Configuring OIDC SSO for organization with multi geo database environments

David Shibuya

Dear Community,

Having some issues configuring OIDC Single Sign On. We are using Microsoft Entra (AzureAD) as our identity provider and authenticating using ID token. We feel this is probably a fairly common config amongst the community. Would anybody be able to confirm the redirect URL for such a config? We are using:

Our mapped attributes are:

NameID == userPrincipalName

Email == mail

firstname == givenName

lastname == surname

The config seems to be correct on the Azure side, and the app logs a successfull authentication attempt. However, when redirected back to the URL above, BB returns a generic error. See image:

We've also tried config using PSK/application secret code to authenticate, but that did not seem to make a difference. We feel that there may be a different/additional redirect URL required for organizations in a multi geo/ multi database situation, as there's sometimes an intermediate page that requires the user to select the database environment, based on what their provisioned to. Any guidance would be greatly appreciated.

Joe Killian

• @David Shibuya
  
  I can't offer any direct advice, other than to point out that BBID has had multiple failures over the past week; could it be your testing aligned with one these issues?
  
  Active Issue Alert – Blackbaud ID – Multiple Products - 000554245; 9/18
• Active Issue Alert – Blackbaud ID, Financial Edge NXT, Raiser's Edge NXT - #000553809, 9/18
• Active Issue Alert – Email Services - 000553756, 9/17
• Active Issue Alert – signin.blackbaud.com, Raiser's Edge NXT, Financial Edge NXT, Education Management, eTapestry, other products - 000553554, 9/16
• Active Issue Alert – Blackbaud ID – Multiple Products - 000552790, 9/12
• Active Issue Alert – Multiple Products - 000552296, 9/11

David Shibuya

Thanks, @Joe Killian. I don't think it's a related issue, but appreciate the links. I did find this KB that mentioned that OIDC SSO needs to be configured and tested using a BBID account that is OUTSIDE of the claimed domain:

Troubleshooting FAQs - Blackbaud Single Sign-On

We're going to try this and update the topic on the result. Appreciate your effort!

David Shibuya

@Joe Killian UPDATE:

Blackbaud's internal team verified what the config needs to be. For organizations using Azure as their IDP, the correct token claims mapping is:

NameId ←→ sub

Email ←→ email

I just tried it and confirmed it works. Also pls note that the redirect URI for OIDC using token ID (which is not published by Blackbaud for some reason) is:

Hope this helps others!

Joe Killian

@David Shibuya Thanks for posting an update!