Digital Ocean Team SSO with Entra ID - Work Around?

Question

So SSO is supported for DO Teams, which is nice for us as we are looking to move some existing applications into the platform, however the IDP instructions shown in the docs doesn’t include Entra ID (Major IDP used by MS365/Azure).

Tried to configure it anyway - as OIDC is an open standard so figured it was worth a try- however it seems to not work ‘out of the box’.

Checking the logs in dev tools shows:


https://cloud.digitalocean.com/sessions/sso/callback?error=invalid_client&error_description=AADSTS650053%3a+The+application+%27Digital+Ocean%27+asked+for+scope+%27groups%27+that+doesn%27t+exist+on+the+resource+%2700000003-0000-0000-c000-000000000000%27.+Contact+the+app+vendor

The ‘missing’ ‘groups’ scope aligns with the Microsoft docs, and what we see in our tenant when configure app API permissions (OpenID Permissions includes only email, offline_access, openid & profile).

Looking at the OpenID spec,the groups claim being requested is not a standard claim per the spec, which would explain why it is not present in Entra. Entra (correctly) doesn’t list ‘groups’ in the ‘scopes_supported’ section of the discover endpoint (provider URL) configured in the Digital Ocean SSO settings.

Has anyone else run into this with Entra or other IDPs with DO Teams and have a work around?

alexdo · Answer

I believe DigitalOcean’s OIDC implementation expects openid, email, profile, team_role, and groups as scopes, and it’s requesting groups as a literal OAuth scope, which Entra ID doesn’t support because Entra treats group membership as a claim, not a scope. You’re not the first to hit this specific mismatch, other OIDC clients that hardcode a groups scope request run into the same wall against Entra ID for the same reason. Worth testing with a user in a small number of groups first, Entra ID’s group overage behavior kicks in above a certain group count and swaps the claim for a reference to the Graph API instead of the actual group list, which DigitalOcean’s OIDC handling likely won’t follow through on. Setting the groups claim to “groups assigned to the application” rather than all groups avoids that if it’s a risk for your tenant. Hope that this helps!

Bobby · Answer

Hi there, Good analysis and alexdo is right on the root cause. DigitalOcean’s SSO implementation is hardcoding a groups scope in the OIDC request, which is not a standard scope and Entra ID correctly rejects it. There is no clean workaround on the client side since you cannot control what scopes DigitalOcean requests. The realistic options are: If you have an Okta or Google Workspace tenant available, those are the IDPs that work out of the box with DigitalOcean SSO since they support the groups scope as expected. If Entra ID is a hard requirement, this is worth raising as a support ticket and a feature request at https://ideas.digitalocean.com . The fix needs to happen on DigitalOcean’s side, either by making the groups scope optional or by supporting Entra’s approach of groups as claims rather than scopes. The more teams request this, the more likely it gets prioritized given how common Entra ID is in enterprise environments.

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

Digital Ocean Team SSO with Entra ID - Work Around?

Related questions

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?

How To Set Up an Endlessh Tarpit on Ubuntu 22.04

Issues with SSH Access After Changing Firewall Settings

Accessing Connecting Public Client IP in App Platform

Report this

Digital Ocean Team SSO with Entra ID - Work Around?

Related questions

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?

How To Set Up an Endlessh Tarpit on Ubuntu 22.04

Issues with SSH Access After Changing Firewall Settings

Accessing Connecting Public Client IP in App Platform