Currently, I have an instance of Canonical Landscape installed and I would like to change the authentication method to use ADFS 2016 via OpenID.

However, Landscape offers these two configurations in services.conf:

openid-provider-url = https://login.ubuntu.com/
openid-logout-url = https://login.ubuntu.com/+logout

If I append the following url:

openid-provider-url = https://<my_adfs_server>/adfs/oauth2/authorize/

I Get the error:

Error in discovery: Error fetching XRDS document: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)>

Installing the ADFS certificate does not solve my problem and as there is no place for me to configure the clientId from ADFS OpenID.

How is it possible to integrate Landscape with ADFS via OpenID?

*PAM is not an option, because I can't connect directly to AD.


The landscape can be configured to use OpenID and works by default with UbuntuSSO. It can be configured as per https://help.landscape.canonical.com/LDS/ReleaseNotes12.09#OpenID_support

ADFS 2016 is using "OpenID Connect" which is different from "OpenID" used with Landscape. Unfortunately, at this time Landscape does not support "OpenID Connect"

Here is more about the differences: https://security.stackexchange.com/questions/44611/difference-between-oauth-openid-and-openid-connect-in-very-simple-term

Hope this will help


And.... From release 19.10, Landscape can use OpenID-Connect (OIDC) to authenticate users. https://docs.ubuntu.com/landscape/en/onprem-auth#openid-connect-support

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.