Feature Request: Support SAML2 or OIDC with PKCE for Entra ID Authentication (Client Secret is being phased out by Microsoft)
Feature Request: Modernize Entra ID Integration to Eliminate Client Secret Dependency
The current Entra ID integration relies on OpenID Connect (OIDC) using a client secret. Since client secrets expire, administrators must track expiration dates and periodically update credentials to avoid authentication failures. This introduces operational overhead and unnecessary risk, particularly in enterprise environments where long-term reliability and low-maintenance integrations are expected.
I recommend implementing one of the following approaches:
-
Support SAML 2.0 for Entra ID integration
- SAML is widely adopted in enterprise environments and can eliminate the dependency on expiring client secrets.
- This provides a more stable and maintenance-friendly authentication method for organizations with established identity management practices.
-
Support OIDC Authorization Code Flow with PKCE
- PKCE provides a modern and secure authentication mechanism without requiring a client secret.
- This approach aligns with current OAuth 2.0 security recommendations and reduces administrative burden while maintaining strong security.
Business Impact
- Eliminates authentication outages caused by expired client secrets.
- Reduces administrative overhead for IT teams.
- Improves suitability for enterprise deployments.
- Aligns the product with Microsoft's recommended direction for identity integrations.
- Enhances security by reducing reliance on static credentials.
Microsoft Guidance
Microsoft is actively encouraging organizations to move away from client secrets and adopt more secure authentication methods such as certificates, managed identities, and federated credentials:
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/migrate-applications-from-secrets
As Microsoft continues to phase out client secret-based authentication in favor of stronger alternatives, supporting SAML 2.0 and/or OIDC with PKCE would help future-proof the platform and better align it with modern identity management best practices.