Redeem authCode failing with error in v2.5.0

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

2.5.0

Web app

Sign-in users, when the appsetting.json contain "ResponseType": "code",

Description

After upgrading to 2.5.0 signIn is not working anymore.
It's failing with

OpenIdConnectProtocolException: Message contains error: 'invalid_client', error_description: 'AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. Trace ID: f230550d-2015-4e89-a234-a98a4b718000 Correlation ID: 33e33f36-5a76-4b3d-b8f7-5c56e1724fe7 Timestamp: 2023-03-01 09:56:57Z', error_uri: 'https://login.microsoftonline.com/error?code=7000218'.

although ClientSecret is set in options.

Reproduction steps

just migrate to 2.5.0 and application which overrides the "ResponseType": "code"

Error message

OpenIdConnectProtocolException: Message contains error: 'invalid_client', error_description: 'AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. Trace ID: f230550d-2015-4e89-a234-a98a4b718000 Correlation ID: 33e33f36-5a76-4b3d-b8f7-5c56e1724fe7 Timestamp: 2023-03-01 09:56:57Z', error_uri: 'https://login.microsoftonline.com/error?code=7000218'.

Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)
Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

Id Web logs

No response

Relevant code snippets

none

Regression

1.26.0

Expected behavior

Client_assertion/secret parameter is send with redeemCode request.

same here

Michael Pröpster (@michiproep)

Michael Pröpster (@michiproep) Konrad Schartner (@MrCodeB2)
very strange. How is your appsettings.json?
We'll have a look, but meanwhile, as a workaround, do you want to replace the "ClientSecret" configuration by the following block (there is an array as we now allow a series of client credentials, including certificates, workload identity federation etc ...)

"ClientCredentials": [
   {
    "SourceType": "ClientSecret",
    "ClientSecret": "***"
   }
  ]

Jean-Marc Prieur (@jmprieur)

Hi Jean-Marc Prieur (@jmprieur) ,
sorry, no luck. Did not help.

can confirm this makes it impossible for users to login. Only thing that helped is reverting back to 1.26.0

Michael Pröpster (@michiproep)

Michael Pröpster (@michiproep) @Jonathan-a35y Konrad Schartner (@MrCodeB2)
Is it a blazor app? in which case did you read :
https://github.com/AzureAD/microsoft-identity-web/wiki/web-app-troubleshooting#aadsts54005-oauth2-authorization-code-was-already-redeemederror ?

No, it's a plain asp.net core mvc app.
I already send the example app within my email. Remember?

Michael Pröpster (@michiproep)

Michael Pröpster (@michiproep) would you be able to share a repro?

Using both Microsoft.Identity.Web and Microsoft.identity.Web.UI.

Issue is with scaffolded templates (dotnet new razor2), but the main points are listed below. Secret is not used on last packages, but is on 1.*.

Program.cs

builder.Services
    .AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

appsettings.json

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "myprivatetenant.onmicrosoft.com",
    "TenantId": "random_guid",
    "ClientId": "random_guid",
    "ClientSecret": "my_super_secret",
    "ResponseType": "code",
    "CallbackPath": "/signin-oidc",
    "ClientCredentials": [
      {
        "SourceType": "ClientSecret",
        "ClientSecret": "my_super_secret"
      }
    ]
  },

}

+1, confirmed this breaks sign-in for an ASP.NET Core Web App that is configured to call the Graph API downstream. Downgrading to 1.26.0 fixes it.

In the appsettings.json you should have either the ClientSecret, or the client credentials of SourceType: ClientSecret, but not both.
Did you set the secret programmatically? or by configuration?

Michael Pröpster (@michiproep)

Michael Pröpster (@michiproep) Paul Irwin (@paulirwin) Konrad Schartner (@MrCodeB2) Dzenan Dumpor (@Dzeneralen) @Jonathan-a35y
FYI, we were able to repro, and jennyf19 has a fix.

we updated slightly the title and the description of the bug with the repro steps.

fix #2096 auth code redemption issue

GitHub automatically closed this, reopening. This will be in the 2.6.1 release which should be out this week 3/23-3/24.

Included in the 2.6.1 release

I can confirm that this is working now.
But unfortunately, the version 2.6.1 introduced additional bugs:
It's about setup and handling OpenIdConnect events.
First of all, it's not clear how we can setup the eventHandler with the new version:

Configure vs PostConfigure
OpenIdConnectOptions vs MicrosoftIdentityOptions
with or without named options

and second:
It seems like once I'm able to catch the event (currently only via PostConfigure), it get's called multiple times, it breaks the DI scope (e.g. DbContext gets disposed), async await not working anymore.

Sorry to say, but these 2.x versions are a complete mess currently.

Michael Pröpster (@michiproep)

Michael Pröpster (@michiproep)
Thanks for the feedback.

As we explained in the release notes, you need to setup your event handlers with the named options (the authentication scheme). You can use OpenIdConnectOptions or MicrosoftIdentityOptions (OpenIdConnectOptions is more performant).

Please see:
https://github.com/AzureAD/microsoft-identity-web/wiki/v2.0#breaking-changes-1

We can also help you better if you share repro code (when we met, you said you would). If you'd rather meet again, just let us know. We can too.

Jean-Marc Prieur (@jmprieur)

Jean-Marc Prieur (@jmprieur) Although, I did send you the code twice already, I now created a repo and send the link via email...

Regarding my last comment, there are some additional issues created by other users now.
e.g. 1992

fix AzureAD#2096 auth code redemption issue (AzureAD#2139)

Navigation Menu

Repository navigation

Redeem authCode failing with error in v2.5.0 #2096

Microsoft.Identity.Web Library

Microsoft.Identity.Web version

Web app

Description

Reproduction steps

Error message

Id Web logs

Relevant code snippets

Regression

Expected behavior

Program.cs

appsettings.json

9 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Redeem authCode failing with error in v2.5.0 #2096

Description

Microsoft.Identity.Web Library

Microsoft.Identity.Web version

Web app

Description

Reproduction steps

Error message

Id Web logs

Relevant code snippets

Regression

Expected behavior

Activity

MrCodeB2 commented on Mar 2, 2023

jmprieur commented on Mar 3, 2023

michiproep commented on Mar 3, 2023

jonathan-vogel-siemens commented on Mar 9, 2023

jmprieur commented on Mar 9, 2023

michiproep commented on Mar 9, 2023

jmprieur commented on Mar 9, 2023

Dzeneralen commented on Mar 14, 2023

Program.cs

appsettings.json

paulirwin commented on Mar 16, 2023

jmprieur commented on Mar 17, 2023

9 remaining items

jmprieur commented on Mar 23, 2023

jennyf19 commented on Mar 23, 2023

westin-m commented on Mar 23, 2023

michiproep commented on Mar 25, 2023

jmprieur commented on Mar 26, 2023

michiproep commented on Mar 27, 2023

michiproep commented on Apr 17, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions