Repository: goauthentik/authentik

Issue:
Federation & Social Logins // OAuth - Azure AD // Unable to save settings
**Describe the bug**
See https://github.com/goauthentik/authentik/issues/7744
Problem still exists with release 2023.10.5

**To Reproduce**
Steps to reproduce the behavior:
See https://github.com/goauthentik/authentik/issues/7744

Neither on initial save or update afterwards 'Authorization URL', 'Access token URL ' and 'Profile URL' are changed

**Expected behavior**
A clear and concise description of what you expected to happen.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Logs**
Seem fine
server:
2023-12-22 11:30:41 {"action": "model_updated", "auth_via": "session", "client_ip": "172.18.0.1", "context": {"http_request": {"args": {}, "method": "PATCH", "path": "/api/v3/sources/oauth/azure-ad/", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}, "model": {"app": "authentik_sources_oauth", "model_name": "oauthsource", "name": "azure ad", "pk": "bda8c9beeac54e5495c8270838e7a797"}}, "event": "Created Event", "host": "localhost:8044", "level": "info", "logger": "authentik.events.models", "pid": 40, "request_id": "ff436debac13400e94274999b5f5d06d", "timestamp": "2023-12-22T10:30:41.555035", "user": {"email": "admin@compose-stack.seven2one.de", "pk": 3, "username": "Admin"}}
2023-12-22 11:30:41 {"auth_via": "session", "event": "Task published", "host": "localhost:8044", "level": "info", "logger": "authentik.root.celery", "pid": 40, "request_id": "ff436debac13400e94274999b5f5d06d", "task_id": "4ebe0d05335f4700b8c0871d6f10235c", "task_name": "authentik.events.tasks.event_notification_handler", "timestamp": "2023-12-22T10:30:41.568890"}
2023-12-22 11:30:41 {"auth_via": "session", "event": "/api/v3/sources/oauth/azure-ad/", "host": "localhost:8044", "level": "info", "logger": "authentik.asgi", "method": "PATCH", "pid": 40, "remote": "172.18.0.1", "request_id": "ff436debac13400e94274999b5f5d06d", "runtime": 396, "scheme": "http", "status": 200, "timestamp": "2023-12-22T10:30:41.572086", "user": "Admin", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}

**Version and Deployment (please complete the following information):**

-   authentik version: 2021.10.5
-   Deployment: docker-compose, helm

**Additional context**




Discussion:
Try the steps from https://github.com/goauthentik/authentik/issues/7744#issuecomment-1867022311
@BeryJu do we have a timeline of merging that into stable ? I am reluctant to diverge from stable branch as last time I have done it I have ended up reinstalling from scratch as the update from beta to stable broke things severely. Thanks !
`ghcr.io/goauthentik/dev-server:gh-version-2023.10` is not the beta version, it is the latest build of the version-2023.10 branch which is bugfixes cherry-picked on top of 2023.10.5

however there will most likely also be a new 2023.10 release
Updated to 10.6 but still seems not to be saving the URLs correctly - cuts out the tenant ID from the authorization and access token url. It does not spit the error anymore, but just comes back to this screen after the Azure auth:

<img width="530" alt="Screenshot 2024-01-11 at 11 03 52" src="https://github.com/goauthentik/authentik/assets/83865615/ba6a0e8c-673e-48ae-86f9-364574f7ddc8">

For some reason despite being authorised in Entra, it goes back to the enrollment flow

Resolving patch:
diff --git a/authentik/sources/oauth/api/source.py b/authentik/sources/oauth/api/source.py
--- a/authentik/sources/oauth/api/source.py
+++ b/authentik/sources/oauth/api/source.py
@@ -56,6 +56,7 @@ def get_type(self, instance: OAuthSource) -> SourceTypeSerializer:
         """Get source's type configuration"""
         return SourceTypeSerializer(instance.source_type).data
 
+    # pylint: disable=too-many-locals
     def validate(self, attrs: dict) -> dict:
         session = get_http_session()
         source_type = registry.find_type(attrs["provider_type"])
@@ -73,9 +74,17 @@ def validate(self, attrs: dict) -> dict:
             config = well_known_config.json()
             if "issuer" not in config:
                 raise ValidationError({"oidc_well_known_url": "Invalid well-known configuration"})
-            attrs["authorization_url"] = config.get("authorization_endpoint", "")
-            attrs["access_token_url"] = config.get("token_endpoint", "")
-            attrs["profile_url"] = config.get("userinfo_endpoint", "")
+            field_map = {
+                # authentik field to oidc field
+                "authorization_url": "authorization_endpoint",
+                "access_token_url": "token_endpoint",
+                "profile_url": "userinfo_endpoint",
+            }
+            for ak_key, oidc_key in field_map.items():
+                # Don't overwrite user-set values
+                if ak_key in attrs and attrs[ak_key]:
+                    continue
+                attrs[ak_key] = config.get(oidc_key, "")
             inferred_oidc_jwks_url = config.get("jwks_uri", "")
 
         # Prefer user-entered URL to inferred URL to default URL


Test patch:
diff --git a/authentik/sources/oauth/tests/test_views.py b/authentik/sources/oauth/tests/test_views.py
--- a/authentik/sources/oauth/tests/test_views.py
+++ b/authentik/sources/oauth/tests/test_views.py
@@ -83,9 +83,6 @@ def test_api_validate_openid_connect(self):
                     "provider_type": "openidconnect",
                     "consumer_key": "foo",
                     "consumer_secret": "foo",
-                    "authorization_url": "http://foo",
-                    "access_token_url": "http://foo",
-                    "profile_url": "http://foo",
                     "oidc_well_known_url": url,
                     "oidc_jwks_url": "",
                 },