Received HTTP404 (resource has been removed) during redirection from IDSRV4 to MVC App

[kenneth-y]

Hi,

I am working on an ASP.net core Web API, and MVC applications. Using IdentityServer4 as the authentication/STS. All these applications are deployed in Azure App Service.

I configured IDSRV4 to authenticate users using Microsoft (AAD) and Google authentication (hybrid flow). It was working fine before but recently I noticed after authenticating from Microsoft (AAD), I encountered the error below

Looking at the browser's console log it shows an HTTP 404 was received.

IDSRV4 log snippet

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=12fecc9f-0573-4668-9771-87ba00b9a51d&scope=https%3A%2F%2Fgraph.microsoft.com%2Fuser.read&response_type=code&redirect_uri=https%3A%2F%2Fidsrv4-qa.azurewebsites.net%2Fsignin-microsoft&state=CfDJ8Et3BndeKKpJgNE_2aNYEUmjiaBEdG_RLmhuF-vZJdw1hrveB_DqkEtKyG971FNzgWgiIGFgbrMvWIjQBcIX9XPbKK47M_0BhA7pccfY_649hUQRI2uXqdUOM1jsmngk_HN2N0I031oVmRXzBgJ_Na6vkuZiM14JTUyJL3KGUc8qVpS8mBxxkZxe0xP46DsshAiEuY2FCbf7ViPtO1UF73h2Ne5V4wsdfk4YssYojWYhVU5EH30LM_A91iJ0gFvhwZ7TEzMfWWskqHfrd5qWCEQMkT4wO7qVAqeAO0nlB5aZ00nV1pGXHtP62MU5eBvYYbJ6z12vgdVbjwJWxPhKfUkbvO7nZ9mPjmoXGLHYICB6H9BGG3TfqfdgoSuLRYs3XnDLOFQAjCQf7oX-ABVu8lhvNgo0oMcRreGYsMp1gTWUdyV1pTicIrJNtMOH9Kx8jkenFe0uMAdXiqIXOrcB-ILwsbsKUbFPWM20wtuhvR4pmlSttuK0cjidUw0EjyD91I2kgXiYDaY0b2_XsE2KeHsmoq0BboM7kDtAbGMcgcHPwMxwg_BIZrOErSfMXmjh8FUjsY8dYt0z4JPVmKJlHZKkbNamHy-udxW2cIWuIS-Gso16Ccm7rBVnMPhSa7kv8NXjKV6aEKAJf6yh-cXeHoVKcVy_hZKyXNCwK2NTppT_e1YK0T_x0XLSxgVzAl7nnTEoz5WUtHtM6yjpREMsdcu_sCXBsRStChzQlUXvu5ZxFqY-PiXiZgZXLvWTaYbQYD2ZAjWVxNd4JwMyi6P9hJNC7YzDRa0cnCZRQKYPc4mpzR_qX2VGr8QbOnRNB-cGZCIE2SQmhY-nXI2cEefJpAHB9BaDFYYBuA6ulJvdopYZd0tbBRMl9LSZS91pw2WMG2EhkRgLaJAgbOevOT3uNdlI1LsHZkYmSJekMLQnErcdBNMBjx9LvCFpdmsI47dZqRMiaBnxwNckbSmzEiHJI0c2YbHK9FesaeG_ulEYWAplyFFLTP1laoEhUklpb9vcqC2JKqLAVhI2udyC-rwbKzhNB-OsBIE1d-aMODFwQFdfGY8b5WNHli8Mnm-HMLJnUm_8PrCve5U8CE10moepV-2zncwVAcZ67HQ9A1c9pE_iaBazLiWMIWwla-VakyXZFt6FZ3XFiBldv8pNuQFErFCCymYgaBpE150sWHJaRWuwpsqQmz6RYrMObjj6OFqMDWs03uNU8xevs_OG0CRY79c0leSG1bzu7pp0x7HUBnM1XDfNN9AaOEQQRg19BZtAyFhP5IdyMGdTubU_CGkx8-fgXFN1ecmZ9O9qmnc8IYBVgzq06LvgZX9Xyrbo4q-p6w idsrv4-qa.azurewebsites.net 404 15 0 436 9022 15

However, if i browse to that URL from the address bar (by copying then paste and go), I am successfully redirected to my MVC App.

By the way Google authentication works fine (redirected successfully to MVC app after authentication).

Appreciate any inputs and suggestions on this. Thanks.

[brockallen]

No logs? Also, how did you get the redirect URI/path of ~/signin-microsoft -- I assume you configured some middleware that way?

[kenneth-y]

@brockallen i got the redirect URL from IDSRV4 log.

in apps.dev.microsoft.com portal, i have the "signin-microsoft" indicated in the redirect url

Allow Implicit Flow: Enabled
Redirect URLs: https://idsrv4-demo-qa.azurewebsites.net/signin-microsoft

I have this in my IDSRV4 "Configure()" method

app.UseMicrosoftAccountAuthentication(new MicrosoftAccountOptions()
{
AuthenticationScheme = "Microsoft",
DisplayName = "Microsoft Azure",
SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,
ClientId = [MICROSOFT_CLIENT_ID],
ClientSecret = [MICROSOFT_CLIENT_SECRET]
});

is it ok if i send u the logs via e-mail? thanks

[brockallen]

UseMicrosoftAccountAuthentication

Hmm, I don't know then. Sounds like this might be more of a Microsoft question and not really anything related to IdentityServer. I'd try to build a stand-alone app that uses this to connect to AAD and then repro it. Once you do that, send it to Microsoft.

is it ok if i send u the logs via e-mail? thanks

No, sorry -- we don't offer free support via email.

[kenneth-y]

thanks @brockallen. i will try as what you suggested.

[brockallen]

I bet there's an exception in the MW on the redirect back from the IdP to your app and it's being suppressed or not handled in some way.

[leastprivilege]

Any update on the issue? closing for now - feel free to re-open if it needs further discussion.

[kenneth-y]

@leastprivilege sorry, it took me a long time to update on this. i believe its a non-IS4 issue. it seems related to IIS max query string length (2048).

[davewasthere]

This is a problem with the middleware. I think it's just due to too much state being passed around. IS4 already suggest a fix for this though: http://docs.identityserver.io/en/latest/topics/signin_external_providers.html#state-url-length-and-isecuredataformat

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.