Update documentation

Author: liss-bot

docs/authentication/oidc.md

@@ -16,18 +16,19 @@ Dashy also supports using a general [OIDC compatible](https://openid.net/connect
 ```yaml
 appConfig:
   disableConfigurationForNonAdmin: true # Hide the config editor from non-admins (recommended)
-  enableGuestAccess: false              # Optional: view the dashboard read-only without signing in
   enableServiceWorker: true             # Optional: enables the PWA and offline support
   enableAuthProxyCompat: true           # Recover the PWA after a session expires (needs the service worker)
   auth:
     enableOidc: true                    # Turn OIDC on
+    enableGuestAccess: false            # Optional: view the dashboard read-only without signing in
     oidc:
       clientId: dashy                    # Client ID from your provider
       endpoint: https://auth.example.com/application/o/dashy/ # The issuer URL, not the .well-known one
       scope: openid profile email groups # Scopes to request (groups for adminGroup, roles for adminRole)
       adminGroup: dashy-admins           # Members of this group are admins
       adminRole: dashy-admin             # Or grant admin by role instead
       enableSilentRenew: true            # Refresh the session in the background before it expires
+      # allowedIssuers: []               # Only for multi-tenant providers to override discovery document
 ```
 
 Because Dashy is a SPA, a [public client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1) registration with PKCE is needed.
@@ -46,6 +47,20 @@ The claim has to be in the id_token, not just the access token. Most providers i
 
 If your admins aren't being picked up, decode the id_token (paste it into [jwt.io](https://jwt.io)) and check the claim is there.
 
+## Multi-tenant providers
+
+With a multi-tenant provider (e.g. Microsoft Entra's `organizations` / `common` endpoints), the issuer in the token doesn't match the one in the discovery document, so verification fails. Set `allowedIssuers` to the issuer URL(s) you want to accept:
+
+```yaml
+    oidc:
+      clientId: dashy
+      endpoint: 'https://login.microsoftonline.com/organizations/v2.0/'
+      allowedIssuers:
+        - 'https://login.microsoftonline.com/<your-tenant-id>/v2.0'
+```
+
+When set, tokens are accepted only if their `iss` matches one of these (signature, audience and expiry are still checked). Leave it unset for normal single-tenant providers.
+
 ## Guest access
 
 Set `enableGuestAccess: true` to let people view the dashboard read-only without signing in. They get the full config but can't save anything, and sections or items marked `hideForGuests` stay hidden. With it off (the default), anyone who isn't signed in is sent to the login flow.

docs/configuring.md

@@ -220,6 +220,7 @@ For more info, see the **[Authentication Docs](/docs/authentication)**
 **`adminGroup`** | `string` | _Optional_ | The group that will be considered as admin.
 **`scope`** | `string` | Required | The scope(s) to request from the OIDC provider
 **`enableSilentRenew`** | `boolean` | _Optional_ | If set to `true`, your session is silently renewed in the background before it expires (only works for providers which support the `offline_access` scope)
+**`allowedIssuers`** | `array` | _Optional_ | List of issuer URLs to accept tokens from. Needed for multi-tenant providers (e.g. Microsoft Entra) where the token issuer differs from the configured `endpoint`. If unset, the issuer from the discovery document is used
 
 ****[⬆️ Back to Top](#)****