Auth.pritunl.com/callback/azure 500 error

lmvdz · April 1, 2025, 9:30pm

Hi we’re getting an error today with the auth.pritunl.com/callback/azure endpoint when SOME of our users login via SSO.

We’ve rotated the Azure Secret just in case and still getting this error.

This is the error from the server:

[2025-04-01 21:21:06,409][ERROR] Azure auth check request error
user_id = “60abe6c131a3d007176ece1c”
user_name = “user@domain.com”
status_code = 500
content = “b’'”

lmvdz · April 1, 2025, 9:55pm

Also what was the design decision to use auth.pritunl.com as the redirect URI instead of our own hosted pritunl server address?

lmvdz · April 1, 2025, 10:23pm

github.com/pritunl/pritunl

pritunl/user/user.py

665c951e5


      
                  logger.exception('Google auth check error', 'user',
                      user_id=self.id,
                      user_name=self.name,
                  )
              return False
          elif AZURE_SSO in modes:
              if settings.user.skip_remote_sso_check:
                  return True
          
              try:
                  resp = requests.get(auth_server +
                      ('/update/azure?user=%s&license=%s&' +
                      'directory_id=%s&app_id=%s&app_secret=%s') % (
                          urllib.parse.quote(self.name),
                          settings.app.license,
                          urllib.parse.quote(settings.app.sso_azure_directory_id),
                          urllib.parse.quote(settings.app.sso_azure_app_id),
                          urllib.parse.quote(settings.app.sso_azure_app_secret),
                  ))
          
                  if resp.status_code != 200:

I’ve found the place where the error is being emitted, tried calling the url in Postman and was getting a 500 error for the problematic user, and 200 for a user who is able to login.

zach · April 1, 2025, 11:13pm

If the user hasn’t logged into the web console in a long time and single sign-on connection authentication is not used the OAuth token may have expired. They will need to login from the web console to perform a full OAuth authorization.

The authentication servers make the configuration simpler and avoid problems that can occur with multiple hosts that don’t have a load balancer for the web console. It also protects the paid features. If you are worried about third parties handling authentication, device authentication can be used to verify the user’s physical device using the TPM or Secure Enclave without any third party single sign-on. The high security environment documentation has information on all the additional security options.

lmvdz · April 2, 2025, 1:37am

Hi, even when these effected users go through the web console performing a full OAuth authorization, by clicking the SSO Sign in Via Azure button, they are able to login to Azure but get a similar 500 error at the callback step

fregatte · April 2, 2025, 8:25am

Hi, we have the same issue from yesterday. Some users cannot use Pritunl VPN with an AUTH_FAILED error. The logs show “Azure auth check request error” for the problem users. The Azure secret for Pritunl has been checked and is not expired.
In case these users try to log in to the pritunl web-console, they receive 500 with the error “auth.pritunl.com can’t currently handle this request”.
Are there any suggestions for this?

fregatte · April 2, 2025, 8:30am

I’ve found the place where the error is being emitted, tried calling the url in Postman and was getting a 500 error for the problematic user, and 200 for a user who is able to login.

Can you share a request example to test it from our side, please?

zach · April 2, 2025, 9:08am

What Azure Region and Azure API Version are set in the top right settings?

fregatte · April 2, 2025, 9:19am

What Azure Region and Azure API Version are set in the top right settings?

I cannot find “Azure Region” field in the settings. “Azure API Version” set in “Microsoft Graph”.

zach · April 2, 2025, 9:54am

Older versions don’t have the option. You can try updating to a newer version of Pritunl and switching to Global (OAuth v1) or Global (OAuth v1). The version you have is likely using the legacy Azure AD Graph. From what I can find this will be disabled in June 2025.

lmvdz · April 2, 2025, 2:19pm

You can reconstruct the request using the code: https://auth.pritunl.com/update/azure/user=<email>&license=<license_key>&directory_id=<azure_tenant_id>&app_id=<azure_application_id>&app_secret=<azure_application_secret>

for a user that is working you’ll get 200, for a problematic user 500

lmvdz · April 2, 2025, 3:03pm

what is the latest version?

zach · April 2, 2025, 3:21pm

The latest stable release is v1.32.4181.41.

lmvdz · April 2, 2025, 3:28pm

Yes, just making sure we were on the latest, we have that option you talked about, we switched to Global v1, Microsoft Graph was already selected, and now able to complete the flow e2e. We also switched off the sso_bypass now.