title: How can I debug oauth2_proxy when connecting to Azure B2C?
body: <p>I'm new to Kubernetes, and I've been learning about Ingress. I'm quite impressed by the idea of handling TLS certificates and authentication at the point of Ingress. I've added a simple static file server, and added cert-manager, so I basically have a HTTPS static website.</p>
  
  <p>I read that NGINX Ingress Controller can be used with oauth2 proxy to handle authentication at the ingress. The problem is that I can't get this working at all. I can confirm that my oauth2-proxy Deployment Service and Deployment are present and correct - in the Pod's log, I can see the requests coming through from NGINX, but I can't see what uri it is actually calling at Azure B2C. Whenever I try and access my service I get a 500 Internal error - if I put my /oath2/auth address in the browser, I get "The scope 'openid' specified in the request is not supported.". However if I Test run the user Flow in Azure, the test URL also specifies "openid" and it functions as expected.</p>
  
  <p>I think that I could work through this if I could find out how to monitor what oauth2-proxy requests from Azure (i.e. work out where my config is wrong by observing it's uri) - otherwise, maybe somebody that has done this can tell me where I went wrong in the config.</p>
  
  <p>My config is as follows:</p>
  
  <pre><code>apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      k8s-app: oauth2-proxy
    name: oauth2-proxy
    namespace: default
  spec:
    replicas: 1
    selector:
      matchLabels:
        k8s-app: oauth2-proxy
    template:
      metadata:
        labels:
          k8s-app: oauth2-proxy
      spec:
        containers:
        - args:
          - -provider=oidc
          - -email-domain=*
          - -upstream=file:///dev/null
          - -http-address=0.0.0.0:4180
          - -redirect-url=https://jwt.ms/
          - -oidc-issuer-url=https://&lt;tenant&gt;.b2clogin.com/tfp/&lt;app-guid&gt;/b2c_1_manager_signup/
          - -cookie-secure=true
          - -scope="openid"
  
          # Register a new application
          # https://github.com/settings/applications/new
          env:
          - name: OAUTH2_PROXY_CLIENT_ID
            value: &lt;app-guid&gt;
          - name: OAUTH2_PROXY_CLIENT_SECRET
            value: &lt;key-base64&gt;
          - name: OAUTH2_PROXY_COOKIE_SECRET
            value: &lt;random+base64&gt;
          image: quay.io/pusher/oauth2_proxy:latest
          imagePullPolicy: Always
          name: oauth2-proxy
          ports:
          - containerPort: 4180
            protocol: TCP
  ---
  
  apiVersion: v1
  kind: Service
  metadata:
    labels:
      k8s-app: oauth2-proxy
    name: oauth2-proxy
    namespace: default
  spec:
    ports:
    - name: http
      port: 4180
      protocol: TCP
      targetPort: 4180
    selector:
      k8s-app: oauth2-proxy
  ---
  apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: static1-oauth2-proxy
    namespace: default
    annotations:
      kubernetes.io/ingress.class: nginx
      kubernetes.io/tls-acme: "true"
  spec:
    rules:
    - host: cloud.&lt;mydomain&gt;
      http:
        paths:
        - backend:
            serviceName: oauth2-proxy
            servicePort: 4180
          path: /oauth2
    tls:
    - hosts:
      - cloud.&lt;mydomain&gt;
      secretName: cloud-demo-crt
  </code></pre>
  
  <p>In my static site ingress I have the following added to metadata.annotations:</p>
  
  <pre><code>    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
      nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$request_uri"
  </code></pre>
  
  <p>I'm not 100% sure whether these annotations should always be set as such, or whether I should have varies these for B2C/OIDC, but they seem to go off to the proxy, it's just what the proxy does next that fails.</p>
  
  <p>Note that the log does indicate that oauth2-proxy connected to B2C, indeed if the issuer uri changes, then it goes into a crash fallback loop.</p>
  
  <p>There seem to be anumber of articles about how to set this up, so I'm sure it's possible, but I got a little lost. If somebody could help with the setup or ideas for debugging, that would be wonderful.</p>
  
  <p>Thanks.</p>
  
  <hr>
  
  <p>Now I'm able to reliably get a ?state= and code= to display in the browser window on the /oauth2/callback page, but the page reports Internal Error. oauth2_proxy is logging when it should now, and the log says:</p>
  
  <p>[2020/06/03 21:18:07] [oauthproxy.go:803] Error redeeming code during OAuth2 callback: token exchange: oauth2: server response missing access_token</p>
  
  <p>My Azure B2C Audit log howwever says that it is issuing id_tokens.</p>
  
  <p>When I look at the source code to oauth2_proxy, it looks as though the problem occurs during oauth2.config.Exchange() - which is in the goloang library - I don't know what that does, but I don't think that it works properly with Azure B2c. Does anybody have an idea how I can progress from here?</p>
  
  <p>Thanks.</p>
  
  <p>Mark</p>