>&1 | grep "rejected the client authentication"

1. In Entra, create a new secret under Certificates & secrets → Client secrets → New client secret and copy the Value.
2. In YEKE, open the provider card's Edit → New client secret (optional) field, paste it, and click Save changes.
3. Sign in once via SSO to confirm the new secret works.
4. Delete the old secret in Entra.