That was the moment it hit me—our MSA OpenID Connect (OIDC) integration was broken, and no one could sign in. Not the testers. Not the admins. Not the customers. The auth flow was stuck in a loop, tokens were expiring, and the redirect chain felt like it had no end.
MSA OpenID Connect is the key to building modern, secure authentication with Microsoft accounts. It extends OAuth 2.0 and adds an ID token in JWT format, which includes verified identity claims. But if you misconfigure a single parameter—issuer, scope, or redirect URI—you’ll be chasing invisible errors for days.
To make MSA OIDC work right, start with the discovery document at the .well-known/openid-configuration endpoint. This JSON config is the source of truth for URLs, supported features, and public keys. Never hardcode anything you can fetch dynamically. The authorization endpoint is where you send users to sign in. The token endpoint issues the access and ID tokens. The jwks_uri holds the signing keys.
Always request the openid scope along with any others you need, like email or profile. Without openid, you won’t get the ID token, which means you won’t have the user’s identity proof. When parsing the ID token, verify the signature using the public keys from the JWKS, check the aud, iss, and exp claims, and reject anything that fails validation. Security here is not optional.