Open OnDemand multifactor authentication MFA, 2FA with Microsoft Entra ID and Microsoft Authentificator

Posted on Mon 13 October 2025 by Pavlo Khmel

On Microsoft Entra ID add Enterprise application with URL to your Open OnDemand. For example: https://ood.example.com/oidc

Three pieces of information are needed for Open OnDemand:

  • Client Secret: NNN8Q~4444444444pa4wAww79rBrmNOaYYYYYYYY
  • Client ID: 22222222-ffff-4444-aaaa-333333333333
  • Tenant ID: 99999999-8888-4444-aaaa-cccccccccccc

Tenant ID is used in URL template: https://login.microsoftonline.com/{TenantID}/.well-known/openid-configuration

Add these lines to /etc/ood/config/ood_portal.yml

oidc_uri: "/oidc"

oidc_provider_metadata_url: https://login.microsoftonline.com/99999999-8888-4444-aaaa-cccccccccccc/v2.0/.well-known/openid-configuration

oidc_client_id: "22222222-ffff-4444-aaaa-333333333333"

oidc_client_secret: "NNN8Q~4444444444pa4wAww79rBrmNOaYYYYYYYY"

user_map_match: '^([^@]+)@.*$'

NOTE: You may need to user_map_match to map users. I needed.

Generate new Open OnDemand config and reload httpd:

/opt/ood/ood-portal-generator/sbin/update_ood_portal
systemctl reload httpd

Optional 1:

While testing it is possible to change these lines manually in the file /etc/httpd/conf.d/ood-portal.conf

  OIDCProviderMetadataURL https://login.microsoftonline.com/99999999-8888-4444-aaaa-cccccccccccc/v2.0/.well-known/openid-configuration

  OIDCClientID 22222222-ffff-4444-aaaa-333333333333

  OIDCClientSecret NNN8Q~4444444444pa4wAww79rBrmNOaYYYYYYYY

  OIDCRedirectURI /oidc

And reload HTTPD:

systemctl reload httpd

Optional 2:

It is possible to configure Microsoft Entra ID to return user name in different forms: email, full name, short, and so on by changing: OIDCRemoteUserClaim.

But by default most of them are not configured on Entra ID side.

Example with preferred_username:

# cat /etc/httpd/conf.d/ood-portal.conf
. . .
OIDCRemoteUserClaim preferred_username
. . .
  SetEnv OOD_USER_MAP_MATCH "^([^@]+)@.*$"
. . .

Possible OIDCRemoteUserClaim here: https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims-reference#v10-and-v20-optional-claims-set