Users via OIDC Before Blocking Access?"

Question

Users via OIDC Before Blocking Access?"

이용각 이용각 0

However, we would prefer not to show this default Microsoft error page. Instead, we want to redirect users to a custom login page or a message we define ourselves.

Could you please suggest a way to handle this scenario gracefully, so that blocked users are redirected to our own UI instead of encountering the Microsoft block page?

Additionally, on the backend server, how can I retrieve user information from a hybrid Azure AD-joined PC using a token or Kerberos ticket, without relying on OIDC calls?

1 answer

Your answer

Answer 1

Hi 이용각 이용각,

Thank you for contacting Q&A Forum. I would like to provide my findings and proposed solution:

Below is a two‑part answer addressing your concerns:

For Blocked Users: Intercept the OIDC authentication failure (using the middleware’s failure event or by configuring passive authentication) so that you can manually redirect users to your custom login or error page.

For Backend User Information: Enable Windows Integrated Authentication on your server to receive and validate Kerberos tickets from hybrid Azure AD‑joined PCs. Use the ticket’s validated identity to obtain user details directly, and consider constrained delegation (protocol transition) if your backend must access additional resources on behalf of the user.

Kindly let me know if this work for you and please let me know if you have any further question.

If I have answered your question, please accept this as answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,
Eric

이용각 이용각 0 Reputation points

2025-05-23T10:28:07.56+00:00

How can I intercept a failure in the middleware?

The IDP is Microsoft, and when initiating an OIDC request, users are redirected to the Microsoft login page. If the user is not registered, Azure shows a blocking page. Since the redirection has already occurred, we no longer have control over the flow, and this is not a VM hosted in Azure.

Additionally, obtaining and validating a Kerberos token is not feasible with our current infrastructure.

Share via

Users via OIDC Before Blocking Access?"

1 answer

Your answer